Description
Problem
While working with verifyImages policies, I noticed some ambiguity around how verifyDigest behaves in background scans.
The documentation states that background scanning applies to verifyImages rules:
“Background scanning … allows Kyverno to scan existing resources and find if they match any validate or verifyImages rules.”
(https://release-1-9-0.kyverno.io/docs/writing-policies/background/)
Initially I assumed verifyDigest is just an option as part of verifyImages and it would work just fine, but I tried it out and it didn't seem to work. It blocked new Pods, but it the background scan didn't work as I expected.
I tried finding out why and I think verifyDigest is not supported for background scans. From the verifyImages documentation, verifyDigest is evaluated as part of validation and typically works together with mutation (mutateDigest) only during admission.
Suggestion
Please clarify in the background scan and/or verifyImages docs that support for verifyImages in background scans does not necessarily include verifyDigest checks for existing resources, and describe the expected behavior explicitly.
Slack discussion
No response
Description
Problem
While working with verifyImages policies, I noticed some ambiguity around how verifyDigest behaves in background scans.
The documentation states that background scanning applies to verifyImages rules:
“Background scanning … allows Kyverno to scan existing resources and find if they match any validate or verifyImages rules.”
(https://release-1-9-0.kyverno.io/docs/writing-policies/background/)
Initially I assumed verifyDigest is just an option as part of verifyImages and it would work just fine, but I tried it out and it didn't seem to work. It blocked new Pods, but it the background scan didn't work as I expected.
I tried finding out why and I think verifyDigest is not supported for background scans. From the verifyImages documentation, verifyDigest is evaluated as part of validation and typically works together with mutation (mutateDigest) only during admission.
Suggestion
Please clarify in the background scan and/or verifyImages docs that support for verifyImages in background scans does not necessarily include verifyDigest checks for existing resources, and describe the expected behavior explicitly.
Slack discussion
No response