Skip to content

Commit ead0a0a

Browse files
authored
fix: insecure push (#266)
Signed-off-by: Timur Tuktamyshev <[email protected]>
1 parent 529945d commit ead0a0a

File tree

5 files changed

+194
-50
lines changed

5 files changed

+194
-50
lines changed

go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ go 1.24.6
55
require (
66
github.com/Masterminds/semver/v3 v3.3.1
77
github.com/deckhouse/deckhouse/pkg/log v0.1.0
8-
github.com/deckhouse/deckhouse/pkg/registry v0.0.0-20251120122028-65011cba39f4
8+
github.com/deckhouse/deckhouse/pkg/registry v0.0.0-20260120103154-2be5575578db
99
github.com/deckhouse/virtualization/src/cli v1.0.0
1010
github.com/fatih/color v1.18.0
1111
github.com/fluxcd/flagger v1.36.1

go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -417,6 +417,10 @@ github.com/deckhouse/deckhouse/pkg/log v0.1.0 h1:2aPfyiHHSIJlX4x7ysyPOaIb7CLmyY+
417417
github.com/deckhouse/deckhouse/pkg/log v0.1.0/go.mod h1:pbAxTSDcPmwyl3wwKDcEB3qdxHnRxqTV+J0K+sha8bw=
418418
github.com/deckhouse/deckhouse/pkg/registry v0.0.0-20251120122028-65011cba39f4 h1:puYW42+BF8fYuoq/dMDd+oxNprMuuSACWqDss6IQulE=
419419
github.com/deckhouse/deckhouse/pkg/registry v0.0.0-20251120122028-65011cba39f4/go.mod h1:+oNXMQMOaVpDq00i+PX9NXptzIybUDRmxAO7iRWM32s=
420+
github.com/deckhouse/deckhouse/pkg/registry v0.0.0-20260119191635-04ce9157d702 h1:HdfASfTGK2124itxEKqFNqEIEdjJ2XfD0DA+8ONBTok=
421+
github.com/deckhouse/deckhouse/pkg/registry v0.0.0-20260119191635-04ce9157d702/go.mod h1:OdmJduRktTXVMNLAULkzoPbzLbtaU/jBuwSoAUbnxRM=
422+
github.com/deckhouse/deckhouse/pkg/registry v0.0.0-20260120103154-2be5575578db h1:xq4DMxGgDk0IaqUzIqwkKOiY9dtQlpVnEupfE/TBU6c=
423+
github.com/deckhouse/deckhouse/pkg/registry v0.0.0-20260120103154-2be5575578db/go.mod h1:OdmJduRktTXVMNLAULkzoPbzLbtaU/jBuwSoAUbnxRM=
420424
github.com/deckhouse/virtualization/api v1.0.0 h1:q4TvC74tpjk25k0byXJCYP4HjvRexBSeI0cC8QeCMTQ=
421425
github.com/deckhouse/virtualization/api v1.0.0/go.mod h1:meTeGulR+xwnvt0pTGsoI14YhGe0lHUVyAfhZsoQyeQ=
422426
github.com/deckhouse/virtualization/src/cli v1.0.0 h1:tNuQugKqYiMwVV8xh2yLVaEIrxCzmRhaTVijrWc7Epw=

