@@ -113,6 +113,7 @@ type ImageRepositoryReconciler struct {
113113 DatabaseReader
114114 }
115115 DeprecatedLoginOpts login.ProviderOptions
116+ AllowInsecureHTTP bool
116117
117118 patchOptions []patch.Option
118119}
@@ -249,9 +250,15 @@ func (r *ImageRepositoryReconciler) reconcile(ctx context.Context, sp *patch.Ser
249250 }
250251
251252 // Parse image reference.
252- ref , err := parseImageReference (obj .Spec .Image )
253+ ref , err := r . parseImageReference (obj .Spec .Image , obj . Spec . Insecure )
253254 if err != nil {
254- conditions .MarkStalled (obj , imagev1 .ImageURLInvalidReason , err .Error ())
255+ var reason string
256+ if errors .Is (err , helper .ErrInsecureHTTPBlocked ) {
257+ reason = meta .InsecureConnectionsDisallowedReason
258+ } else {
259+ reason = imagev1 .ImageURLInvalidReason
260+ }
261+ conditions .MarkStalled (obj , reason , err .Error ())
255262 result , retErr = ctrl.Result {}, nil
256263 return
257264 }
@@ -268,11 +275,18 @@ func (r *ImageRepositoryReconciler) reconcile(ctx context.Context, sp *patch.Ser
268275 // Check if it can be scanned now.
269276 ok , when , reasonMsg , err := r .shouldScan (* obj , startTime )
270277 if err != nil {
271- e := fmt .Errorf ("failed to determine if it's scan time: %w" , err )
272- conditions .MarkFalse (obj , meta .ReadyCondition , metav1 .StatusFailure , e .Error ())
278+ var e error
279+ if errors .Is (err , helper .ErrInsecureHTTPBlocked ) {
280+ e = err
281+ conditions .MarkStalled (obj , meta .InsecureConnectionsDisallowedReason , e .Error ())
282+ } else {
283+ e = fmt .Errorf ("failed to determine if it's scan time: %w" , err )
284+ conditions .MarkFalse (obj , meta .ReadyCondition , metav1 .StatusFailure , e .Error ())
285+ }
273286 result , retErr = ctrl.Result {}, e
274287 return
275288 }
289+ conditions .Delete (obj , meta .StalledCondition )
276290
277291 // Scan the repository if it's scan time. No scan is a no-op reconciliation.
278292 // The next scan time is not reset in case of no-op reconciliation.
@@ -468,7 +482,7 @@ func (r *ImageRepositoryReconciler) shouldScan(obj imagev1.ImageRepository, now
468482
469483 // If the canonical image name of the image is different from the last
470484 // observed name, scan now.
471- ref , err := parseImageReference (obj .Spec .Image )
485+ ref , err := r . parseImageReference (obj .Spec .Image , obj . Spec . Insecure )
472486 if err != nil {
473487 return false , scanInterval , "" , err
474488 }
@@ -570,13 +584,23 @@ func eventLogf(ctx context.Context, r kuberecorder.EventRecorder, obj runtime.Ob
570584}
571585
572586// parseImageReference parses the given URL into a container registry repository
573- // reference.
574- func parseImageReference (url string ) (name.Reference , error ) {
587+ // reference. If insecure is set to true, then the registry is deemed to be
588+ // located at an HTTP endpoint.
589+ func (r * ImageRepositoryReconciler ) parseImageReference (url string , insecure bool ) (name.Reference , error ) {
575590 if s := strings .Split (url , "://" ); len (s ) > 1 {
576591 return nil , fmt .Errorf (".spec.image value should not start with URL scheme; remove '%s://'" , s [0 ])
577592 }
578593
579- ref , err := name .ParseReference (url )
594+ var opts []name.Option
595+ if insecure {
596+ if r .AllowInsecureHTTP {
597+ opts = append (opts , name .Insecure )
598+ } else {
599+ return nil , helper .ErrInsecureHTTPBlocked
600+ }
601+ }
602+
603+ ref , err := name .ParseReference (url , opts ... )
580604 if err != nil {
581605 return nil , err
582606 }
0 commit comments