Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support registry mirrors #742

Open
williamokano opened this issue Aug 5, 2022 · 0 comments
Open

Support registry mirrors #742

williamokano opened this issue Aug 5, 2022 · 0 comments
Labels
enhancement New feature or request

Comments

@williamokano
Copy link

williamokano commented Aug 5, 2022

Describe the feature
Currently, when parsing the Global Unique Name (GUN), when no registry is provided, the docker.io registry is defaulted and added as registry when building the Image class.

I would like to suggest to support also some way to configure another default registry, or either read the docker-daemon.json (when available) to discover the whole list of configured mirror registries.

Optional: Is your feature request related to a problem? Please describe.
When there are mirror registries configured, it's still possible to declare the image on kubernetes without the registry, meaning that it will try to pull the image from the known mirrors (such as docker.io), and once it fails, it will try to pull it from the mirrors.

When pulling from a mirror other than docker.io, the MutatingAdmissionController will still receive the image like this somepath/imagename:version and since there's no registry prepended to the GUN, connaisseur will assume that the registry is docker.io and it will fail to validate the image (tried only using cosign as validator).

Optional: Implementation ideas
Just some brainstorming, no further thoughts put into consideration:

  • Be able to configure the default registry instead of hardcoded docker.io
  • Support reading mirrors from docker-daemon.json when available and automatically attempt to prepend all the mirror registries into the image name (it would cause connaisseur to call validation several times in case of multiple mirrors definition)
@xopham xopham added the enhancement New feature or request label Aug 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants