0

I am testing my binary authorization policies and put an exemption entry to allow nginx .

Following are the entries I tried by adding them under Images exempt from policy

registry.hub.docker.com/library/nginx*
registry.hub.docker.com/library/nginx.latest
docker.io/library/nginx*

but it is failing with below error

 $ kubectl run httpd-server --image=nginx --restart=Never -l app=httpd-server --port 80
 Error from server (VIOLATES_POLICY): admission webhook "imagepolicywebhook.image-policy.k8s.io" denied the request: Image nginx denied by Binary Authorization default admission rule. Denied by always_deny admission rule

If i disable binary authorization and install the nginx package , it shows the following repository is used to pull the image

   image: docker.io/library/nginx:latest

This entry is already there in Images exempt from policy , but the download is still blocked . Sharing the policy definition as requested .

enter image description here

Any suggestions ?

Zama Ques
  • 523
  • 1
  • 9
  • 24

1 Answers1

1

I successfully reproduced your environment and everything runs as it should be. I configured my policy as in the image. enviorement reproduced

And I was able to create a deployment without any problem. I tried a few times changing between options, but in the end I didn't find a problem.

Please be sure that you're running a cluster with binary Authorization enabled.

To verify that Binary Authorization is enabled for the cluster, do the following:

1 Open the GKE page in the Cloud console.

2 Under Kubernetes clusters, find your cluster.

3 Under Security, verify that Binary Authorization is set to Enabled.

Also, it is important to check that the cluster where you're running your commands is the same cluster where you set the specific rules.

Before creating the deployment, be sure to use:

gcloud container clusters get-credentials NAME [--internal-ip] [--region=REGION     | --zone=ZONE, -z ZONE] [GCLOUD_WIDE_FLAG …]

To get the credentials for the cluster that you need to use.

Ismael Clemente Aguirre
  • 181
  • 5
  • Thanks so much for your response . Binary authorization is enabled on the cluster but the cluster specific rule was for a different cluster – Zama Ques Jun 01 '22 at 06:11
  • Can we use "Images exempt from policy" feature to disallow non google images like "docker.io" if we disallow all images in default and cluster specific rules ? – Zama Ques Jun 10 '22 at 17:08
  • I "disallowed all images " in both default and cluster specific rule and added "docker.io/library/nginx:latest" in custom exemption rules , but nginx deployment is getting failed with "Image nginx denied by Binary Authorization cluster admission" error – Zama Ques Jun 10 '22 at 17:12