主页
产品
OpenShift Container Platform
3.11
集群管理
11.3. 配置 ImagePolicy Admission 插件

11.3. 配置 ImagePolicy Admission 插件

要配置可以在集群中运行的镜像，请在 master-config.yaml 文件中配置 ImagePolicy Admission 插件。您可以根据需要设置一个或多个规则。

使用特定注解拒绝镜像 ：

使用此规则拒绝在其上设置特定注解的所有镜像。以下使用 images.openshift.io/deny-execution 注解拒绝所有镜像：

- name: execution-denied
  onResources:
  - resource: pods
  - resource: builds
  reject: true
  matchImageAnnotations:
  - key: images.openshift.io/deny-execution 
    value: "true"
  skipOnResolutionFailure: true

- name: execution-denied
  onResources:
  - resource: pods
  - resource: builds
  reject: true
  matchImageAnnotations:
  - key: images.openshift.io/deny-execution


    value: "true"
  skipOnResolutionFailure: true

Copy to Clipboard

Toggle word wrap

1: 如果特定镜像被视为是恶意的，管理员可以设置此注解来标记这些镜像。

允许用户从 Docker Hub 运行镜像 ：

使用此规则允许用户使用 Docker Hub 中的镜像：

- name: allow-images-from-dockerhub
  onResources:
    - resource: pods
    - resource: builds
    matchRegistries:
    - docker.io

- name: allow-images-from-dockerhub
  onResources:
    - resource: pods
    - resource: builds
    matchRegistries:
    - docker.io

Copy to Clipboard

Toggle word wrap

以下是在 master-config.yaml 文件中设置多个 ImagePolicy addmission 插件规则的示例配置：

注解的文件示例

admissionConfig:
  pluginConfig:
    openshift.io/ImagePolicy:
      configuration:
        kind: ImagePolicyConfig
        apiVersion: v1
        resolveImages: AttemptRewrite 
        executionRules: 
        - name: execution-denied
          # Reject all images that have the annotation images.openshift.io/deny-execution set to true.
          # This annotation may be set by infrastructure that wishes to flag particular images as dangerous
          onResources: 
          - resource: pods
          - resource: builds
          reject: true 
          matchImageAnnotations: 
          - key: images.openshift.io/deny-execution
            value: "true"
          skipOnResolutionFailure: true 
        - name: allow-images-from-internal-registry
          # allows images from the internal registry and tries to resolve them
          onResources:
          - resource: pods
          - resource: builds
          matchIntegratedRegistry: true
        - name: allow-images-from-dockerhub
          onResources:
          - resource: pods
          - resource: builds
          matchRegistries:
          - docker.io
        resolutionRules: 
        - targetResource:
            resource: pods
          localNames: true
          policy: AttemptRewrite
        - targetResource: 
            group: batch
            resource: jobs
          localNames: true 
          policy: AttemptRewrite

admissionConfig:
  pluginConfig:
    openshift.io/ImagePolicy:
      configuration:
        kind: ImagePolicyConfig
        apiVersion: v1
        resolveImages: AttemptRewrite


        executionRules:


        - name: execution-denied
          # Reject all images that have the annotation images.openshift.io/deny-execution set to true.
          # This annotation may be set by infrastructure that wishes to flag particular images as dangerous
          onResources:


          - resource: pods
          - resource: builds
          reject: true


          matchImageAnnotations:


          - key: images.openshift.io/deny-execution
            value: "true"
          skipOnResolutionFailure: true


        - name: allow-images-from-internal-registry
          # allows images from the internal registry and tries to resolve them
          onResources:
          - resource: pods
          - resource: builds
          matchIntegratedRegistry: true
        - name: allow-images-from-dockerhub
          onResources:
          - resource: pods
          - resource: builds
          matchRegistries:
          - docker.io
        resolutionRules:


        - targetResource:
            resource: pods
          localNames: true
          policy: AttemptRewrite
        - targetResource:


            group: batch
            resource: jobs
          localNames: true


          policy: AttemptRewrite

Copy to Clipboard

Toggle word wrap

1: 尝试将镜像解析到不可变镜像摘要中，并更新 pod 中的镜像拉取规格。
2: 针对传入资源进行评估的规则数组。如果您只有 reject: true 规则，则默认为 允许所有。如果您有任何接受规则，则在任何规则中都 reject: false，ImagePolicy 的默认行为 deny-all。
3: 指示要强制执行规则的资源。如果未指定任何内容，则默认为 pod。
4: 表示如果此规则匹配，则 Pod 应该被拒绝。
5: 镜像对象的元数据匹配的注解列表。
6: 如果您无法解析镜像，请不要失败 pod。
7: 允许在 Kubernetes 资源中使用镜像流的规则数组。默认配置允许 pod、复制控制器、replicaset、有状态集、daemonset、Deployment 和作业在镜像字段中使用相同的项目镜像流标签引用。
8: 标识规则应用到的组和资源。如果资源是 *，则此规则将应用到该组中的所有资源。
9: LocalNames 将允许单个片段名称（如 ruby:2.5）解释为本地命名空间镜像流标签，但只有在资源或目标镜像流启用了 本地名称解析 时才会显示。

注意

如果您通常依赖使用默认 registry 前缀（如 docker.io 或 registry.redhat.io）拉取的基础架构镜像，则这些镜像与任何 matchRegistries 值不匹配，因为它们没有 registry 前缀。为确保基础架构镜像具有与镜像策略匹配的 registry 前缀，请在 master-config.yaml 文件中设置 imageConfig.format 值。

返回顶部

11.3. 配置 ImagePolicy Admission 插件

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links