Only rewrite container image registry for requested images

1 files changed, 8 insertions, 1 deletions

diff --git a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/ContainerImagesTest.java b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/ContainerImagesTest.java
index bb7ea52ca0e..4537aaef45b 100644
--- a/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/ContainerImagesTest.java
+++ b/node-repository/src/test/java/com/yahoo/vespa/hosted/provision/provisioning/ContainerImagesTest.java
@@ -24,7 +24,7 @@ public class ContainerImagesTest {
 
     @Test
     public void image_selection() {
-        DockerImage defaultImage = DockerImage.fromString("registry.example.com/vespa/default");
+        DockerImage defaultImage = DockerImage.fromString("different.example.com/vespa/default");
         DockerImage tenantImage = DockerImage.fromString("registry.example.com/vespa/tenant");
         DockerImage gpuImage = DockerImage.fromString("registry.example.com/vespa/tenant-gpu");
         ContainerImages images = new ContainerImages(defaultImage, Optional.of(tenantImage), Optional.of(gpuImage));
@@ -45,6 +45,13 @@ public class ContainerImagesTest {
         DockerImage requested = DockerImage.fromString("registry.example.com/vespa/special");
         assertEquals(requested, images.get(node(NodeType.tenant, requested)));
 
+        // Malicious registry is rewritten to the trusted one
+        DockerImage malicious = DockerImage.fromString("malicious.example.com/vespa/special");
+        assertEquals(requested, images.get(node(NodeType.tenant, malicious)));
+
+        // Requested image registry for config is rewritten to the defaultImage registry
+        assertEquals(DockerImage.fromString("different.example.com/vespa/special"), images.get(node(NodeType.config, requested)));
+
         // When there is no custom tenant image, the default one is used
         images = new ContainerImages(defaultImage, Optional.empty(), Optional.of(gpuImage));
         assertEquals(defaultImage, images.get(node(NodeType.host)));