Gatekeeper Audit Interval

[jimmyraywv]

The current Quick Start config uses the default Gatekeeper audit interval of 60s. This is not normally an issue. However, in the case of the ratify external data provider configuration, the Gatekeeper audit cycle seems to cause ratify to interrogate the remote oras-enabled registry.

Based on the log entry below, is ratify making a call to the registry every time the audit interval triggers a policy call from Gatekeeper?

time="2022-05-11T00:18:17Z" level=info msg="received request POST /ratify/gatekeeper/v1/verify "
time="2022-05-11T00:18:17Z" level=info msg="start request POST /ratify/gatekeeper/v1/verify"
time="2022-05-11T00:18:17Z" level=info msg="subject for request POST /ratify/gatekeeper/v1/verify is ratify.azurecr.io/testimage:signed"
time="2022-05-11T00:18:17Z" level=info msg="Resolve of the image completed successfully the digest is sha256:9515b691095051d68b4409a30c4819c98bd6f4355d5993a7487687cdc6d47cc3"
{
  "isSuccess": true,
  "verifierReports": [
    {
      "subject": "ratify.azurecr.io/testimage:signed",
      "isSuccess": true,
      "name": "notaryv2",
      "results": [
        "signature verification success"
      ]
    }
  ]
}

[sajayantony]

@etrexel - Should we log that its actually coming from cache in the message about?

[jimmyraywv]

Yes, I think that would be best.

[ritazh]

Hi @jimmyraywv, all the flags used to configure audit are globally shared.
https://open-policy-agent.github.io/gatekeeper/website/docs/audit#configuring-audit
In this case, it would make sense to have the ratify external data provider cache the data and only call the remote registry when cache needs to be refreshed.

[jimmyraywv]

Opened issue.

[jimmyraywv]

In the interim, we are looking into caching.