Skip to content

Commit 65b276d

Browse files
Windfarerzirain
Windfarer
authored and
zirain
committed
fix(api): image validation regex, support port in repository (envoyproxy#6819)
fix: match repository in image with port Signed-off-by: Windfarer <windfarer@gmail.com>
1 parent 5efe96d commit 65b276d

File tree

6 files changed

+81
-9
lines changed

6 files changed

+81
-9
lines changed

‎api/v1alpha1/shared_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ type KubernetesContainerSpec struct {
231231
// Image specifies the EnvoyProxy container image to be used including a tag, instead of the default image.
232232
// This field is mutually exclusive with ImageRepository.
233233
//
234-
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')",message="Image must include a tag and allowed characters only (e.g., 'repo:tag')."
234+
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')",message="Image must include a tag and allowed characters only (e.g., 'repo:tag')."
235235
// +optional
236236
Image *string `json:"image,omitempty"`
237237

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -614,7 +614,7 @@ spec:
614614
x-kubernetes-validations:
615615
- message: Image must include a tag and allowed characters
616616
only (e.g., 'repo:tag').
617-
rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
617+
rule: self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
618618
imageRepository:
619619
description: |-
620620
ImageRepository specifies the container image repository to be used without specifying a tag.
@@ -4459,7 +4459,7 @@ spec:
44594459
x-kubernetes-validations:
44604460
- message: Image must include a tag and allowed characters
44614461
only (e.g., 'repo:tag').
4462-
rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
4462+
rule: self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
44634463
imageRepository:
44644464
description: |-
44654465
ImageRepository specifies the container image repository to be used without specifying a tag.

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -613,7 +613,7 @@ spec:
613613
x-kubernetes-validations:
614614
- message: Image must include a tag and allowed characters
615615
only (e.g., 'repo:tag').
616-
rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
616+
rule: self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
617617
imageRepository:
618618
description: |-
619619
ImageRepository specifies the container image repository to be used without specifying a tag.
@@ -4458,7 +4458,7 @@ spec:
44584458
x-kubernetes-validations:
44594459
- message: Image must include a tag and allowed characters
44604460
only (e.g., 'repo:tag').
4461-
rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
4461+
rule: self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
44624462
imageRepository:
44634463
description: |-
44644464
ImageRepository specifies the container image repository to be used without specifying a tag.

‎test/cel-validation/envoyproxy_test.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1669,6 +1669,42 @@ func TestEnvoyProxyProvider(t *testing.T) {
16691669
},
16701670
wantErrors: []string{},
16711671
},
1672+
{
1673+
desc: "valid: imageRepository with ip and port",
1674+
mutate: func(envoy *egv1a1.EnvoyProxy) {
1675+
envoy.Spec = egv1a1.EnvoyProxySpec{
1676+
Provider: &egv1a1.EnvoyProxyProvider{
1677+
Type: egv1a1.ProviderTypeKubernetes,
1678+
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
1679+
EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{
1680+
Container: &egv1a1.KubernetesContainerSpec{
1681+
ImageRepository: ptr.To("192.168.1.1:8000"),
1682+
},
1683+
},
1684+
},
1685+
},
1686+
}
1687+
},
1688+
wantErrors: []string{},
1689+
},
1690+
{
1691+
desc: "valid: imageRepository with domain and port",
1692+
mutate: func(envoy *egv1a1.EnvoyProxy) {
1693+
envoy.Spec = egv1a1.EnvoyProxySpec{
1694+
Provider: &egv1a1.EnvoyProxyProvider{
1695+
Type: egv1a1.ProviderTypeKubernetes,
1696+
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
1697+
EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{
1698+
Container: &egv1a1.KubernetesContainerSpec{
1699+
ImageRepository: ptr.To("registry.com:8000"),
1700+
},
1701+
},
1702+
},
1703+
},
1704+
}
1705+
},
1706+
wantErrors: []string{},
1707+
},
16721708
{
16731709
desc: "valid: imageRepository set without tag, image not set",
16741710
mutate: func(envoy *egv1a1.EnvoyProxy) {
@@ -1760,6 +1796,42 @@ func TestEnvoyProxyProvider(t *testing.T) {
17601796
},
17611797
wantErrors: []string{"Image must include a tag and allowed characters only (e.g., 'repo:tag')."},
17621798
},
1799+
{
1800+
desc: "valid: image with domain and port",
1801+
mutate: func(envoy *egv1a1.EnvoyProxy) {
1802+
envoy.Spec = egv1a1.EnvoyProxySpec{
1803+
Provider: &egv1a1.EnvoyProxyProvider{
1804+
Type: egv1a1.ProviderTypeKubernetes,
1805+
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
1806+
EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{
1807+
Container: &egv1a1.KubernetesContainerSpec{
1808+
Image: ptr.To("registry.com:3000/envoy:v1.2.3"),
1809+
},
1810+
},
1811+
},
1812+
},
1813+
}
1814+
},
1815+
wantErrors: []string{},
1816+
},
1817+
{
1818+
desc: "valid: image with ip and port",
1819+
mutate: func(envoy *egv1a1.EnvoyProxy) {
1820+
envoy.Spec = egv1a1.EnvoyProxySpec{
1821+
Provider: &egv1a1.EnvoyProxyProvider{
1822+
Type: egv1a1.ProviderTypeKubernetes,
1823+
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
1824+
EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{
1825+
Container: &egv1a1.KubernetesContainerSpec{
1826+
Image: ptr.To("127.0.0.1:3000/envoy:v1.2.3"),
1827+
},
1828+
},
1829+
},
1830+
},
1831+
}
1832+
},
1833+
wantErrors: []string{},
1834+
},
17631835
{
17641836
desc: "invalid: imageRepository contains tag",
17651837
mutate: func(envoy *egv1a1.EnvoyProxy) {

‎test/helm/gateway-crds-helm/all.out.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24547,7 +24547,7 @@ spec:
2454724547
x-kubernetes-validations:
2454824548
- message: Image must include a tag and allowed characters
2454924549
only (e.g., 'repo:tag').
24550-
rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
24550+
rule: self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
2455124551
imageRepository:
2455224552
description: |-
2455324553
ImageRepository specifies the container image repository to be used without specifying a tag.
@@ -28392,7 +28392,7 @@ spec:
2839228392
x-kubernetes-validations:
2839328393
- message: Image must include a tag and allowed characters
2839428394
only (e.g., 'repo:tag').
28395-
rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
28395+
rule: self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
2839628396
imageRepository:
2839728397
description: |-
2839828398
ImageRepository specifies the container image repository to be used without specifying a tag.

‎test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7235,7 +7235,7 @@ spec:
72357235
x-kubernetes-validations:
72367236
- message: Image must include a tag and allowed characters
72377237
only (e.g., 'repo:tag').
7238-
rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
7238+
rule: self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
72397239
imageRepository:
72407240
description: |-
72417241
ImageRepository specifies the container image repository to be used without specifying a tag.
@@ -11080,7 +11080,7 @@ spec:
1108011080
x-kubernetes-validations:
1108111081
- message: Image must include a tag and allowed characters
1108211082
only (e.g., 'repo:tag').
11083-
rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
11083+
rule: self.matches('^[a-zA-Z0-9._-]+(:[0-9]+)?(/[a-zA-Z0-9._/-]+)?(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
1108411084
imageRepository:
1108511085
description: |-
1108611086
ImageRepository specifies the container image repository to be used without specifying a tag.

0 commit comments

Comments
 (0)