pkg/libmirror/util/auth/auth_test.go

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,81 @@ func TestMakeRemoteRegistryRequestOptionsAnonymousInsecure(t *testing.T) {
3939
gotOptionFnPtr := reflect.PointerTo(reflect.TypeOf(nameOpts[0]))
4040
require.Equal(t, expectedOptionFnPtr, gotOptionFnPtr)
4141
}
42+
43+
func TestMakeRemoteRegistryRequestOptions_InsecureHTTPScheme(t *testing.T) {
44+
t.Run("insecure flag enables HTTP scheme for registry references", func(t *testing.T) {
45+
nameOpts, _ := MakeRemoteRegistryRequestOptions(nil, true, false)
46+
require.Len(t, nameOpts, 1, "should return name.Insecure option")
47+
48+
ref, err := name.ParseReference("localhost:5000/repo:tag", nameOpts...)
49+
require.NoError(t, err)
50+
require.Equal(t, "http", ref.Context().Registry.Scheme(), "should use HTTP scheme with insecure flag")
51+
})
52+
53+
t.Run("secure mode uses HTTPS scheme", func(t *testing.T) {
54+
nameOpts, _ := MakeRemoteRegistryRequestOptions(nil, false, false)
55+
require.Len(t, nameOpts, 0, "should return no name options")
56+
57+
ref, err := name.ParseReference("registry.example.com/repo:tag", nameOpts...)
58+
require.NoError(t, err)
59+
require.Equal(t, "https", ref.Context().Registry.Scheme(), "should use HTTPS scheme by default")
60+
})
61+
62+
t.Run("insecure flag works with localhost registry", func(t *testing.T) {
63+
nameOpts, _ := MakeRemoteRegistryRequestOptions(nil, true, false)
64+
65+
ref, err := name.ParseReference("localhost:5000/deckhouse/install:v1.0.0", nameOpts...)
66+
require.NoError(t, err)
67+
require.Equal(t, "http", ref.Context().Registry.Scheme())
68+
require.Equal(t, "localhost:5000", ref.Context().RegistryStr())
69+
})
70+
71+
t.Run("insecure flag works with IP-based registry", func(t *testing.T) {
72+
nameOpts, _ := MakeRemoteRegistryRequestOptions(nil, true, false)
73+
74+
ref, err := name.ParseReference("192.168.1.100:5000/repo:tag", nameOpts...)
75+
require.NoError(t, err)
76+
require.Equal(t, "http", ref.Context().Registry.Scheme())
77+
})
78+
}
79+
80+
func TestMakeRemoteRegistryRequestOptions_TLSSkipVerify(t *testing.T) {
81+
t.Run("TLS skip verify creates custom transport", func(t *testing.T) {
82+
_, remoteOpts := MakeRemoteRegistryRequestOptions(nil, false, true)
83+
require.Len(t, remoteOpts, 3, "should have 3 remote options: transport + puller + pusher")
84+
})
85+
86+
t.Run("both insecure and TLS skip verify", func(t *testing.T) {
87+
nameOpts, remoteOpts := MakeRemoteRegistryRequestOptions(nil, true, true)
88+
require.Len(t, nameOpts, 1, "should have name.Insecure option")
89+
require.Len(t, remoteOpts, 3, "should have transport + puller + pusher options")
90+
})
91+
92+
t.Run("secure mode without TLS skip", func(t *testing.T) {
93+
nameOpts, remoteOpts := MakeRemoteRegistryRequestOptions(nil, false, false)
94+
require.Len(t, nameOpts, 0, "should have no name options")
95+
require.Len(t, remoteOpts, 2, "should have only puller + pusher options")
96+
})
97+
}
98+
99+
func TestMakeRemoteRegistryRequestOptions_RegressionTest(t *testing.T) {
100+
t.Run("insecure flag must be passed to name.ParseReference", func(t *testing.T) {
101+
nameOpts, _ := MakeRemoteRegistryRequestOptions(nil, true, false)
102+
103+
require.NotEmpty(t, nameOpts, "name options must not be empty when insecure=true")
104+
105+
ref, err := name.ParseReference("localhost:5000/deckhouse/ee:v1.63.0", nameOpts...)
106+
require.NoError(t, err, "should parse reference with insecure option")
107+
require.Equal(t, "http", ref.Context().Registry.Scheme(),
108+
"REGRESSION: insecure flag must result in HTTP scheme, not HTTPS")
109+
})
110+
111+
t.Run("without insecure flag remote registry defaults to HTTPS", func(t *testing.T) {
112+
nameOpts, _ := MakeRemoteRegistryRequestOptions(nil, false, false)
113+
114+
ref, err := name.ParseReference("registry.example.com:5000/repo:tag", nameOpts...)
115+
require.NoError(t, err)
116+
require.Equal(t, "https", ref.Context().Registry.Scheme(),
117+
"without insecure flag, remote registry should default to HTTPS")
118+
})
119+
}

0 commit comments

Comments
 (0)