Support insecure registries

[jromero]

I am using https://github.com/tektoncd/catalog/blob/master/task/buildpacks/0.3/buildpacks.yaml.

Here the APP_IMAGE doesn't take transport style like http or https. The tekton staging pod makes an https call to the registry whereas my registry is insecure. How do I tell tekton to make a http request ?

• via @rohitsakala at Cannot connect to insecure private registry tektoncd/catalog#757

[jromero]

Hi @rohitsakala,

This currently isn't supported by the underlying buildpacks engine (lifecycle). See buildpacks/lifecycle#524.

Thank you for bringing up the use case. I'll try to push for support this feature.

[edmund-wagner]

I'm using IP instead of a hostname as a workaround to push into my local http registry. Maybe this helps some devs until this is fixed ;)

[david-caro]

@edmund-wagner can you elaborate? Using for example just "APP_IMAGE=192.168.49.1/minikube-user/python:snap" I get the same error:

$ kubectl -n image-build logs minikube-user-buildpacks-pipelinerun-fjtrj-build-from-git-gkt6c -c step-analyze
ERROR: failed to get previous image: connect to repo store '192.168.49.1/minikube-user/python:snap': Get "https://192.168.49.1/v2/": x509: certificate signed by unknown authority; Get "https://192.168.49.1:443/v2/": x509: certificate signed by unknown authority

And still does not accept passing the http:// proto in the APP_IMAGE param.

[david-caro]

And still does not accept passing the http:// proto in the APP_IMAGE param.

Replying to myself :), I'm using a local harbor instance, and if you have ssl configured it will redirect to all http traffic to https, just had to not configure ssl on harbor side and now it works!

[cmoulliard]

There is a workaround which is to use as registry hostname *.local. In this case the go-containerregistry lib used by lifecycle will issue a HTTP call instead of a HTTPS call :-)

[metacoma]

any updates here?

At the moment, I'm using the following workaround to use an in-cluster insecure registry:

...
     - name: resolve-host                                                                                                                                                                                 
        runAfter:                                                                                                                                                                                          
          - copy                                                                                                                                                                                           
        taskSpec:                                                                                                                                                                                          
          results:                                                                                                                                                                                         
            - name: host-ip                                                                                                                                                                                
              description: "Resolved IP address of zot.zot.svc.cluster.local"                                                                                                                              
          steps:                                                                                                                                                                                           
            - name: get-host-ip                                                                                                                                                                            
              image: nicolaka/netshoot:latest                                                                                                                                                              
              script: |                                                                                                                                                                                    
                #!/bin/sh                                                                                                                                                                                  
                echo "Resolving IP for zot.zot.svc.cluster.local..."                                                                                                                                       
                IP=$(getent hosts zot.zot.svc.cluster.local | awk '{ print $1 }')                                                                                                                          
                echo "Resolved IP: $IP"                                                                                                                                                                    
                echo -n "$IP" > $(results.host-ip.path)                                                                                                                                                    
                                                                                                                                                                                                           
      - name: buildpack                                                                                                                                                                                    
        runAfter:                                                                                                                                                                                          
          - resolve-host                                                                                                                                                                                   
        params:                                                                                                                                                                                            
          - name: REGISTRY_IP
            value: $(tasks.resolve-host.results.host-ip)
        taskSpec:
          steps:
            - name: pack-build
              env:
                - name: CNB_INSECURE_REGISTRIES 
                  value: zot.zot;zot.zot.svc.cluster.local
              image: buildpacksio/pack:latest
              workingDir: /workspace/build
              command: 
                - pack
                - build
                - $(params.REGISTRY_IP):5000/test3:latest
                #- --buildpack-registry
                #- zot.zot:5000
                - --builder
                - paketobuildpacks/builder-jammy-tiny
                - --workspace
                - /workspace/build
                - --docker-host=inherit
                - --publish
...

[jjbustamante]

Hi @metacoma

I think the blocker for this on the lifecycle side was fixed, but we need to update the tekton integration to use it, the main problem now is the lack of maintainers to keep this integration up to date, in the past, Javier was doing it, but he is not contributing on buildpacks anymore, we will need some help to take a look on this

[metacoma]

hey @jjbustamante

I am not using the Buildpack Tekton integration. Instead, I am directly utilizing the buildpack/pack:latest image.

 steps:
            - name: pack-build
              image: buildpacksio/pack:latest

[cmoulliard]

I think the blocker for this on the lifecycle side was fixed, but we need to update the tekton integration to use it, the main problem now is the lack of maintainers to keep this integration up to date, in the past, Javier was doing it, but he is not contributing on buildpacks anymore, we will need some help to take a look on this

We created, at red hat, more recent tasks able also to support to build an image using the extension mechanism: https://github.com/redhat-buildpacks/catalog. We don't have yet an engineer contributing directly to the project but that should be great to get some contributors

[jjbustamante]

@metacoma

I am not using the Buildpack Tekton integration. Instead, I am directly utilizing the buildpack/pack:latest image.

Sorry! I missed that part, in pack side there is an issue open to expose the feature added into lifecycle, there is an open PR, probably it requires a little bit of work to get it into the last mile.

Please, could you leave a +1 or comment on that issue, let see if I can include it in pack 0.37.0