Repository navigation
policysession: dynamic source policy support - #6276
Conversation
github-actions
Bot
added
area/testing
area/client
area/api
area/solver
area/sourcepolicy
labels
8c20682 to
375cc87
Compare
|
What use-cases were you look at for this? |
Yes, that is one of the cases. |
15a9abd to
c0565f7
Compare
|
Bringing this out of draft. I think we could mark this experimental for the next release while we test this out with more use cases. |
Add support for dynamic source policies via client session. Client session can allow or deny specific source or ask additional metadata information via sourcemetaresolver if that is needed to make the decision. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
c0565f7 to
931fcb6
Compare
| max := 0 | ||
| for { | ||
| max++ | ||
| if max > 10 { // TODO: better loop detection | ||
| return false, errors.Errorf("too many policy requests") | ||
| } |
There was a problem hiding this comment.
I guess this is to avoid badly written policies that could hang builds? I wonder if we could show policy evaluation during image resolution in build logs to make it obvious?
There was a problem hiding this comment.
The resolve request does go to the build logs. Yes, this can be improved with better detection if things have changed. E.g., when the client sends requests for the same op they already received, then we can just error out right away instead of waiting for a fixed limit.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
931fcb6 to
bab17af
Compare
Add support for dynamic source policies via client session.
Client session can allow or deny specific source or ask additional metadata information via sourcemetaresolver if that is needed to make the decision.
Still lots of things to complete. Opening draft for early feedback. cc @cpuguy83