Use smart-proxy mTLS auth for container registry#948
Conversation
Allow smart-proxies to pull/push container images against Katello's registry using their existing Foreman SSL client certificate. Adds a reusable `Proxy::ContainerRegistry::PodmanAuth` module to smart-proxy for podman cert-dir setup and cleanup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
| key_file = Proxy::SETTINGS.foreman_ssl_key || Proxy::SETTINGS.ssl_private_key | ||
| ca_file = Proxy::SETTINGS.foreman_ssl_ca || Proxy::SETTINGS.ssl_ca_file | ||
|
|
||
| dir = Dir.mktmpdir('podman_registry_cert') |
There was a problem hiding this comment.
This temporary cert directory works well because we do support setting up container certs on hosts when they register, and users do register smart proxies as hosts. So, the certificate directories will not clash.
ekohl
left a comment
ekohl
left a comment
There was a problem hiding this comment.
What's the benefit of having this code in core? Do you intend to use it in multiple places?
to be able to re-use it and not implement it multiple times. e.g. re-used in https://github.com/ATIX-AG/smart_proxy_ansible_director/pull/24/changes#diff-d10917afb8a06f6552550287738ecd520da52438cdf29983fa2bbd6fdc0d9688R105 |
|
But that's still only within a single repository, right? |
Yes, but I think the ability for a Smart Proxy plugin to use Katello’s Docker registry could also be useful for other plugins. |
|
I have my doubts. Why optimize it prematurely and make merging your PR harder? |
It was a thought. I an move everything to smart proxy Ansible Director, too. |
|
I'd lean to starting there. Gives you a bit more freedom to backport the plugin to older releases too. We can always add it if it's needed. |
3 participants
Allow smart-proxies to pull/push container images against Katello's registry using their existing Foreman SSL client certificate. Adds a reusable
Proxy::ContainerRegistry::PodmanAuthmodule to smart-proxy for podman cert-dir setup and cleanup.Katello PR: Katello/katello#11776
Smart Proxy PR: #948
Smart Proxy Ansible Director: ATIX-AG/smart_proxy_ansible_director#24
Note: I have created this PRs to discuss how to use the katello container registry with smart-proxies.