From 350e17e5ac619e6c26995207eacc7f3ae71a8be8 Mon Sep 17 00:00:00 2001 From: Denny Hoang Date: Thu, 28 Apr 2022 09:49:06 -0400 Subject: [PATCH] early return err; add signaturePullSecrets comment Signed-off-by: Denny Hoang --- .../cosigned/v1alpha1/clusterimagepolicy_types.go | 3 +++ pkg/cosign/kubernetes/webhook/validator.go | 14 ++++++++------ pkg/cosign/kubernetes/webhook/validator_test.go | 2 +- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/pkg/apis/cosigned/v1alpha1/clusterimagepolicy_types.go b/pkg/apis/cosigned/v1alpha1/clusterimagepolicy_types.go index c7f7292a210..c4a6329e279 100644 --- a/pkg/apis/cosigned/v1alpha1/clusterimagepolicy_types.go +++ b/pkg/apis/cosigned/v1alpha1/clusterimagepolicy_types.go @@ -115,6 +115,9 @@ type KeyRef struct { type Source struct { // +optional OCI string `json:"oci,omitempty"` + // SignaturePullSecrets is an optional list of references to secrets in the + // same namespace as the deploying resource for pulling any of the signatures + // used by this Source. // +optional SignaturePullSecrets []v1.LocalObjectReference `json:"signaturePullSecrets,omitempty"` } diff --git a/pkg/cosign/kubernetes/webhook/validator.go b/pkg/cosign/kubernetes/webhook/validator.go index 3e8fe3965a5..d1a2454fd1a 100644 --- a/pkg/cosign/kubernetes/webhook/validator.go +++ b/pkg/cosign/kubernetes/webhook/validator.go @@ -322,7 +322,7 @@ func ValidatePolicy(ctx context.Context, namespace string, ref name.Reference, c name string attestations map[string][]PolicySignature signatures []PolicySignature - errs []error + err error } results := make(chan retChannelType, len(cip.Authorities)) for _, authority := range cip.Authorities { @@ -337,7 +337,9 @@ func ValidatePolicy(ctx context.Context, namespace string, ref name.Reference, c signaturePullSecretsOpts, err := authority.SourceSignaturePullSecretsOpts(ctx, namespace) if err != nil { - result.errs = append(result.errs, err) + result.err = err + results <- result + return } authorityRemoteOpts = append(authorityRemoteOpts, signaturePullSecretsOpts...) @@ -345,14 +347,14 @@ func ValidatePolicy(ctx context.Context, namespace string, ref name.Reference, c // We're doing the verify-attestations path, so validate (.att) validatedAttestations, err := ValidatePolicyAttestationsForAuthority(ctx, ref, authority, authorityRemoteOpts...) if err != nil { - result.errs = append(result.errs, err) + result.err = err } else { result.attestations = validatedAttestations } } else { validatedSignatures, err := ValidatePolicySignaturesForAuthority(ctx, ref, authority, authorityRemoteOpts...) if err != nil { - result.errs = append(result.errs, err) + result.err = err } else { result.signatures = validatedSignatures } @@ -376,8 +378,8 @@ func ValidatePolicy(ctx context.Context, namespace string, ref name.Reference, c continue } switch { - case len(result.errs) > 0: - authorityErrors = append(authorityErrors, result.errs...) + case result.err != nil: + authorityErrors = append(authorityErrors, result.err) case len(result.signatures) > 0: policyResult.AuthorityMatches[result.name] = AuthorityMatch{Signatures: result.signatures} case len(result.attestations) > 0: diff --git a/pkg/cosign/kubernetes/webhook/validator_test.go b/pkg/cosign/kubernetes/webhook/validator_test.go index feae66c2c66..183ef8e7bd1 100644 --- a/pkg/cosign/kubernetes/webhook/validator_test.go +++ b/pkg/cosign/kubernetes/webhook/validator_test.go @@ -531,7 +531,7 @@ UoJou2P8sbDxpLiE/v3yLw1/jyOrCPWYHWFXnyyeGlkgSVefG54tNoK7Uw== return errs }(), - cvs: authorityPublicKeyCVS, + cvs: fail, }, { name: "simple, no error, authority source signaturePullSecrets, valid secret", ps: &corev1.PodSpec{