Add the default image policy to bootstrap bindata

Author: smarterclayton

pkg/bootstrap/bindata.go

@@ -15,13 +15,16 @@ import (
 	"k8s.io/kubernetes/pkg/runtime"
 	"k8s.io/kubernetes/pkg/util"
 	"k8s.io/kubernetes/pkg/util/sets"
+	"k8s.io/kubernetes/pkg/util/yaml"
 
+	"github.com/openshift/origin/pkg/bootstrap"
 	"github.com/openshift/origin/pkg/cmd/flagtypes"
 	"github.com/openshift/origin/pkg/cmd/server/admin"
 	configapi "github.com/openshift/origin/pkg/cmd/server/api"
 	configapiv1 "github.com/openshift/origin/pkg/cmd/server/api/v1"
 	"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
 	cmdutil "github.com/openshift/origin/pkg/cmd/util"
+	imagepolicyapi "github.com/openshift/origin/pkg/image/admission/imagepolicy/api"
 	"github.com/spf13/cobra"
 )
 
@@ -314,6 +317,23 @@ func (args MasterArgs) BuildSerializeableMasterConfig() (*configapi.MasterConfig
 		config.ServiceAccountConfig.PublicKeyFiles = []string{}
 	}
 
+	// embed a default policy for generated config
+	defaultImagePolicy, err := bootstrap.Asset("pkg/image/admission/imagepolicy/api/v1/default-policy.yaml")
+	if err != nil {
+		return nil, fmt.Errorf("unable to find default image admission policy: %v", err)
+	}
+	// TODO: this should not be necessary, runtime.Unknown#MarshalJSON should handle YAML content type correctly
+	defaultImagePolicy, err = yaml.ToJSON(defaultImagePolicy)
+	if err != nil {
+		return nil, err
+	}
+	if config.AdmissionConfig.PluginConfig == nil {
+		config.AdmissionConfig.PluginConfig = make(map[string]configapi.AdmissionPluginConfig)
+	}
+	config.AdmissionConfig.PluginConfig[imagepolicyapi.PluginName] = configapi.AdmissionPluginConfig{
+		Configuration: &runtime.Unknown{Raw: defaultImagePolicy},
+	}
+
 	internal, err := applyDefaults(config, configapiv1.SchemeGroupVersion)
 	if err != nil {
 		return nil, err

pkg/cmd/server/start/master_args.go

@@ -53,14 +53,18 @@ os::cmd::expect_success_and_text 'oc get istag' 'wildfly'
 
 # create an image stream and post a mapping to it
 os::cmd::expect_success 'oc create imagestream test'
-os::cmd::expect_success 'oc create -f test/fixtures/mysql-image-stream-mapping.yaml'
+os::cmd::expect_success 'oc create -f test/testdata/mysql-image-stream-mapping.yaml'
 os::cmd::expect_success_and_text 'oc get istag/test:new --template="{{ index .image.dockerImageMetadata.Config.Entrypoint 0 }}"' "docker-entrypoint.sh"
 os::cmd::expect_success_and_text 'oc get istag/test:new -o jsonpath={.image.metadata.name}' 'sha256:b2f400f4a5e003b0543decf61a0a010939f3fba07bafa226f11ed7b5f1e81237'
 # reference should point to the current repository, and that repository should match the reported dockerImageRepository for pushes
 repository="$( oc get is/test -o jsonpath='{.status.dockerImageRepository}' )"
 os::cmd::expect_success_and_text 'oc get istag/test:new -o jsonpath={.image.dockerImageReference}' "^$repository@sha256:b2f400f4a5e003b0543decf61a0a010939f3fba07bafa226f11ed7b5f1e81237"
 os::cmd::expect_success_and_text 'oc get istag/test:new -o jsonpath={.image.dockerImageReference}' "/$project/test@sha256:b2f400f4a5e003b0543decf61a0a010939f3fba07bafa226f11ed7b5f1e81237"
 
+repository="$( oc get is/test -o jsonpath='{.status.dockerImageRepository}' )"
+os::cmd::expect_success 'oc annotate --overwrite image/sha256:b2f400f4a5e003b0543decf61a0a010939f3fba07bafa226f11ed7b5f1e81237 images.openshift.io/deny-execution=true'
+os::cmd::expect_failure_and_text "oc run vulnerable --image=${repository}:new --restart=Never" 'spec.containers\[0\].image: Forbidden: this image is prohibited by policy'
+
 # test image stream tag operations
 os::cmd::expect_success_and_text 'oc get istag/wildfly:latest -o jsonpath={.generation}' '2'
 os::cmd::expect_success_and_text 'oc get istag/wildfly:latest -o jsonpath={.tag.from.kind}' 'ImageStreamTag'