{"id":13846243,"url":"https://github.com/jainishshah17/tugger","last_synced_at":"2025-10-30T09:57:52.576Z","repository":{"id":39702112,"uuid":"166315320","full_name":"jainishshah17/tugger","owner":"jainishshah17","description":"Kubernetes Admission Webhook to enforce pulling of Docker images from the private registry.","archived":false,"fork":false,"pushed_at":"2023-11-30T18:42:19.000Z","size":605,"stargazers_count":56,"open_issues_count":9,"forks_count":22,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-11-21T21:42:18.814Z","etag":null,"topics":["admission-controllers","docker","docker-registry","enforce-pulling","kubernetes","kubernetes-admission-webhook","mutatingadmissionwebhook"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jainishshah17.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-01-18T00:06:49.000Z","updated_at":"2024-11-08T17:20:36.000Z","dependencies_parsed_at":"2024-08-04T18:01:03.906Z","dependency_job_id":"856820f8-c131-4b0e-86b1-8af37266f7e7","html_url":"https://github.com/jainishshah17/tugger","commit_stats":null,"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"purl":"pkg:github/jainishshah17/tugger","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jainishshah17%2Ftugger","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jainishshah17%2Ftugger/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jainishshah17%2Ftugger/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jainishshah17%2Ftugger/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jainishshah17","download_url":"https://codeload.github.com/jainishshah17/tugger/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jainishshah17%2Ftugger/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264958135,"owners_count":23689007,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["admission-controllers","docker","docker-registry","enforce-pulling","kubernetes","kubernetes-admission-webhook","mutatingadmissionwebhook"],"created_at":"2024-08-04T18:00:20.821Z","updated_at":"2025-10-30T09:57:52.563Z","avatar_url":"https://github.com/jainishshah17.png","language":"Go","funding_links":[],"categories":["Operators vs Controllers"],"sub_categories":["Admission"],"readme":"# Tugger\n\n### What does Tugger do?\nTugger is Kubernetes Admission webhook to enforce pulling of docker images from private registry.\n\n### Prerequisites\n\nKubernetes 1.9.0 or above with the `admissionregistration.k8s.io/v1` API enabled. Verify that by the following command:\n```\nkubectl api-versions | grep admissionregistration.k8s.io/v1beta1\n```\nThe result should be:\n```\nadmissionregistration.k8s.io/v1beta1\n```\n\nIn addition, the `MutatingAdmissionWebhook` and `ValidatingAdmissionWebhook` admission controllers should be added and listed in the correct order in the admission-control flag of kube-apiserver.\n\n### Build and Push Tugger Docker Image\n\n```bash\n# Build docker image\ndocker build -t jainishshah17/tugger:0.1.8 .\n\n# Push it to Docker Registry\ndocker push jainishshah17/tugger:0.1.8\n```\n\n### Create [Kubernetes Docker registry secret](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/)\n\n```bash\n# Create a Docker registry secret called 'regsecret'\nkubectl create secret docker-registry regsecret --docker-server=${DOCKER_REGISTRY} --docker-username=${DOCKER_USER} --docker-password=${DOCKER_PASS} --docker-email=${DOCKER_EMAIL}\n```\n\n**Note**: Create Docker registry secret in each non-whitelisted namespaces.\n\n### Generate TLS Certs for Tugger\n\n```bash\n./tls/gen-cert.sh\n```\n\n### Get CA Bundle\n\n```bash\n./webhook/webhook-patch-ca-bundle.sh\n```\n\n### Deploy Tugger to Kubernetes\n\n#### Deploy using Helm Chart\n\nThe helm chart can generate certificates and configure webhooks in a single step.  See the notes on webhooks below for more information.