Skip to content

Commit 9d5b077

Browse files
davidjumanidavidjumani
authored
fix: gwp does not respect image variant (#10603)
1 parent 2d3e0fc commit 9d5b077

File tree

4 files changed

+101
-29
lines changed

4 files changed

+101
-29
lines changed

‎changelog/v1.19.0-beta7/fix-gwp-fips-distroless.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
changelog:
2+
- type: FIX
3+
issueLink: https://github.com/solo-io/gloo/issues/10602
4+
resolvesIssue: false
5+
description: Fixes the gateway params image to respect the fips and distroless variants specified by global.image.variant. This only applies to the kubernetes gateway proxy.

‎install/helm/gloo/templates/_gg-helpers.tpl

+4-4
Original file line numberDiff line numberDiff line change
@@ -42,18 +42,18 @@ Images valid for the GatewayParameters
4242
ref Image api in projects/gateway2/api/v1alpha1/kube/container.proto
4343
*/}}
4444
{{- define "gloo-gateway.gatewayParametersImage" -}}
45-
{{- $image := . -}}
45+
{{ $image := . }}
4646
{{- if $image.registry }}
4747
registry: {{ $image.registry }}
4848
{{- end -}}{{/* if $image.registry */}}
4949
{{- if $image.repository }}
50-
repository: {{ $image.repository }}
50+
repository: {{ template "gloo.image.repository" $image }}
5151
{{- end -}}{{/* if $image.repository */}}
5252
{{- if $image.tag }}
53-
tag: {{ $image.tag }}
53+
tag: {{ template "gloo.image.tag" $image }}
5454
{{- end -}}{{/* if $image.tag */}}
5555
{{- if $image.digest }}
56-
digest: {{ $image.digest }}
56+
digest: {{ template "gloo.image.digest" $image }}
5757
{{- end -}}{{/* if $image.digest */}}
5858
{{- if $image.pullPolicy }}
5959
pullPolicy: {{ $image.pullPolicy }}

‎install/helm/gloo/templates/_helpers.tpl

+41-25
Original file line numberDiff line numberDiff line change
@@ -25,59 +25,75 @@ ClusterRole
2525
{{- end -}}
2626
{{- end -}}
2727
28-
{{/*
29-
Construct a container image name from a registry, repository, tag, and digest.
30-
*/}}
31-
{{- define "gloo.image" -}}
32-
{{- $image := printf "%s/%s" .registry .repository -}}
33-
28+
{{- define "gloo.image.repository" -}}
3429
{{- /*
3530
for fips or fips-distroless variants: add -fips to the image repo (name)
3631
*/ -}}
32+
{{- if .repository -}}
33+
{{- $repository := .repository -}}
3734
{{- if or .fips (has .variant (list "fips" "fips-distroless")) -}}
3835
{{- $fipsSupportedImages := list "gloo-ee" "extauth-ee" "gloo-ee-envoy-wrapper" "rate-limit-ee" "discovery-ee" "sds-ee" -}}
3936
{{- if (has .repository $fipsSupportedImages) -}}
40-
{{- $image = printf "%s-fips" $image -}}
37+
{{- $repository = printf "%s-fips" $repository -}}
4138
{{- end -}}{{- /* if (has .repository $fipsSupportedImages) */ -}}
4239
{{- end -}}{{- /* if or .fips (has .variant (list "fips" "fips-distroless")) */ -}}
40+
{{ $repository }}
41+
{{- end -}}{{- /* if .repository */ -}}
42+
{{- end -}}{{- /* define "gloo.image.repository" */ -}}
4343
44-
{{- /*
45-
add tag, if it exists
46-
*/ -}}
44+
{{- define "gloo.image.tag" -}}
4745
{{- if .tag -}}
48-
{{- $image = printf "%s:%s" $image .tag -}}
49-
{{- end -}}{{- /* if .tag */ -}}
50-
46+
{{- $tag := .tag -}}
5147
{{- /*
5248
for distroless or fips-distroless variants: add -distroless to the tag
5349
*/ -}}
5450
{{- if and .tag (has .variant (list "distroless" "fips-distroless")) -}}
5551
{{- $distrolessSupportedImages := list "gloo" "gloo-envoy-wrapper" "discovery" "sds" "certgen" "kubectl" "access-logger" "ingress" "gloo-ee" "extauth-ee" "gloo-ee-envoy-wrapper" "rate-limit-ee" "discovery-ee" "sds-ee" "observability-ee" "caching-ee" -}}
5652
{{- if (has .repository $distrolessSupportedImages) -}}
57-
{{- $image = printf "%s-distroless" $image -}} {{- /* Add distroless suffix to the tag since it contains the same binaries in a different container */ -}}
53+
{{- $tag = printf "%s-distroless" $tag -}} {{- /* Add distroless suffix to the tag since it contains the same binaries in a different container */ -}}
5854
{{- end -}}{{- /* if (has .repository $distrolessSupportedImages) */ -}}
5955
{{- end -}}{{- /* if and .tag (has .variant (list "distroless" "fips-distroless")) */ -}}
56+
{{ $tag }}
57+
{{- end -}}{{- /* if .tag */ -}}
58+
{{- end -}}{{- /* define "gloo.image.tag" */ -}}
6059
61-
{{- /*
62-
add digest for the chosen variant, if it exists
63-
*/ -}}
60+
{{- define "gloo.image.digest" -}}
61+
{{- $digest := "" -}}
6462
{{- if or .fips (eq .variant "fips") -}}
6563
{{- if .fipsDigest -}}
66-
{{- $image = printf "%s@%s" $image .fipsDigest -}}
64+
{{- $digest = .fipsDigest -}}
6765
{{- end -}}{{- /* if .fipsDigest */ -}}
6866
{{- else if eq .variant "distroless" -}}
6967
{{- if .distrolessDigest -}}
70-
{{- $image = printf "%s@%s" $image .distrolessDigest -}}
68+
{{- $digest = .distrolessDigest -}}
7169
{{- end -}}{{- /* if .distrolessDigest */ -}}
7270
{{- else if eq .variant "fips-distroless" -}}
7371
{{- if .fipsDistrolessDigest -}}
74-
{{- $image = printf "%s@%s" $image .fipsDistrolessDigest -}}
72+
{{- $digest = .fipsDistrolessDigest -}}
7573
{{- end -}}{{- /* if .fipsDistrolessDigest */ -}}
7674
{{- else -}}
7775
{{- if .digest -}}{{- /* standard image digest */ -}}
78-
{{- $image = printf "%s@%s" $image .digest -}}
76+
{{- $digest = .digest -}}
7977
{{- end -}}{{- /* if .digest */ -}}
8078
{{- end -}}
79+
{{ $digest }}
80+
{{- end -}}{{- /* define "gloo.image.digest" */ -}}
81+
82+
83+
{{/*
84+
Construct a container image name from a registry, repository, tag, and digest.
85+
*/}}
86+
{{- define "gloo.image" -}}
87+
{{- $repository := include "gloo.image.repository" . -}}
88+
{{- $image := printf "%s/%s" .registry $repository -}}
89+
{{- $tag := include "gloo.image.tag" . -}}
90+
{{- if $tag -}}
91+
{{- $image = printf "%s:%s" $image $tag -}}
92+
{{- end -}}{{- /* if .tag */ -}}
93+
{{- $digest := include "gloo.image.digest" . -}}
94+
{{- if $digest -}}
95+
{{- $image = printf "%s@%s" $image $digest -}}
96+
{{- end -}}{{- /* if .digest */ -}}
8197
{{ $image }}
8298
{{- end -}}{{- /* define "gloo.image" */ -}}
8399
@@ -170,7 +186,7 @@ It takes 4 values:
170186
.defaults - the default securityContext for the pod or container
171187
.globalSec - global security settings, usually from .Values.global.securitySettings
172188
.indent - the number of spaces to indent the output. If not set, the output will not be indented.
173-
The indentation argument is necessary because it is possible that no output will be rendered.
189+
The indentation argument is necessary because it is possible that no output will be rendered.
174190
If that happens and the caller handles the indentation the result will be a line of whitespace, which gets caught by the whitespace tests
175191
176192
Depending upon the value of .values.merge, the securityContext will be merged with the defaults or completely replaced.
@@ -234,7 +250,7 @@ It takes 4 values:
234250
.podSecurityStandards - podSecurityStandard from values.yaml
235251
.globalSec - global security settings, usually from .Values.global.securitySettings
236252
.indent - the number of spaces to indent the output. If not set, the output will not be indented.
237-
The indentation argument is necessary because it is possible that no output will be rendered.
253+
The indentation argument is necessary because it is possible that no output will be rendered.
238254
If that happens and the caller handles the indentation the result will be a line of whitespace, which gets caught by the whitespace tests
239255
240256
If .podSecurityStandards.container.enableRestrictedContainerDefaults is true, the defaults will be set to a restricted set of values.
@@ -260,7 +276,7 @@ It takes 4 values:
260276
{{- end -}}
261277
{{- /* set default seccompProfileType */ -}}
262278

263-
{{- $pss_restricted_defaults := dict
279+
{{- $pss_restricted_defaults := dict
264280
"runAsNonRoot" true
265281
"capabilities" (dict "drop" (list "ALL"))
266282
"allowPrivilegeEscalation" false }}
@@ -280,7 +296,7 @@ It takes 4 values:
280296
{{- end -}}
281297
{{- end -}}
282298
{{- /* call general securityContext template */ -}}
283-
{{- include "gloo.securityContext" (dict
299+
{{- include "gloo.securityContext" (dict
284300
"values" $values
285301
"defaults" $defaults
286302
"indent" $indent

