policy-test: use local registry

Author: davidweisse

justfile

@@ -2,19 +2,20 @@ default_cli := "contrast.cli"
 default_deploy_target := "openssl"
 default_platform := "${default_platform}"
 default_set := "${set}"
+default_registry := "${container_registry}"
 workspace_dir := "workspace"
 default_collateral_proxy := "http://collateral-proxy.default.svc"
 
 # Undeploy, rebuild, deploy.
 default target=default_deploy_target platform=default_platform cli=default_cli: soft-clean coordinator initializer openssl port-forwarder service-mesh-proxy memdump debugshell (deploy target cli platform) set-manifest verify (wait-for-workload target)
 
 # Build and push a container image.
-push target set=default_set:
+push target set=default_set registry=default_registry:
     #!/usr/bin/env bash
     set -euo pipefail
     mkdir -p {{ workspace_dir }}
-    echo "Pushing container $container_registry/contrast/{{ target }}"
-    nix run -L .#{{ set }}.scripts.containers.push-{{ target }} -- "$container_registry/contrast/{{ target }}" "{{ workspace_dir }}/just.containerlookup" "{{ workspace_dir }}/layers-cache.json"
+    echo "Pushing container {{ registry }}/contrast/{{ target }}"
+    nix run -L .#{{ set }}.scripts.containers.push-{{ target }} -- "{{ registry }}/contrast/{{ target }}" "{{ workspace_dir }}/just.containerlookup" "{{ workspace_dir }}/layers-cache.json"
 
 coordinator: (push "coordinator")
 
@@ -554,12 +555,34 @@ lint:
 unit:
     CGO_ENABLED=1 go test -tags=contrast_unstable_api -v -race ./...
 
+# Run a local registry needed for the policy test suite.
+policy-registry:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    mkdir -p ./{{ workspace_dir }}
+    echo "Setting up registry..."
+    crane registry serve --address localhost:5000 > ./{{ workspace_dir }}/registry.log 2>&1 &
+    PID=$!
+    trap 'kill $PID 2>/dev/null; wait $PID 2>/dev/null || true' EXIT
+    just push "initializer" "{{ default_set }}" "localhost:5000"
+    crane copy busybox localhost:5000/busybox
+    sha=$(crane digest localhost:5000/busybox)
+    printf "busybox@sha256:dc2d74b28e4cf8984fa52af1f39bc7c3d9c73760b41a74d629f5d11b1ab28616=localhost:5000/busybox@%s\n" "$sha" >> ./{{ workspace_dir }}/just.containerlookup
+    crane copy ghcr.io/edgelesssys/kubernetes/pause:3.6 localhost:5000/edgelesssys/kubernetes/pause:3.6
+    echo "Registry is ready."
+    tail -n 0 --pid $PID -f ./{{ workspace_dir }}/registry.log
+
 # Run the policy test suite.
-policy: initializer
+policy:
     #!/usr/bin/env bash
     set -euo pipefail
+    if ! curl -sf localhost:5000/v2/ > /dev/null; then
+        echo "Registry not ready, please run 'just policy-registry' first."
+        exit 1
+    fi
+    mkdir -p ./{{ workspace_dir }}
     echo "Running policy tests..."
-    nix run -L .#base.policy-test -- --image-replacements ./{{ workspace_dir }}/just.containerlookup
+    nix run -L .#base.policy-test -- --image-replacements ./{{ workspace_dir }}/just.containerlookup --insecure-registry localhost:5000
 
 # Check links.
 check-links config="external":

packages/by-name/policy-test/package.nix

@@ -35,7 +35,7 @@ buildGoModule (_finalAttrs: {
     };
 
   proxyVendor = true;
-  vendorHash = "sha256-Cob7OieQcJBSc4L4j9X2vi0AYaPU4JdB9Jt8QhIJSk4=";
+  vendorHash = "sha256-g52+TFJlFZXsFhZweXEQQX63UBBxvoLxOdX0Px594PM=";
 
   # The preConfigure and postConfigure hooks from the cli package work on the repository root, so setting
   # either sourceRoot or modRoot would break the build. Instead, cd into the subdir here.

policy-test/go.mod

@@ -10,6 +10,7 @@ replace github.com/google/go-sev-guest => github.com/edgelesssys/go-sev-guest v0
 
 require (
 	github.com/edgelesssys/contrast v1.22.0
+	github.com/elazarl/goproxy v1.8.2
 	github.com/evanphx/json-patch/v5 v5.9.11
 	github.com/open-policy-agent/opa v1.18.2
 	github.com/spf13/cobra v1.10.2

