rage.fail

gcp-ar-workload-pulls-image

explicit gcp emits ContainsResourceReference

match (record)

{ "field": "spec.containers[].image | spec.template.spec.containers[].image | build.steps[].name", "resource_type": [ "google.container.Cluster", "google.cloud.run.Service", "google.cloud.run.Job", "google.cloudfunctions.Function", "google.cloudbuild.Build", "google.compute.Instance" ] }

where

image reference resolves to an Artifact Registry hostname: <region>-docker.pkg.dev or <project>.pkg.dev

emit

source type	`*`
target type	`*`
source	`<Compute / KubernetesWorkload / BuildWorker node>`
target	`<ContainerRegistry / ArtifactRepository node for the referenced repo>`

Narrative

{consumer.name} pulls and runs a container image from repository {repo.name} (reference: {image_ref}; mutable_tag: {image_mutable}); this is the supply-chain consumption edge that container-chains uses to propagate a registry push to this workload.

Raw rule rules/explicit/gcp-artifactregistry.yaml

id: gcp-ar-workload-pulls-image
emits: ContainsResourceReference
applies_to:
- gcp
match_record:
  resource_type:
  - google.container.Cluster
  - google.cloud.run.Service
  - google.cloud.run.Job
  - google.cloudfunctions.Function
  - google.cloudbuild.Build
  - google.compute.Instance
  field: spec.containers[].image | spec.template.spec.containers[].image | build.steps[].name
where:
- 'image reference resolves to an Artifact Registry hostname: <region>-docker.pkg.dev or <project>.pkg.dev'
emit:
  target_type: '*'
  source_type: '*'
  source: <Compute / KubernetesWorkload / BuildWorker node>
  target: <ContainerRegistry / ArtifactRepository node for the referenced repo>
  api_source: artifactregistry.projects.locations.repositories.list + workload spec APIs
  evidence_field: image reference string (containers[].image)
  properties:
    reference_kind: runs_image
    image_mutable: <true if reference is a mutable tag; false if @sha256 digest-pinned>
    image_ref: <full image reference string including tag or digest>
  narrative: '{consumer.name} pulls and runs a container image from repository {repo.name} (reference:
    {image_ref}; mutable_tag: {image_mutable}); this is the supply-chain consumption edge that container-chains
    uses to propagate a registry push to this workload.'