GO-2025-3615: Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno

imagedataloader

package

v1.14.1 Latest Latest Go to latest Published: Apr 30, 2025 License: Apache-2.0 Imports: 33 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kyverno/kyverno

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func GCRtoOCISpecDesc(v1desc gcrv1.Descriptor) ocispec.Descriptor
func KeychainsForProviders(credentialProviders ...string) []authn.Keychain
func New(lister k8scorev1.SecretInterface, opts ...Option) (*imagedatafetcher, error)
func NewAutoRefreshSecretsKeychain(lister k8scorev1.SecretInterface, imagePullSecrets ...string) (authn.Keychain, error)
func OCISpectoGCRDesc(ocidesc ocispec.Descriptor) (*gcrv1.Descriptor, error)
type Fetcher
type ImageContext
- func NewImageContext(lister k8scorev1.SecretInterface, opts ...Option) (ImageContext, error)
type ImageData
type ImageDescriptor
type ImageReference
- func ParseImageReference(image string, options ...Option) (ImageReference, error)
type Option

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	DefaultKeychain  = AnonymousKeychain
	DefaultTransport = &http.Transport{
		Proxy: http.ProxyFromEnvironment,
		DialContext: (&net.Dialer{

			Timeout:   5 * time.Second,
			KeepAlive: 30 * time.Second,
		}).DialContext,
		ForceAttemptHTTP2:     true,
		MaxIdleConns:          100,
		IdleConnTimeout:       90 * time.Second,
		TLSHandshakeTimeout:   10 * time.Second,
		ExpectContinueTimeout: 1 * time.Second,
	}
	UserAgent = fmt.Sprintf("Kyverno/%s (%s; %s)", version.GetVersionInfo().GitVersion, runtime.GOOS, runtime.GOARCH)
)

View Source

var AnonymousKeychain authn.Keychain = anonymuskc{}

View Source

var AzureKeychain authn.Keychain = azurekeychain{}

Functions ¶

func GCRtoOCISpecDesc ¶

func GCRtoOCISpecDesc(v1desc gcrv1.Descriptor) ocispec.Descriptor

func KeychainsForProviders ¶

func KeychainsForProviders(credentialProviders ...string) []authn.Keychain

func New ¶

func New(lister k8scorev1.SecretInterface, opts ...Option) (*imagedatafetcher, error)

func NewAutoRefreshSecretsKeychain ¶

func NewAutoRefreshSecretsKeychain(lister k8scorev1.SecretInterface, imagePullSecrets ...string) (authn.Keychain, error)

func OCISpectoGCRDesc ¶

func OCISpectoGCRDesc(ocidesc ocispec.Descriptor) (*gcrv1.Descriptor, error)

Types ¶

type Fetcher ¶

type Fetcher interface {
	FetchImageData(ctx context.Context, image string, options ...Option) (*ImageData, error)
}

type ImageContext ¶

type ImageContext interface {
	AddImages(ctx context.Context, images []string, opts ...Option) error
	Get(ctx context.Context, image string, opts ...Option) (*ImageData, error)
}

ImageContext stores a list of imagedata, it lives as long as the admission request. Get request for images either returned a prefetched image or fetches it from the registry. It is used to share image data for a policy across policies

func NewImageContext ¶

func NewImageContext(lister k8scorev1.SecretInterface, opts ...Option) (ImageContext, error)

type ImageData ¶

type ImageData struct {
	RemoteOpts []remote.Option
	NameOpts   []name.Option

	ImageDescriptor `json:",inline"`

	NameRef name.Reference
	// contains filtered or unexported fields
}

func (*ImageData) AddVerifiedIntotoPayloads ¶

func (i *ImageData) AddVerifiedIntotoPayloads(predicateType string, data []byte)

func (*ImageData) AddVerifiedReferrer ¶

func (i *ImageData) AddVerifiedReferrer(desc gcrv1.Descriptor)

func (*ImageData) Data ¶

func (i *ImageData) Data() ImageDescriptor

func (*ImageData) FetchReference ¶

func (i *ImageData) FetchReference(identifier string) (ocispec.Descriptor, error)

func (*ImageData) FetchRefererrs ¶

func (i *ImageData) FetchRefererrs(artifactType string) ([]gcrv1.Descriptor, error)

func (*ImageData) FetchRefererrsForDigest ¶

func (i *ImageData) FetchRefererrsForDigest(digest string, artifactType string) ([]gcrv1.Descriptor, error)

func (*ImageData) FetchReferrerData ¶

func (i *ImageData) FetchReferrerData(desc gcrv1.Descriptor) ([]byte, *gcrv1.Descriptor, error)

func (*ImageData) GetPayload ¶

func (i *ImageData) GetPayload(a v1alpha1.Attestation) (interface{}, error)

func (*ImageData) WithDigest ¶

func (i *ImageData) WithDigest(digest string) string

type ImageDescriptor ¶

type ImageDescriptor struct {
	ImageReference `json:",inline"`
	ImageIndex     interface{}       `json:"imageIndex,omitempty"`
	Manifest       *gcrv1.Manifest   `json:"manifest,omitempty"`
	ConfigData     *gcrv1.ConfigFile `json:"config,omitempty"`
}

type ImageReference ¶

type ImageReference struct {
	Image         string `json:"image,omitempty"`
	ResolvedImage string `json:"resolvedImage,omitempty"`
	Registry      string `json:"registry,omitempty"`
	Repository    string `json:"repository,omitempty"`
	Identifier    string `json:"identifier,omitempty"`
	Tag           string `json:"tag,omitempty"`
	Digest        string `json:"digest,omitempty"`
}

func ParseImageReference ¶

func ParseImageReference(image string, options ...Option) (ImageReference, error)

type Option ¶

type Option func(*options)

func BuildRemoteOpts ¶

func BuildRemoteOpts(secrets []string, providers []string, insecure bool) []Option

func WithCredentialProviders ¶

func WithCredentialProviders(providers ...string) Option

func WithInsecure ¶

func WithInsecure(v bool) Option

func WithLocalCredentials ¶

func WithLocalCredentials(v bool) Option

func WithPullSecret ¶

func WithPullSecret(secrets []string) Option

func WithTracing ¶

func WithTracing(v bool) Option

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL