You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the feature
Currently, when parsing the Global Unique Name (GUN), when no registry is provided, the docker.io registry is defaulted and added as registry when building the Image class.
I would like to suggest to support also some way to configure another default registry, or either read the docker-daemon.json (when available) to discover the whole list of configured mirror registries.
Optional: Is your feature request related to a problem? Please describe.
When there are mirror registries configured, it's still possible to declare the image on kubernetes without the registry, meaning that it will try to pull the image from the known mirrors (such as docker.io), and once it fails, it will try to pull it from the mirrors.
When pulling from a mirror other than docker.io, the MutatingAdmissionController will still receive the image like this somepath/imagename:version and since there's no registry prepended to the GUN, connaisseur will assume that the registry is docker.io and it will fail to validate the image (tried only using cosign as validator).
Optional: Implementation ideas
Just some brainstorming, no further thoughts put into consideration:
Be able to configure the default registry instead of hardcoded docker.io
Support reading mirrors from docker-daemon.json when available and automatically attempt to prepend all the mirror registries into the image name (it would cause connaisseur to call validation several times in case of multiple mirrors definition)
The text was updated successfully, but these errors were encountered:
Describe the feature
Currently, when parsing the Global Unique Name (GUN), when no registry is provided, the
docker.io
registry is defaulted and added asregistry
when building theImage
class.I would like to suggest to support also some way to configure another default registry, or either read the docker-daemon.json (when available) to discover the whole list of configured mirror registries.
Optional: Is your feature request related to a problem? Please describe.
When there are mirror registries configured, it's still possible to declare the image on kubernetes without the registry, meaning that it will try to pull the image from the known mirrors (such as docker.io), and once it fails, it will try to pull it from the mirrors.
When pulling from a mirror other than docker.io, the MutatingAdmissionController will still receive the image like this
somepath/imagename:version
and since there's no registry prepended to the GUN, connaisseur will assume that the registry isdocker.io
and it will fail to validate the image (tried only using cosign as validator).Optional: Implementation ideas
Just some brainstorming, no further thoughts put into consideration:
docker.io
docker-daemon.json
when available and automatically attempt to prepend all the mirror registries into the image name (it would cause connaisseur to call validation several times in case of multiple mirrors definition)The text was updated successfully, but these errors were encountered: