Updating Prefix in tpl file

[tommyd450]

No description provided.

[qodo-for-securesign]

PR Summary by Qodo

Use TEST_IMAGE_PREFIX in cluster image policy test template

🐞 Bug fix 🧪 Tests 🕐 Less than 5 minutes

AI Description

• Fix cluster image policy test template to reference the image prefix variable.
• Align template inputs with expected test configuration keys.
• Prevent template rendering failures or incorrect image glob matching in tests.

Diagram

graph TD
  A["Test harness"] --> B["Template renderer"] --> C["common_cluster_image_policy.yaml.tpl"] --> D["Rendered CIP YAML"] --> E["K8s ClusterImagePolicy"] --> F["Image glob match"]
  subgraph Legend
    direction LR
    _proc([Process]) ~~~ _file["File"] ~~~ _k8s[(Kubernetes Resource)]
  end

Loading

High-Level Assessment

Directly switching the template variable to .TEST_IMAGE_PREFIX is the simplest and most maintainable fix, assuming the test harness now provides TEST_IMAGE_PREFIX as the canonical input.

Files changed (1) +1 / -1

Bug fix (1) +1 / -1

common_cluster_image_policy.yaml.tplUpdate image glob variable to TEST_IMAGE_PREFIX +1/-1

Update image glob variable to TEST_IMAGE_PREFIX

• Replaces the glob template variable from .TEST_IMAGE to .TEST_IMAGE_PREFIX so rendered ClusterImagePolicy manifests match the test harness' configured image prefix input.

test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Glob won't match digests ✓ Resolved 🐞 Bug ≡ Correctness

Description

common_cluster_image_policy.yaml.tpl now sets spec.images[0].glob to TEST_IMAGE_PREFIX (repository
only) without any wildcard, so it will not match the digest/tag-qualified TEST_IMAGE values used in
e2e workloads. This prevents the ClusterImagePolicy from applying to the test image, causing
Verify()’s “unsigned image should be rejected” assertions to fail because workload creation will be
allowed.

Code

test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl[7]

+    - glob: "{{ .TEST_IMAGE_PREFIX }}"

Relevance

●●● Strong

Likely breaks e2e: repo-only glob won’t match digest/tag image refs; deterministic correctness fix.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The template now uses the repo-only prefix as the glob (no wildcard). In e2e, TEST_IMAGE is a digest
reference and TEST_IMAGE_PREFIX is derived by stripping @/:; Verify() creates workloads using
TEST_IMAGE, so the new glob will not match those image strings under standard glob semantics (as
documented in this repo via use of **).

test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl[6-8]
test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl[24-30]
test/utils/image.go[17-70]
test/e2e/policy_controller_e2e_test.go[81-92]
test/utils/support.go[86-106]
docs/configuring_cluster_image_policy.md[39-58]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The ClusterImagePolicy template uses `{{ .TEST_IMAGE_PREFIX }}` as an `images[].glob` value, but `TEST_IMAGE_PREFIX` strips tag/digest and the resulting glob is an exact string. E2E workloads use digest/tag-qualified image references, so the policy won’t match/apply.

### Issue Context
`TEST_IMAGE_PREFIX` is computed by stripping everything after `@` or `:` from `TEST_IMAGE`, while `TEST_IMAGE` is commonly a digest reference (e.g. `repo/image@sha256:...`). The docs in this repo show glob patterns use wildcard semantics (`"**"`), implying that without a wildcard the match is exact.

### Fix Focus Areas
- test/utils/custom_resources/cluster_image_policies/common_cluster_image_policy.yaml.tpl[6-8]

### Suggested change
Update the template to include a wildcard suffix, e.g.:
```yaml
 images:
   - glob: "{{ .TEST_IMAGE_PREFIX }}*"
```
(or an equivalent pattern accepted by policy-controller such as `{{ .TEST_IMAGE_PREFIX }}**`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}