Additional registry whitelisting

hack/lib/start.sh

@@ -155,11 +155,21 @@ readonly -f os::start::internal::configure_master
 #  - ETCD_PEER_PORT
 #  - USE_SUDO
 #  - MAX_IMAGES_BULK_IMPORTED_PER_REPOSITORY
+#  - ADDITIONAL_ALLOWED_REGISTRIES
 # Returns:
 #  - export ADMIN_KUBECONFIG
 #  - export CLUSTER_ADMIN_CONTEXT
 function os::start::internal::patch_master_config() {
 	local sudo=${USE_SUDO:+sudo}
+
+	readarray -t allowed_registries <<<"$(sed -n \
+		'/^imagePolicyConfig/,/^[^[:space:]]/s/.*domainName:\s*'"'"'\?\([^'"'"']\+\).*/\1/p' \
+		"${SERVER_CONFIG_DIR}/master/master-config.yaml")"
+	for reg in "${ADDITIONAL_ALLOWED_REGISTRIES[@]:-}"; do
+		[[ -z "${reg:-}" ]] && continue
+		allowed_registries+=( "${reg}" )
+	done
+
 	cp "${SERVER_CONFIG_DIR}/master/master-config.yaml" "${SERVER_CONFIG_DIR}/master/master-config.orig.yaml"
 	oc ex config patch "${SERVER_CONFIG_DIR}/master/master-config.orig.yaml" --patch="{\"etcdConfig\": {\"address\": \"${API_HOST}:${ETCD_PORT}\"}}" | \
 	oc ex config patch - --patch="{\"admissionConfig\": {\"pluginConfig\": {\"openshift.io/ImagePolicy\": {\"configuration\": {\"apiVersion\": \"v1\", \"executionRules\": [{\"matchImageAnnotations\": [{\"key\": \"images.openshift.io/deny-execution\", \"value\": \"true\"}], \"name\": \"execution-denied\", \"onResources\": [{\"resource\": \"pods\"}, {\"resource\": \"builds\"}], \"reject\": true, \"skipOnResolutionFailure\": true }], \"kind\": \"ImagePolicyConfig\" }, \"location\": \"\"}}}}" | \
@@ -168,7 +178,9 @@ function os::start::internal::patch_master_config() {
 	oc ex config patch - --patch="{\"etcdConfig\": {\"peerAddress\": \"${API_HOST}:${ETCD_PEER_PORT}\"}}" | \
 	oc ex config patch - --patch="{\"etcdConfig\": {\"peerServingInfo\": {\"bindAddress\": \"${API_HOST}:${ETCD_PEER_PORT}\"}}}" | \
 	oc ex config patch - --patch="{\"auditConfig\": {\"enabled\": true}}" | \
-	oc ex config patch - --patch="{\"imagePolicyConfig\": {\"maxImagesBulkImportedPerRepository\": ${MAX_IMAGES_BULK_IMPORTED_PER_REPOSITORY:-5}}}" > "${SERVER_CONFIG_DIR}/master/master-config.yaml"
+	oc ex config patch - --patch="{\"imagePolicyConfig\": {\"maxImagesBulkImportedPerRepository\": ${MAX_IMAGES_BULK_IMPORTED_PER_REPOSITORY:-5}}}" | \
+	oc ex config patch - --patch="{\"imagePolicyConfig\":{\"allowedRegistriesForImport\":[$(echo "${allowed_registries[@]}" | xargs printf '{"domainName":"%s"},' | sed 's/,$//')]}}" \
+	> "${SERVER_CONFIG_DIR}/master/master-config.yaml"
 
 	# Make oc use ${MASTER_CONFIG_DIR}/admin.kubeconfig, and ignore anything in the running user's $HOME dir
 	export ADMIN_KUBECONFIG="${MASTER_CONFIG_DIR}/admin.kubeconfig"

hack/test-cmd.sh

@@ -68,6 +68,8 @@ fi
 # profile the web
 export OPENSHIFT_PROFILE="${WEB_PROFILE-}"
 
+export ADDITIONAL_ALLOWED_REGISTRIES=( "172.30.30.30:5000" "myregistry.com" "registry.centos.org" )
+
 os::start::configure_server
 
 os::test::junit::declare_suite_start "cmd/version"

pkg/image/admission/fake/fake.go

@@ -0,0 +1,17 @@
+package fake
+
+import (
+	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+)
+
+type ImageStreamLimitVerifier struct {
+	ImageStreamEvaluator func(ns string, is *imageapi.ImageStream) error
+	Err                  error
+}
+
+func (f *ImageStreamLimitVerifier) VerifyLimits(ns string, is *imageapi.ImageStream) error {
+	if f.ImageStreamEvaluator != nil {
+		return f.ImageStreamEvaluator(ns, is)
+	}
+	return f.Err
+}

pkg/image/admission/testutil/util.go

@@ -30,18 +30,6 @@ func MakeDockerImageReference(ns, isName, imageID string) string {
 	return fmt.Sprintf("%s/%s/%s@%s", InternalRegistryURL, ns, isName, imageID)
 }
 
-type FakeImageStreamLimitVerifier struct {
-	ImageStreamEvaluator func(ns string, is *imageapi.ImageStream) error
-	Err                  error
-}
-
-func (f *FakeImageStreamLimitVerifier) VerifyLimits(ns string, is *imageapi.ImageStream) error {
-	if f.ImageStreamEvaluator != nil {
-		return f.ImageStreamEvaluator(ns, is)
-	}
-	return f.Err
-}
-
 // GetFakeImageStreamListHandler creates a test handler that lists given image streams matching requested
 // namespace. Additionally, a shared image stream will be listed if the requested namespace is "shared".
 func GetFakeImageStreamListHandler(t *testing.T, iss ...imageapi.ImageStream) clientgotesting.ReactionFunc {

pkg/image/apis/image/test/conversion_test.go

@@ -7,8 +7,8 @@ import (
 	"k8s.io/apimachinery/pkg/util/diff"
 	"k8s.io/kubernetes/pkg/api/legacyscheme"
 
+	"github.com/openshift/api/image/v1"
 	newer "github.com/openshift/origin/pkg/image/apis/image"
-	"github.com/openshift/origin/pkg/image/apis/image/v1"
 
 	_ "github.com/openshift/origin/pkg/image/apis/image/install"
 )

pkg/image/apis/image/validation/fake/fake.go

@@ -0,0 +1,25 @@
+package fake
+
+import (
+	imageapi "github.com/openshift/origin/pkg/image/apis/image"
+	"github.com/openshift/origin/pkg/image/apis/image/validation/whitelist"
+)
+
+type RegistryWhitelister struct{}
+
+func (rw *RegistryWhitelister) AdmitHostname(host string, transport whitelist.WhitelistTransport) error {
+	return nil
+}
+func (rw *RegistryWhitelister) AdmitPullSpec(pullSpec string, transport whitelist.WhitelistTransport) error {
+	return nil
+}
+func (rw *RegistryWhitelister) AdmitDockerImageReference(ref *imageapi.DockerImageReference, transport whitelist.WhitelistTransport) error {
+	return nil
+}
+func (rw *RegistryWhitelister) WhitelistRegistry(hostPortGlob string, transport whitelist.WhitelistTransport) error {
+	return nil
+}
+func (rw *RegistryWhitelister) WhitelistPullSpecs(pullSpec ...string) {}
+func (rw *RegistryWhitelister) Copy() whitelist.RegistryWhitelister {
+	return &RegistryWhitelister{}
+}