Log image reference when no-match-policy is set to warn or deny#1941
Merged
hectorj2f merged 1 commit intosigstore:mainfrom Mar 20, 2026
Merged
Log image reference when no-match-policy is set to warn or deny#1941hectorj2f merged 1 commit intosigstore:mainfrom
hectorj2f merged 1 commit intosigstore:mainfrom
Conversation
falcorocks
force-pushed
the
log-no-match-policy-warn
branch
from
f97986d to
e0dcb9f
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1941 +/- ##
==========================================
+ Coverage 29.98% 30.00% +0.01%
==========================================
Files 122 122
Lines 7323 7325 +2
==========================================
+ Hits 2196 2198 +2
Misses 4894 4894
Partials 233 233 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
falcorocks
force-pushed
the
log-no-match-policy-warn
branch
2 times, most recently
from
92298f7 to
8348401
Compare
falcorocks
changed the title
falcorocks
force-pushed
the
log-no-match-policy-warn
branch
2 times, most recently
from
b840d41 to
331c7b6
Compare
hectorj2f
approved these changes
Mar 19, 2026
Collaborator
|
@falcorocks please, rebase again! |
Contributor
Author
|
@hectorj2f it's already rebased to the last available commit from main 03e7e49 |
When no-match-policy is configured as "warn" or "deny", the webhook does not produce any server-side log entry for images that don't match any ClusterImagePolicy. For "warn", the warning is only returned client-side via the admission response. For "deny", the request is rejected but nothing is logged. This makes it impossible to monitor or alert on unmatched images from the webhook pod logs. Add log statements in both the WarnAll and DenyAll cases of setNoMatchingPoliciesError: Errorf for deny (admission rejected) and Warnf for warn (admission allowed with warning). Signed-off-by: falcorocks <14293929+falcorocks@users.noreply.github.com>
falcorocks
force-pushed
the
log-no-match-policy-warn
branch
from
331c7b6 to
550747e
Compare
Contributor
Author
|
rebased now @hectorj2f |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When
no-match-policyis configured aswarnordeny, the webhook does not produce any server-side log entry for images that don't match any ClusterImagePolicy:warn: the warning is only returned client-side via the Kubernetes admission response (Warning: no matching policies: <image>), but nothing is logged in the webhook pod.deny: the request is rejected but nothing is logged either.This is inconsistent with CIP
mode: warn, which logsWarnf("Failed to validate at least one policy for %s ...")invalidateContainerImagewhen an image fails policy validation.This PR adds log statements in both the
WarnAllandDenyAllcases ofsetNoMatchingPoliciesError:Errorffor deny (admission rejected)Warnffor warn (admission allowed with warning)Test plan
TestPolicyControllerConfigNoMatchPolicypassesErrorffires fordenycase,Warnffires forwarncase in test output