Feature: adds '--allow-insecure-registry' for cosign load #3000
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Mritunjay <mritunjaysharma394@gmail.com>
znewman01
suggested changes
May 22, 2023
There was a problem hiding this comment.
Can we use the RegistryOpts directly? https://github.com/sigstore/cosign/blob/f21081a1820939cddc41c1c119632a6c489d57fd/cmd/cosign/cli/options/registry.go#LL41C1-L41C1
This means that you don't have to duplicate the code to create the Opts.
Codecov Report
@@ Coverage Diff @@
## main #3000 +/- ##
==========================================
- Coverage 30.25% 30.23% -0.02%
==========================================
Files 151 151
Lines 9473 9478 +5
==========================================
Hits 2866 2866
- Misses 6162 6167 +5
Partials 445 445
|
|
Thanks @znewman01 , just fixed that, I (wrongly) thought that we add opts for each command separately 😅 but yes we should try to be as DRY as we can be, thanks for the review! Let me know if it needs further improvements |
Signed-off-by: Mritunjay <mritunjaysharma394@gmail.com>
mritunjaysharma394
force-pushed
the
load-allow-insecure
branch
from
5534ad2
to
2dd42b5
Compare
znewman01
approved these changes
May 23, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
According to the issue #2986, we need in certain cases like that of "Tactical edge deployments for the Government", to 'load' an image to a registry that is had either NO tls cert, for the ability to tell cosign to ignore the cert, or use http instead.
This PR fixes #2986
Release Note
cosign loadwas added with--allow-insecure-registryto disable TLS verification when interacting with insecure (e.g. self-signed) container registriesDocumentation
Yes, added it in the github docs