replace-registry still making request to original registry?

[strowi]

Hi,

since docker is reducing the rate-limits again, i was testing the replace-image-registry ClusterPolicy to redirect to our harbor-mirror.

---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: replace-image-registry-with-harbor
  annotations:
    ...
spec:
  rules:
    - name: redirect-docker
      match:
        any:
          - resources:
              kinds:
                - Pod
              operations:
                - CREATE
                - UPDATE
      mutate:
        foreach:
          - list: "request.object.spec.initContainers[]"
            context:
              - name: imageData
                imageRegistry:
                  reference: "{{ element.image }}"
            preconditions:
              any:
                - key: "{{imageData.registry}}"
                  operator: Equals
                  value: index.docker.io
            patchStrategicMerge:
              spec:
                imagePullSecrets:
                  - name: harbor
                initContainers:
                  - name: "{{ element.name }}"
                    image: harbor/proxy.docker.io/{{imageData.repository}}:{{imageData.identifier}}

          - list: "request.object.spec.containers[]"
            context:
              - name: imageData
                imageRegistry:
                  reference: "{{ element.image }}"
            preconditions:
              any:
                - key: "{{imageData.registry}}"
                  operator: Equals
                  value: index.docker.io
            patchStrategicMerge:
              spec:
                imagePullSecrets:
                  - name: harbor
                containers:
                  - name: "{{ element.name }}"
                    image: harbor/proxy.docker.io/{{imageData.repository}}:{{imageData.identifier}}

But after a few test kyverno seems to get rate-limited by docker.io:

 ERR github.com/kyverno/kyverno/pkg/webhooks/resource/handlers.go:211 > 
 mutation failed error="mutation policy replace-image-registry-with-harbor error: 
 failed to apply policy replace-image-registry-with-harbor rules 
 [redirect-docker: failed to mutate elements: failed to evaluate mutate.foreach[0].preconditions: 
 failed to substitute variables in condition key: failed to resolve imageData.registry at path : 
 failed to fetch image descriptor: docker.io/emqx/emqx:4.2.7, 
 error: failed to fetch image descriptor: docker.io/emqx/emqx:4.2.7, 
 error: failed to fetch image reference: docker.io/emqx/emqx:4.2.7, 
 error: GET https://index.docker.io/v2/emqx/emqx/manifests/4.2.7: 
 TOOMANYREQUESTS: You have reached your unauthenticated pull rate limit. 
 https://www.docker.com/increase-rate-limit]" 
 URLParams= clusterroles=["system:basic-user",
 "system:controller:statefulset-controller",
 "system:discovery",
 "system:public-info-viewer",
 "system:service-account-issuer-discovery"] 
 gvk="/v1,
 Kind=Pod" gvr={"group":"","resource":"pods","version":"v1"} kind=Pod logger=webhooks/resource/mutate name=emqx-0 namespace=app operation=CREATE resource.gvk="/v1,
 Kind=Pod" roles=["kube-system:sealed-secrets-controller-service-proxier"] uid=ea9d53ab-b9d8-4ebc-9439-94af0d12b3ff user={"extra":{"authentication.kubernetes.io/credential-id":["JTI=d1f5683d-a71f-4982-8b39-c779d3903c6c"]},"groups":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"],"uid":"c1d1a3ec-cb7b-4682-a328-1af5ee08402f","username":"system:serviceaccount:kube-system:statefulset-controller"}

Is there a way around this?

regards,
strowi