func matchImageConditionValues(rule *imagepolicy.ImageCondition, integrated RegistryMatcher, attrs *ImagePolicyAttributes) bool {
	if rule.MatchIntegratedRegistry && !(attrs.IntegratedRegistry || integrated.Matches(attrs.Name.Registry)) {
		klog.V(5).Infof("image registry %v does not match integrated registry", attrs.Name.Registry)
		return false
	}
	if len(rule.MatchRegistries) > 0 && !hasAnyMatch(attrs.Name.Registry, rule.MatchRegistries) {
		klog.V(5).Infof("image registry %v does not match registries from rule: %#v", attrs.Name.Registry, rule.MatchRegistries)
		return false
	}

	// all subsequent calls require the image
	image := attrs.Image
	if image == nil {
		if rule.SkipOnResolutionFailure {
			klog.V(5).Infof("rule does not match because image did not resolve and SkipOnResolutionFailure is true")
			// Likely we will never get here (see: https://github.com/openshift/origin/blob/4f709b48f8e52e8c6012bd8b91945f022a437a6a/pkg/image/admission/imagepolicy/rules/accept.go#L99-L103)
			// but if we do, treat the condition as not matching since we are supposed to skip this rule on resolution failure.
			return false
		}

		// if we don't require an image to evaluate our rules, then there's no reason to continue from here
		// we already know that we passed our filter
		r := requiresImage(rule)
		klog.V(5).Infof("image did not resolve, rule requires image metadata for matching: %t", r)
		return !r
	}

	if len(rule.MatchDockerImageLabels) > 0 {
		if err := imageutil.ImageWithMetadata(image); err != nil {
			if rule.SkipOnResolutionFailure {
				return false
			} else {
				return true
			}
		}
		dockerImageMetadata, hasMetadata := image.DockerImageMetadata.Object.(*docker10.DockerImage)
		if !hasMetadata {
			klog.V(5).Infof("image has no labels to match rule labels")
			return false
		}

		if !matchKeyValue(dockerImageMetadata.Config.Labels, rule.MatchDockerImageLabels) {
			klog.V(5).Infof("image labels %#v do not match rule labels %#v", dockerImageMetadata.Config.Labels, rule.MatchDockerImageLabels)
			return false
		}
	}
	if !matchKeyValue(image.Annotations, rule.MatchImageAnnotations) {
		klog.V(5).Infof("image annotations %#v do not match rule annotations %#v", image.Annotations, rule.MatchImageAnnotations)
		return false
	}
	for _, s := range rule.MatchImageLabelSelectors {
		if !s.Matches(labels.Set(image.Labels)) {
			klog.V(5).Infof("image label selectors %#v do not match rule label selectors %#v", image.Labels, s)
			return false
		}
	}

	return true
}
// matchImageConditionValues handles only the match rules on the condition, returning true if the conditions match.
// Use matchImageCondition to apply invertMatch rules.
matchImageConditionValues handles only the match rules on the condition, returning true if the conditions match.
Use matchImageCondition to apply invertMatch rules.
// matchImageConditionValues handles only the match rules on the condition returning true if the conditions match . // Use matchImageCondition to apply invertMatch rules .
func matchImageConditionValues(rule *imagepolicy.ImageCondition, integrated RegistryMatcher, attrs *ImagePolicyAttributes) bool {
	if rule.MatchIntegratedRegistry && !(attrs.IntegratedRegistry || integrated.Matches(attrs.Name.Registry)) {
		klog.V(5).Infof("image registry %v does not match integrated registry", attrs.Name.Registry)
		return false
	}
	if len(rule.MatchRegistries) > 0 && !hasAnyMatch(attrs.Name.Registry, rule.MatchRegistries) {
		klog.V(5).Infof("image registry %v does not match registries from rule: %#v", attrs.Name.Registry, rule.MatchRegistries)
		return false
	}
	image := attrs.Image
	if image == nil {
		if rule.SkipOnResolutionFailure {
			klog.V(5).Infof("rule does not match because image did not resolve and SkipOnResolutionFailure is true")
			return false
		}
		r := requiresImage(rule)
		klog.V(5).Infof("image did not resolve, rule requires image metadata for matching: %t", r)
		return !r
	}
	if len(rule.MatchDockerImageLabels) > 0 {
		if err := imageutil.ImageWithMetadata(image); err != nil {
			if rule.SkipOnResolutionFailure {
				return false
			} else {
				return true
			}
		}
		dockerImageMetadata, hasMetadata := image.DockerImageMetadata.Object.(*docker10.DockerImage)
		if !hasMetadata {
			klog.V(5).Infof("image has no labels to match rule labels")
			return false
		}
		if !matchKeyValue(dockerImageMetadata.Config.Labels, rule.MatchDockerImageLabels) {
			klog.V(5).Infof("image labels %#v do not match rule labels %#v", dockerImageMetadata.Config.Labels, rule.MatchDockerImageLabels)
			return false
		}
	}
	if !matchKeyValue(image.Annotations, rule.MatchImageAnnotations) {
		klog.V(5).Infof("image annotations %#v do not match rule annotations %#v", image.Annotations, rule.MatchImageAnnotations)
		return false
	}
	for _, s := range rule.MatchImageLabelSelectors {
		if !s.Matches(labels.Set(image.Labels)) {
			klog.V(5).Infof("image label selectors %#v do not match rule label selectors %#v", image.Labels, s)
			return false
		}
	}
	return true
}
func matchImageConditionValues ( rule * imagepolicy . ImageCondition , integrated RegistryMatcher , attrs * ImagePolicyAttributes ) bool { if rule . MatchIntegratedRegistry && ! ( attrs . IntegratedRegistry || integrated . Matches ( attrs . Name . Registry ) ) { klog . V ( 5 ) . Infof ( " " , attrs . Name . Registry ) return false } if len ( rule . MatchRegistries ) > 0 && ! hasAnyMatch ( attrs . Name . Registry , rule . MatchRegistries ) { klog . V ( 5 ) . Infof ( " " , attrs . Name . Registry , rule . MatchRegistries ) return false } image := attrs . Image if image == nil { if rule . SkipOnResolutionFailure { klog . V ( 5 ) . Infof ( " " ) return false } r := requiresImage ( rule ) klog . V ( 5 ) . Infof ( " " , r ) return ! r } if len ( rule . MatchDockerImageLabels ) > 0 { if err := imageutil . ImageWithMetadata ( image ) ; err != nil { if rule . SkipOnResolutionFailure { return false } else { return true } } dockerImageMetadata , hasMetadata := image . DockerImageMetadata . Object . ( * docker10 . DockerImage ) if ! hasMetadata { klog . V ( 5 ) . Infof ( " " ) return false } if ! matchKeyValue ( dockerImageMetadata . Config . Labels , rule . MatchDockerImageLabels ) { klog . V ( 5 ) . Infof ( " " , dockerImageMetadata . Config . Labels , rule . MatchDockerImageLabels ) return false } } if ! matchKeyValue ( image . Annotations , rule . MatchImageAnnotations ) { klog . V ( 5 ) . Infof ( " " , image . Annotations , rule . MatchImageAnnotations ) return false } for _ , s := range rule . MatchImageLabelSelectors { if ! s . Matches ( labels . Set ( image . Labels ) ) { klog . V ( 5 ) . Infof ( " " , image . Labels , s ) return false } } return true }
matchImageConditionValues handles only the match rules on the condition, returning true if the conditions match.
matchImageConditionValues handles only the match rules on the condition returning true if the conditions match .
// all subsequent calls require the image // Likely we will never get here (see: https://github.com/openshift/origin/blob/4f709b48f8e52e8c6012bd8b91945f022a437a6a/pkg/image/admission/imagepolicy/rules/accept.go#L99-L103) // but if we do, treat the condition as not matching since we are supposed to skip this rule on resolution failure. // if we don't require an image to evaluate our rules, then there's no reason to continue from here // we already know that we passed our filter