\n\n```bash\n# Add Tugger Helm repository\nhelm repo add tugger https://jainishshah17.github.io/tugger\n\n# Update Helm repository index\nhelm repo update\n```\n\n```bash\nhelm install --name tugger \\\n  --set docker.registrySecret=regsecret, \\\n  --set docker.registryUrl=jainishshah17, \\\n  --set whitelistNamespaces={kube-system,default}, \\\n  --set whitelistRegistries={jainishshah17} \\\n  --set validatingWebhook.create=true \\\n  --set mutatingWebhook.create=true \\\n  tugger/tugger\n```\n\n#### Deploy using kubectl\n\n1. Create deployment and service\n\n\t```bash\n\t# Run deployment\n\tkubectl create -f deployment/tugger-deployment.yaml\n\n\t# Create service\n\tkubectl create -f  deployment/tugger-svc.yaml\n\t```\n\n2. Configure `MutatingAdmissionWebhook` and `ValidatingAdmissionWebhook`\n\n\t**Note**: Replace `${CA_BUNDLE}` with value generated by running `./webhook/webhook-patch-ca-bundle.sh`\n\n\t```bash\n\t# re MutatingAdmissionWebhook\n\tkubectl create -f webhook/tugger-mutating-webhook ration.yaml\n\t```\n\n\tNote: Use MutatingAdmissionWebhook only if you want to enforce pulling of docker image from Private Docker Registry e.g [JFrog Artifactory](https://jfrog.com/artifactory/).\n\tIf your container image is `nginx` then Tugger will append `REGISTRY_URL` to it. e.g `nginx` will become `jainishshah17/nginx`\n\n\t```bash\n\t# Configure ValidatingWebhookConfiguration\n\tkubectl create -f webhook/tugger-validating-webhook ration.yaml\n\t```\n\n\tNote: Use ValidatingWebhookConfiguration only if you want to check pulling of docker image from Private Docker Registry e.g [JFrog Artifactory](https://jfrog.com/artifactory/).\n\tIf your container image does not contain `REGISTRY_URL` then Tugger will deny request to run that pod.\n\n### Test Tugger\n\n```bash\n# Deploy nginx\nkubectl apply -f test/nginx.yaml\n```\n\n## Configure\n\nThe mutation or validation policy can be defined as a list of rules in a YAML file.\n\nThe YALM file can be specified with the command line argument `--policy-file=FILE`, or when using the Helm chart, populate `rules:` in values.\n\n### Schema\n\n```yaml\nrules:\n- pattern: regex\n  replacement: template (optional)\n  condition: policy (optional)\n- ...\n```\n\n_pattern_ is a regex pattern\n\n_replacement_ is a template comprised of the captured groups to use to generate the new image name in the mutating admission controller. When _replacement_ is `null` or undefined, the image name is allowed without patching. Rules with this field are ignored by the validating admission controller, where mutation is not supported.\n\n_condition_ is a special condition to test before committing the replacement. Initially `Always` and `Exists` will be supported. `Always` is the default and performs the replacement regardless of any condition. `Exists` implements the behavior from #7; it only rewrites the image name if the target name exists in the remote registry.\n\nEach rule will be evaluated in order, and if the list is exhausted without a match, the admission controller will return `allowed: false`.\n\n### Examples\n\nThis example allows all images without rewriting:\n```yaml\nrules:\n- pattern: .*\n```\n\nThis example implements the default behavior of rewriting all image names to start with `jainishshah17`:\n```yaml\nrules:\n- pattern: ^jainishshah17/.*\n- pattern: (.*)\n  replacement: jainishshah17/$1\n```\n\nOr the same thing, but only if the image exists in `jainishshah17/`, and allowing all other images:\n```yaml\nrules:\n- pattern: ^jainishshah17/.*\n- pattern: (.*)\n  replacement: jainishshah17/$1\n  condition: Exists\n- pattern: .*\n```\n\nAllow the nginx image, but rewrite everything else:\n```yaml\nrules:\n- pattern: ^nginx(:.*)?$\n- pattern: (?:jainishshah17)?(.*)\n  replacement: jainishshah17/$1\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjainishshah17%2Ftugger","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjainishshah17%2Ftugger","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjainishshah17%2Ftugger/lists"}