Allow anonymous registry access #9887
Conversation
|
[test] |
|
Looks reasonably not crazy |
| // See https://docs.docker.com/registry/spec/auth/token/#/how-to-authenticate and https://tools.ietf.org/html/rfc6750#section-3 | ||
| str := fmt.Sprintf("Bearer realm=%q", ac.realm) | ||
| if ac.service != "" { | ||
| str += fmt.Sprintf("service=%q", ac.service) |
There was a problem hiding this comment.
Seems like comma is missing before service.
|
LGTM, but I'm wondering if that test failure is a flake or actual problem. |
|
yeah, I had a different docker client version locally, so the message output was slightly different. updated the test. |
|
conformance and integration flaked on #8571 |
|
cc @brianwcook |
I'm confused why this role is granted to all users by default. I'm assuming all project images must be granted this access. Can you give an example command for how a project admin would enable unauthenticated pulls for their project? |
| SelfProvisionerRoleName = "self-provisioner" | ||
| BasicUserRoleName = "basic-user" | ||
| StatusCheckerRoleName = "cluster-status" | ||
| SelfAccessReviewerRoleName = "self-access-reviewer" |
There was a problem hiding this comment.
Why not just self-access-viewer?
There was a problem hiding this comment.
because all the APIs that check access are *Review (SubjectAccessReview, etc)
The Registry authorization works by asking the API (as the user doing the push/pull) "can I get imagestreams/layers in namespace foo?" or "can I update imagestreams/layers in namespace foo?". For anonymous pulls/pushes to work, anonymous users must be able to check anonymous access to a particular action.
For a particular project: For all projects: |
|
flaked six ways from Sunday, but passed all the e2e tests related to anonymous pulling/pushing. [merge] |
|
continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/6529/) (Image: devenv-rhel7_4627) |
|
Evaluated for origin merge up to d179662 |
|
Evaluated for origin test up to d179662 |
|
continuous-integration/openshift-jenkins/test FAILURE (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/6530/) |
Docker registry updates:
/openshift/token:"anonymous") to token requests that include no Authorization headerPolicy updates:
self-access-reviewerrole (name up for grabs)Use:
To allow anonymous users to pull images from a particular project:
To allow anonymous users to pull images from all projects: