sundowndev
/
clusterlint
mirror of https://github.com/sundowndev/clusterlint.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Refactor latest-tag check to use docker distribution package.

varsha/versions
Varsha Varadarajan 2019-06-21 12:08:30 -04:00
parent 787fc63030
commit 3e49be5d62
2 changed files with 22 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
checks/basic/latest_tag.go
View File

@ -6,6 +6,7 @@ import (
"github.com/digitalocean/clusterlint/checks"
"github.com/digitalocean/clusterlint/kube"
"github.com/docker/distribution/reference"
corev1 "k8s.io/api/core/v1"
)
@ -51,8 +52,9 @@ func (l *latestTagCheck) Run(objects *kube.Objects) (warnings []error, errors []
func checkTags(containers []corev1.Container, podName string, namespace string) []error {
var w []error
for _, container := range containers {
image := container.Image[strings.LastIndex(container.Image, "/")+1:]
if strings.Contains(image, ":latest") || !strings.Contains(image, ":") {
namedRef, _ := reference.ParseNormalizedNamed(container.Image)
tagNameOnly := reference.TagNameOnly(namedRef)
if strings.HasSuffix(tagNameOnly.String(), ":latest") {
w = append(w, fmt.Errorf("[Best Practice] Use specific tags instead of latest for container '%s' in pod '%s' in namespace '%s'", container.Name, podName, namespace))
}
}

36
checks/basic/latest_tag_test.go
View File

@ -56,27 +56,27 @@ func TestLatestTagWarning(t *testing.T) {
},
{
name: "pod with container image - private:5000/repo/busybox",
arg: container("http://private:5000/repo/busybox"),
arg: container("private:5000/repo/busybox"),
expected: issues(warning),
},
{
name: "pod with container image - private:5000/repo/busybox:latest",
arg: container("http://private:5000/repo/busybox:latest"),
arg: container("private:5000/repo/busybox:latest"),
expected: issues(warning),
},
{
name: "pod with container image - test:5000/repo@sha256:digest",
arg: container("test:5000/repo@sha256:digest"),
name: "pod with container image - test:5000/repo/image@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
arg: container("test:5000/repo/image@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
expected: nil,
},
{
name: "pod with container image - repo@sha256:digest",
arg: container("repo@sha256:digest"),
name: "pod with container image - repo/image@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
arg: container("repo/image@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
expected: nil,
},
{
name: "pod with container image - test:5000/repo:ignore-tag@sha256:digest",
arg: container("test:5000/repo:ignore-tag@sha256:digest"),
name: "pod with container image - test:5000/repo/image:ignore-tag@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
arg: container("test:5000/repo/image:ignore-tag@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
expected: nil,
},
{
@ -106,28 +106,28 @@ func TestLatestTagWarning(t *testing.T) {
expected: issues(warning),
},
{
name: "pod with container image - http://private:5000/repo/busybox",
arg: container("http://private:5000/repo/busybox"),
name: "pod with container image - private:5000/repo/busybox",
arg: container("private:5000/repo/busybox"),
expected: issues(warning),
},
{
name: "pod with container image - http://private:5000/repo/busybox:latest",
arg: container("http://private:5000/repo/busybox:latest"),
name: "pod with container image - private:5000/repo/busybox:latest",
arg: container("private:5000/repo/busybox:latest"),
expected: issues(warning),
},
{
name: "pod with container image - test:5000/repo@sha256:digest",
arg: initContainer("test:5000/repo@sha256:digest"),
name: "pod with container image - test:5000/repo/image@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
arg: initContainer("test:5000/repo/image@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
expected: nil,
},
{
name: "pod with container image - test:5000/repo:ignore-tag@sha256:digest",
arg: initContainer("test:5000/repo:ignore-tag@sha256:digest"),
name: "pod with container image - test:5000/repo/image:ignore-tag@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
arg: initContainer("test:5000/repo/image:ignore-tag@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
expected: nil,
},
{
name: "pod with container image - repo@sha256:digest",
arg: initContainer("repo@sha256:digest"),
name: "pod with container image - repo/image@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
arg: initContainer("repo/image@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
expected: nil,
},
{