1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
//go:build !integration
// +build !integration
package common
import (
"testing"
"github.com/stretchr/testify/assert"
)
type allowedImageTestCase struct {
image string
allowedImages []string
internalImages []string
expectedAllowed bool
}
//nolint:lll
var allowedImageTestCases = []allowedImageTestCase{
{image: "alpine", allowedImages: []string{"alpine"}, internalImages: []string{}, expectedAllowed: true},
{image: "alpine", allowedImages: []string{"ubuntu"}, internalImages: []string{}, expectedAllowed: false},
{image: "library/ruby", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: false},
{image: "library/ruby", allowedImages: []string{"**/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "library/ruby", allowedImages: []string{"**/*:*"}, internalImages: []string{}, expectedAllowed: false},
{image: "library/ruby", allowedImages: []string{"*/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "library/ruby", allowedImages: []string{"*/*:*"}, internalImages: []string{}, expectedAllowed: false},
{image: "library/ruby:2.1", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: false},
{image: "library/ruby:2.1", allowedImages: []string{"**/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "library/ruby:2.1", allowedImages: []string{"**/*:*"}, internalImages: []string{}, expectedAllowed: true},
{image: "library/ruby:2.1", allowedImages: []string{"*/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "library/ruby:2.1", allowedImages: []string{"*/*:*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/group/subgroup/ruby", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: false},
{image: "my.registry.tld/group/subgroup/ruby", allowedImages: []string{"my.registry.tld/**/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/group/subgroup/ruby", allowedImages: []string{"my.registry.tld/*/*"}, internalImages: []string{}, expectedAllowed: false},
{image: "my.registry.tld/group/subgroup/ruby", allowedImages: []string{"my.registry.tld/*/*/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/group/subgroup/ruby:2.1", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: false},
{image: "my.registry.tld/group/subgroup/ruby:2.1", allowedImages: []string{"my.registry.tld/**/*:*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/group/subgroup/ruby:2.1", allowedImages: []string{"my.registry.tld/*/*/*:*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/group/subgroup/ruby:2.1", allowedImages: []string{"my.registry.tld/*/*:*"}, internalImages: []string{}, expectedAllowed: false},
{image: "my.registry.tld/library/ruby", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: false},
{image: "my.registry.tld/library/ruby", allowedImages: []string{"my.registry.tld/**/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/library/ruby", allowedImages: []string{"my.registry.tld/*/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/library/ruby:2.1", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: false},
{image: "my.registry.tld/library/ruby:2.1", allowedImages: []string{"my.registry.tld/**/*:*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/library/ruby:2.1", allowedImages: []string{"my.registry.tld/*/*:*"}, internalImages: []string{}, expectedAllowed: true},
{image: "my.registry.tld/ruby", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: false},
{image: "my.registry.tld/ruby:2.1", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: false},
{image: "ruby", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: true},
{image: "ruby", allowedImages: []string{"**/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "ruby:2.1", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: true},
{image: "ruby:2.1", allowedImages: []string{"**/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "ruby:latest", allowedImages: []string{"*"}, internalImages: []string{}, expectedAllowed: true},
{image: "ruby:latest", allowedImages: []string{"**/*"}, internalImages: []string{}, expectedAllowed: true},
{image: "gitlab-runner-helper", allowedImages: []string{"alpine"}, internalImages: []string{"gitlab-runner-helper"}, expectedAllowed: true},
{image: "alpine", allowedImages: []string{}, internalImages: []string{}, expectedAllowed: true},
}
func TestVerifyAllowedImage(t *testing.T) {
logger := BuildLogger{}
for _, test := range allowedImageTestCases {
options := VerifyAllowedImageOptions{
Image: test.image,
OptionName: "",
AllowedImages: test.allowedImages,
InternalImages: test.internalImages,
}
err := VerifyAllowedImage(options, logger)
if test.expectedAllowed {
assert.NoError(t, err, "%q must be allowed by %q", test.image, test.allowedImages)
} else {
assert.Error(t, err, "%q must not be allowed by %q", test.image, test.allowedImages)
}
}
}
|
