Skip to content

[WIP] [DNM] Revert "fix: remote builds defeault to insecure for local registries … #3253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
matejvasek wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

[WIP] [DNM] Revert "fix: remote builds defeault to insecure for local registries … #3253

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 0 additions & 39 deletions pkg/pipelines/tekton/templates.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ import (
"fmt"
"os"
"path"
"regexp"
"strings"
"text/template"

Expand Down Expand Up @@ -77,27 +76,6 @@ const (
defaultPipelinesTargetBranch = "main"
)

// insecureRegistryRegex matches localhost, 127.0.0.1, or registry.default.svc.cluster.local with optional port
var insecureRegistryRegex = regexp.MustCompile(`^(localhost|127\.0\.0\.1|registry\.default\.svc\.cluster\.local)(:[0-9]+)?$`)

// isInsecureRegistry checks if the given registry should be treated as insecure
// (skip TLS verification). This includes known local/cluster registries.
func isInsecureRegistry(registry string) bool {
// First check the basic regex pattern
if insecureRegistryRegex.MatchString(registry) {
return true
}

// Also check if registry includes the insecure registry as part of image path (e.g., "localhost/myimage")
// This handles cases where the registry might be part of a full image reference
parts := strings.SplitN(registry, "/", 2)
if len(parts) > 0 && insecureRegistryRegex.MatchString(parts[0]) {
return true
}

return false
}

type templateData struct {
FunctionName string
Annotations map[string]string
Expand Down Expand Up @@ -134,9 +112,6 @@ type templateData struct {

// S2I related properties
S2iImageScriptsUrl string

// TLS verification for registry operations
TlsVerify string
}

// createPipelineTemplatePAC creates a Pipeline template used for PAC on-cluster build
Expand Down Expand Up @@ -214,12 +189,6 @@ func createPipelineRunTemplatePAC(f fn.Function, labels map[string]string) error
image = f.Image
}

// Determine if TLS verification should be skipped
tlsVerify := "true"
if isInsecureRegistry(f.Registry) {
tlsVerify = "false"
}

data := templateData{
FunctionName: f.Name,
Annotations: f.Deploy.Annotations,
Expand All @@ -242,7 +211,6 @@ func createPipelineRunTemplatePAC(f fn.Function, labels map[string]string) error
PipelineYamlURL: fmt.Sprintf("%s/%s", resourcesDirectory, pipelineFileNamePAC),

S2iImageScriptsUrl: s2iImageScriptsUrl,
TlsVerify: tlsVerify,

RepoUrl: "\"{{ repo_url }}\"",
Revision: "\"{{ revision }}\"",
Expand Down Expand Up @@ -418,12 +386,6 @@ func createAndApplyPipelineRunTemplate(f fn.Function, namespace string, labels m
s2iImageScriptsUrl = quarkusS2iImageScriptsUrl
}

// Determine if TLS verification should be skipped
tlsVerify := "true"
if isInsecureRegistry(f.Registry) {
tlsVerify = "false"
}

data := templateData{
FunctionName: f.Name,
Annotations: f.Deploy.Annotations,
Expand All @@ -440,7 +402,6 @@ func createAndApplyPipelineRunTemplate(f fn.Function, namespace string, labels m
SecretName: getPipelineSecretName(f),

S2iImageScriptsUrl: s2iImageScriptsUrl,
TlsVerify: tlsVerify,

RepoUrl: f.Build.Git.URL,
Revision: pipelinesTargetBranch,
Expand Down
10 changes: 0 additions & 10 deletions pkg/pipelines/tekton/templates_s2i.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,6 @@ spec:
name: s2iImageScriptsUrl
type: string
default: 'image:///usr/libexec/s2i'
- description: Verify TLS when pushing to registry
name: tlsVerify
type: string
default: 'true'
tasks:
{{.GitCloneTaskRef}}
- name: scaffold
Expand All @@ -74,8 +70,6 @@ spec:
- '$(params.buildEnvs[*])'
- name: S2I_IMAGE_SCRIPTS_URL
value: $(params.s2iImageScriptsUrl)
- name: TLSVERIFY
value: $(params.tlsVerify)
runAfter:
- scaffold
{{.FuncS2iTaskRef}}
Expand Down Expand Up @@ -144,8 +138,6 @@ spec:
{{end}}
- name: s2iImageScriptsUrl
value: {{.S2iImageScriptsUrl}}
- name: tlsVerify
value: {{.TlsVerify}}
pipelineRef:
name: {{.PipelineName}}
workspaces:
Expand Down Expand Up @@ -214,8 +206,6 @@ spec:
{{end}}
- name: s2iImageScriptsUrl
value: {{.S2iImageScriptsUrl}}
- name: tlsVerify
value: {{.TlsVerify}}
pipelineRef:
name: {{.PipelineName}}
workspaces:
Expand Down
25 changes: 0 additions & 25 deletions pkg/pipelines/tekton/templates_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,31 +19,6 @@ const (
TestRegistry = "example.com/alice"
)

func Test_isInsecureRegistry(t *testing.T) {
tests := []struct {
name string
registry string
want bool
}{
{"localhost without port", "localhost", true},
{"127.0.0.1 without port", "127.0.0.1", true},
{"cluster local registry without port", "registry.default.svc.cluster.local", true},
{"localhost with port 5000", "localhost:5000", true},
{"127.0.0.1 with port 5000", "127.0.0.1:5000", true},
{"cluster local registry with port 5000", "registry.default.svc.cluster.local:5000", true},
{"external registry", "docker.io", false},
{"external registry with port", "quay.io:443", false},
{"similar but not matching", "localhost.example.com", false},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if got := isInsecureRegistry(tt.registry); got != tt.want {
t.Errorf("isInsecureRegistry(%q) = %v, want %v", tt.registry, got, tt.want)
}
})
}
}

func Test_createPipelineTemplatePAC(t *testing.T) {
tests := []struct {
name string
Expand Down
Loading