Skip to content

Commit c1834b6

Browse files
lucasrod16lucasrod16
authored
feat: transform imagePullPolicy when using local cluster (#9495)
Signed-off-by: Lucas Rodriguez <[email protected]>
1 parent 5d13748 commit c1834b6

File tree

3 files changed

+166
-0
lines changed

3 files changed

+166
-0
lines changed

‎pkg/skaffold/deploy/kubectl/kubectl.go

+11
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,17 @@ func (k *Deployer) Deploy(ctx context.Context, out io.Writer, builds []graph.Art
241241
return err
242242
}
243243

244+
cluster, err := config.GetCluster(ctx, config.GetClusterOpts{})
245+
if err != nil {
246+
return err
247+
}
248+
if cluster.Local {
249+
manifests, err = manifests.ReplaceImagePullPolicy(manifest.NewResourceSelectorImagePullPolicy())
250+
if err != nil {
251+
return err
252+
}
253+
}
254+
244255
childCtx, endTrace = instrumentation.StartTrace(ctx, "Deploy_LoadImages")
245256
if err := k.imageLoader.LoadImages(childCtx, out, k.localImages, k.originalImages, builds); err != nil {
246257
endTrace(instrumentation.TraceEndError(err))

‎pkg/skaffold/kubernetes/manifest/image_pull_policy.go

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/*
2+
Copyright 2019 The Skaffold Authors
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package manifest
18+
19+
import apimachinery "k8s.io/apimachinery/pkg/runtime/schema"
20+
21+
// resourceSelectorImagePullPolicy selects PodSpecs for transforming the imagePullPolicy field
22+
// based on allowlist and denylist rules for their GroupKind and navigation path.
23+
type resourceSelectorImagePullPolicy struct{}
24+
25+
func NewResourceSelectorImagePullPolicy() ResourceSelector {
26+
return &resourceSelectorImagePullPolicy{}
27+
}
28+
29+
// allowByGroupKind checks if a GroupKind is allowed for transformation.
30+
// It allows GroupKinds in the allowlist unless they are in the denylist with ".*" in PodSpec paths, which blocks all PodSpecs.
31+
func (rs *resourceSelectorImagePullPolicy) allowByGroupKind(gk apimachinery.GroupKind) bool {
32+
if _, allowed := TransformAllowlist[gk]; allowed {
33+
if rf, disallowed := TransformDenylist[gk]; disallowed {
34+
for _, s := range rf.PodSpec {
35+
if s == ".*" {
36+
return false
37+
}
38+
}
39+
}
40+
return true
41+
}
42+
return false
43+
}
44+
45+
// allowByNavpath checks if a GroupKind's PodSpec path (navpath) allows transformation.
46+
// It blocks transformation if the path matches a denylist entry or ".*".
47+
// If not denied, it permits transformation if the path matches an allowlist entry or ".*".
48+
func (rs *resourceSelectorImagePullPolicy) allowByNavpath(gk apimachinery.GroupKind, navpath string, k string) (string, bool) {
49+
if rf, ok := TransformDenylist[gk]; ok {
50+
for _, denypath := range rf.PodSpec {
51+
if denypath == ".*" || navpath == denypath {
52+
return "", false
53+
}
54+
}
55+
}
56+
if rf, ok := TransformAllowlist[gk]; ok {
57+
for _, allowpath := range rf.PodSpec {
58+
if allowpath == ".*" || navpath == allowpath {
59+
return "", true
60+
}
61+
}
62+
}
63+
return "", false
64+
}
65+
66+
func (l *ManifestList) ReplaceImagePullPolicy(rs ResourceSelector) (ManifestList, error) {
67+
r := &imagePullPolicyReplacer{}
68+
return l.Visit(r, rs)
69+
}
70+
71+
// imagePullPolicyReplacer implements FieldVisitor and modifies the "imagePullPolicy" field in Kubernetes manifests.
72+
type imagePullPolicyReplacer struct{}
73+
74+
// Visit sets the value of the "imagePullPolicy" field in a Kubernetes manifest to "Never".
75+
func (i *imagePullPolicyReplacer) Visit(gk apimachinery.GroupKind, navpath string, o map[string]interface{}, k string, v interface{}, rs ResourceSelector) bool {
76+
const imagePullPolicyField = "imagePullPolicy"
77+
if _, allowed := rs.allowByNavpath(gk, navpath, k); !allowed {
78+
return true
79+
}
80+
if k != imagePullPolicyField {
81+
return true
82+
}
83+
if _, ok := v.(string); !ok {
84+
return true
85+
}
86+
o[imagePullPolicyField] = "Never"
87+
return false
88+
}

‎pkg/skaffold/kubernetes/manifest/image_pull_policy_test.go

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
Copyright 2019 The Skaffold Authors
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package manifest
18+
19+
import (
20+
"testing"
21+
22+
"github.com/GoogleContainerTools/skaffold/v2/testutil"
23+
)
24+
25+
func TestReplaceImagePullPolicy(t *testing.T) {
26+
manifests := ManifestList{[]byte(`
27+
apiVersion: v1
28+
kind: Pod
29+
metadata:
30+
name: replace-imagePullPolicy
31+
spec:
32+
containers:
33+
- image: gcr.io/k8s-skaffold/example@sha256:81daf011d63b68cfa514ddab7741a1adddd59d3264118dfb0fd9266328bb8883
34+
name: if-not-present
35+
imagePullPolicy: IfNotPresent
36+
- image: gcr.io/k8s-skaffold/example@sha256:81daf011d63b68cfa514ddab7741a1adddd59d3264118dfb0fd9266328bb8883
37+
name: always
38+
imagePullPolicy: Always
39+
- image: gcr.io/k8s-skaffold/example@sha256:81daf011d63b68cfa514ddab7741a1adddd59d3264118dfb0fd9266328bb8883
40+
name: never
41+
imagePullPolicy: Never
42+
`)}
43+
44+
expected := ManifestList{[]byte(`
45+
apiVersion: v1
46+
kind: Pod
47+
metadata:
48+
name: replace-imagePullPolicy
49+
spec:
50+
containers:
51+
- image: gcr.io/k8s-skaffold/example@sha256:81daf011d63b68cfa514ddab7741a1adddd59d3264118dfb0fd9266328bb8883
52+
name: if-not-present
53+
imagePullPolicy: Never
54+
- image: gcr.io/k8s-skaffold/example@sha256:81daf011d63b68cfa514ddab7741a1adddd59d3264118dfb0fd9266328bb8883
55+
name: always
56+
imagePullPolicy: Never
57+
- image: gcr.io/k8s-skaffold/example@sha256:81daf011d63b68cfa514ddab7741a1adddd59d3264118dfb0fd9266328bb8883
58+
name: never
59+
imagePullPolicy: Never
60+
`)}
61+
62+
testutil.Run(t, "", func(t *testutil.T) {
63+
resultManifest, err := manifests.ReplaceImagePullPolicy(NewResourceSelectorImagePullPolicy())
64+
t.CheckNoError(err)
65+
t.CheckDeepEqual(expected.String(), resultManifest.String(), testutil.YamlObj(t.T))
66+
})
67+
}

0 commit comments

Comments
 (0)