policy-test/go.sum

@@ -10,6 +10,8 @@ github.com/bytecodealliance/wasmtime-go/v44 v44.0.0 h1:WRZXnLPIer/TWs5aYPaMlmVcO
 github.com/bytecodealliance/wasmtime-go/v44 v44.0.0/go.mod h1:GP93piU+39CoFVCQ5xfHrPOUtL0APlMnkbblJ2d3YY0=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
+github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -31,6 +33,8 @@ github.com/edgelesssys/go-sev-guest v0.0.0-20260729130516-c98bf131aac5 h1:X8Zl2f
 github.com/edgelesssys/go-sev-guest v0.0.0-20260729130516-c98bf131aac5/go.mod h1:SK9vW+uyfuzYdVN0m8BShL3OQCtXZe/JPF7ZkpD3760=
 github.com/edgelesssys/go-tdx-guest v0.0.0-20260625102850-ea481d3db249 h1:Tx0olMH9+rqQgXfX8dIzIDN8UadjSJeTev6t4Qcx+J8=
 github.com/edgelesssys/go-tdx-guest v0.0.0-20260625102850-ea481d3db249/go.mod h1:uHy3VaNXNXhl0fiPxKqTxieeouqQmW6A0EfLcaeCYBk=
+github.com/elazarl/goproxy v1.8.2 h1:keGt9KHFAnrXFEctQuOF9NRxKFCXtd5cQg5PrBdeVW4=
+github.com/elazarl/goproxy v1.8.2/go.mod h1:b5xm6W48AUHNpRTCvlnd0YVh+JafCCtsLsJZvvNTz+E=
 github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
 github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=

policy-test/main.go

@@ -31,6 +31,7 @@ func main() {
 		RunE:  execute,
 	}
 	cmd.Flags().String("image-replacements", "", "path to the image replacements file")
+	cmd.Flags().String("insecure-registry", "", "insecure registry to use for generating policies")
 
 	cmd.SilenceUsage = true
 
@@ -55,6 +56,16 @@ func execute(c *cobra.Command, _ []string) error {
 		return err
 	}
 
+	cleanup, err := setupProxy(c.Context(), flags.insecureRegistry)
+	if err != nil {
+		return fmt.Errorf("setup proxy: %w", err)
+	}
+	defer func() {
+		if err := cleanup(); err != nil {
+			log.Printf("Error cleaning up proxy: %v", err)
+		}
+	}()
+
 	policy, err := generatePolicy(c.Context(), workDir, flags)
 	if err != nil {
 		return fmt.Errorf("generate policy: %w", err)
@@ -100,9 +111,17 @@ func generatePolicy(ctx context.Context, workDir string, flags *flags) (string,
 		"--genpolicy-cache-path=" + filepath.Join(workDir, "layers-cache.json"),
 		"--image-replacements=" + flags.imageReplacementsFile,
 		"--output=" + filepath.Join(workDir, "out.yml"),
-		filepath.Join(workDir, "pod.yml"),
 	}
-	generateCmd.SetArgs(args)
+	if flags.insecureRegistry != "" {
+		// This assumes that the insecure registry contains a mirror of ghcr.io/edgelesssys/kubernetes/pause
+		// which is used by genpolicy to fetch the pause image. See ./proxy.go.
+		args = append(
+			args,
+			"--insecure-registry="+flags.insecureRegistry,
+			"--insecure-registry=ghcr.io",
+		)
+	}
+	generateCmd.SetArgs(append(args, filepath.Join(workDir, "pod.yml")))
 	generateCmd.SetOut(io.Discard)
 	errBuf := &bytes.Buffer{}
 	generateCmd.SetErr(errBuf)
@@ -149,14 +168,20 @@ func extractPolicy(yaml []byte) (string, error) {
 
 type flags struct {
 	imageReplacementsFile string
+	insecureRegistry      string
 }
 
 func parseFlags(cmd *cobra.Command) (*flags, error) {
 	imageReplacementsFile, err := cmd.Flags().GetString("image-replacements")
 	if err != nil {
 		return nil, err
 	}
+	insecureRegistry, err := cmd.Flags().GetString("insecure-registry")
+	if err != nil {
+		return nil, err
+	}
 	return &flags{
 		imageReplacementsFile: imageReplacementsFile,
+		insecureRegistry:      insecureRegistry,
 	}, nil
 }

policy-test/proxy.go

@@ -0,0 +1,58 @@
+// Copyright 2026 Edgeless Systems GmbH
+// SPDX-License-Identifier: BUSL-1.1
+
+package main
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"os"
+
+	"github.com/elazarl/goproxy"
+)
+
+const ghcrHost = "ghcr.io"
+
+func setupProxy(ctx context.Context, registry string) (func() error, error) {
+	proxy := goproxy.NewProxyHttpServer()
+	server := http.Server{Handler: proxy}
+	errCh := make(chan error)
+
+	proxy.OnRequest().DoFunc(func(req *http.Request, _ *goproxy.ProxyCtx) (*http.Request, *http.Response) {
+		// Genpolicy fetches the pause image from ghcr.io/edgelesssys/kubernetes/pause.
+		// The image replacements file does not catch this, as it is not in any deployment YAML.
+		// Reroute these request to the insecure registry to speed up offline testing.
+		// This requires that the insecure registry contains a mirror of ghcr.io/edgelesssys/kubernetes/pause.
+		if req.Host == ghcrHost && registry != "" {
+			req.Host = registry
+			req.URL.Host = registry
+		}
+		return req, nil
+	})
+
+	cleanup := func() error {
+		if err := server.Close(); err != nil {
+			return err
+		}
+		err := <-errCh
+		if !errors.Is(err, http.ErrServerClosed) {
+			return err
+		}
+		return nil
+	}
+
+	proxyListener, err := (&net.ListenConfig{}).Listen(ctx, "tcp", "127.0.0.1:")
+	if err != nil {
+		return cleanup, err
+	}
+
+	go func() {
+		errCh <- server.Serve(proxyListener)
+	}()
+
+	os.Setenv("http_proxy", proxyListener.Addr().String())
+
+	return cleanup, nil
+}