‎install/test/k8sgateway_test.go

+51
Original file line numberDiff line numberDiff line change
@@ -487,6 +487,57 @@ var _ = Describe("Kubernetes Gateway API integration", func() {
487487
})
488488
})
489489
})
490+
491+
Context("distroless and fips", func() {
492+
DescribeTable("Uses the correct image for the sds-ee container", func(variant string, expectedImage string) {
493+
extraValueArgs := []string{
494+
"kubeGateway.gatewayParameters.glooGateway.sdsContainer.image.registry=my-sds-reg",
495+
"kubeGateway.gatewayParameters.glooGateway.sdsContainer.image.tag=my-sds-tag",
496+
"kubeGateway.gatewayParameters.glooGateway.sdsContainer.image.repository=sds-ee",
497+
"global.image.variant=" + variant,
498+
}
499+
valuesArgs = append(valuesArgs, extraValueArgs...)
500+
// Updated values so need to re-render
501+
prepareHelmManifest(namespace, glootestutils.HelmValues{ValuesArgs: valuesArgs})
502+
503+
gwp := getDefaultGatewayParameters(testManifest)
504+
gwpKube := gwp.Spec.Kube
505+
Expect(gwpKube).ToNot(BeNil())
506+
sdsContainer := gwpKube.SdsContainer.Image
507+
image := fmt.Sprintf("%s/%s:%s", *sdsContainer.Registry, *sdsContainer.Repository, *sdsContainer.Tag)
508+
Expect(image).To(Equal(expectedImage))
509+
},
510+
Entry("No variant specified", "", "my-sds-reg/sds-ee:my-sds-tag"),
511+
Entry("Standard variant", "standard", "my-sds-reg/sds-ee:my-sds-tag"),
512+
Entry("Fips variant", "fips", "my-sds-reg/sds-ee-fips:my-sds-tag"),
513+
Entry("Distroless variant", "distroless", "my-sds-reg/sds-ee:my-sds-tag-distroless"),
514+
Entry("Fips-Distroless variant", "fips-distroless", "my-sds-reg/sds-ee-fips:my-sds-tag-distroless"))
515+
516+
DescribeTable("Uses the correct image for the gloo-ee-envoy-wrapper container", func(variant string, expectedImage string) {
517+
extraValueArgs := []string{
518+
"kubeGateway.gatewayParameters.glooGateway.envoyContainer.image.registry=my-gloo-ee-envoy-wrapper-reg",
519+
"kubeGateway.gatewayParameters.glooGateway.envoyContainer.image.tag=my-gloo-ee-envoy-wrapper-tag",
520+
"kubeGateway.gatewayParameters.glooGateway.envoyContainer.image.repository=gloo-ee-envoy-wrapper",
521+
"global.image.variant=" + variant,
522+
}
523+
valuesArgs = append(valuesArgs, extraValueArgs...)
524+
// Updated values so need to re-render
525+
prepareHelmManifest(namespace, glootestutils.HelmValues{ValuesArgs: valuesArgs})
526+
527+
gwp := getDefaultGatewayParameters(testManifest)
528+
gwpKube := gwp.Spec.Kube
529+
Expect(gwpKube).ToNot(BeNil())
530+
envoyContainer := gwpKube.EnvoyContainer.Image
531+
image := fmt.Sprintf("%s/%s:%s", *envoyContainer.Registry, *envoyContainer.Repository, *envoyContainer.Tag)
532+
Expect(image).To(Equal(expectedImage))
533+
},
534+
Entry("No variant specified", "", "my-gloo-ee-envoy-wrapper-reg/gloo-ee-envoy-wrapper:my-gloo-ee-envoy-wrapper-tag"),
535+
Entry("Standard variant", "standard", "my-gloo-ee-envoy-wrapper-reg/gloo-ee-envoy-wrapper:my-gloo-ee-envoy-wrapper-tag"),
536+
Entry("Fips variant", "fips", "my-gloo-ee-envoy-wrapper-reg/gloo-ee-envoy-wrapper-fips:my-gloo-ee-envoy-wrapper-tag"),
537+
Entry("Distroless variant", "distroless", "my-gloo-ee-envoy-wrapper-reg/gloo-ee-envoy-wrapper:my-gloo-ee-envoy-wrapper-tag-distroless"),
538+
Entry("Fips-Distroless variant", "fips-distroless", "my-gloo-ee-envoy-wrapper-reg/gloo-ee-envoy-wrapper-fips:my-gloo-ee-envoy-wrapper-tag-distroless"))
539+
540+
})
490541
})
491542

492543
When("kube gateway integration is disabled (default)", func() {

0 commit comments

Comments
 (0)