Feature/insecure flag

[tannerjones4075]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

feature

/kind flaky-test

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area library

cli

tests

/area examples

What this PR does / why we need it:

Added --insecure flag to registry auth basic command

• Allows authentication to registries using plain HTTP (non-HTTPS) connections
• Useful for local development and testing with private registries
• Helps when working with registries that don't have TLS configured
• Example usage: falcoctl registry auth basic -u username -p password localhost:5000 --insecure
• This feature makes it easier to work with local and development registries that don't have TLS certificates configured, improving the development workflow and testing capabilities.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:
I tested this by created a local private registry and authenticated to it with the insecure tag and I was able to pull and pull from the registry:

docker run -d -p 5001:5000 --name registry1 registry:2  
./falcoctl registry auth basic --insecure -u testuser -p testpass --config ~/.falcoctl/config.yaml http://localhost:5001

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tannerjones4075
Once this PR has been reviewed and has the lgtm label, please assign leogr for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cpanato]

/ok-to-test

[tannerjones4075]

/ok-to-test

Any movement? I don't see any additional tests being ran.

[leogr]

/ok-to-test

Any movement? I don't see any additional tests being ran.

ok-to-test is not actually needed here, sorry. Also, I apologize for the delay in reviewing this PR (we have been busy with the upcoming release). Still, I want to assure you that this PR is under our radar. Thank tyou

[Copilot]

Pull Request Overview

Adds an --insecure flag to the registry auth basic command to allow plain HTTP connections and skip TLS certificate verification.

• Updates the OCI auth client to support InsecureSkipVerify via a new WithInsecure option.
• Enhances the basic login flow to detect http:///https:// schemes and apply insecure or fallback behavior.
• Binds the new flag in the CLI, updates utilities for scheme stripping, and adds tests for various insecure scenarios.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/oci/authn/client.go	Added Insecure option and configures transport to skip TLS verify.
internal/utils/validate.go	Strips http:///https:// prefixes before extracting registry name.
internal/login/basic/basic.go	Implements insecure flag logic: scheme detection, fallback, and errors.
cmd/registry/auth/basic/basic.go	Binds --insecure, passes WithInsecure() to client creation.
cmd/registry/auth/basic/basic_test.go	Tests covering HTTP/HTTPS success and failure with/without --insecure.

Comments suppressed due to low confidence (4)

cmd/registry/auth/basic/basic.go:29

• The import oras.land/oras-go/v2/registry/remote/auth is unused in this file and should be removed to keep imports clean.

"oras.land/oras-go/v2/registry/remote/auth",

cmd/registry/auth/basic/basic.go:84

• [nitpick] The flag description only mentions SSL certs; consider clarifying that --insecure also enables plain HTTP and skips TLS verification for self-signed certificates.

--insecure          allow connections to SSL registry without certs

internal/login/basic/basic.go:61

• [nitpick] This error message could be more informative by including the registry hostname, e.g., cannot use plain HTTP for %q without --insecure flag.

return fmt.Errorf("cannot use plain HTTP without --insecure flag")

internal/utils/validate.go:26

• The strings.TrimPrefix calls require importing the strings package. Add import "strings" to avoid a compile error.

ref = strings.TrimPrefix(strings.TrimPrefix(ref, "http://"), "https://")

[poiana]

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.

📝 Please follow instructions in the contributing guide to update your commits with the DCO

Full details of the Developer Certificate of Origin can be found at developercertificate.org.

The list of commits missing DCO signoff:

• a50792f removed unused package and improve error messaging

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[leogr]

/remove-lifecycle rotten

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[leogr]

/remove-lifecycle stale

[leogr]

Hi @tannerjones4075,

First of all, thanks for this PR, since the --insecure flag may be a reasonable feature for local development workflows.

However, commits are missing DCO sign-off, which is required for merging. Moreover, since this PR has been open for a while without activity, I'm going to close it for now to keep our backlog tidy. Please don't take this personally. Your contribution is appreciated!

Feel free to reopen this PR (or open a fresh one) if you have time to revisit it. We're happy to help if you have any questions.

Thanks again 🙏

[leogr]

/close

[poiana]

@leogr: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.