feat: add support for client tls on a per registry basis

[darkdragn]

Added a --registry-tls switch, using key=value style string, supporting keys [registry,cert,key] allowing multiple tls certs.

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here (e.g. I signed it!) and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[darkdragn]

I signed it!

[googlebot]

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

[tejal29]

@darkdragn Thanks for the PR.
Can you please add some tests?

[darkdragn]

@tejal29 Sorry about the delay, it's been a busy week. I'll try adding some throughout the week, but I'll have some up by this weekend at the latest. Let me know if that time frame doesn't work, if we're trying to make it into a beta/milestone/something, and I'll do what I can to move some work around and get to it earlier.

[tejal29]

no worries @darkdragn. Thanks!

[bputt]

@darkdragn thanks for this PR, it's extremely useful and I'd love to see it merged. Would you be able to write the tests?

[tejal29]

@bputt do you want to take this up?

[bputt]

@tejal29 I'm not a go dev, but prob could figure it out if I want this to get merged into master ;)....Can confirm it works in prod (test it live!)

[antechrestos]

@tejal29 @darkdragn this job looks great. I am eager to take this up if needed. It would be too bad to lose it.

[bputt]

@antechrestos feel free, it'd be much appreciated

[antechrestos]

@bputt to do so I have two scenarios

1. create another pull request with a cherry-pick of @darkdragn job

2. ask @darkdragn to make me contributor of his cloned repository

[bputt]

@antechrestos I like option 1

[antechrestos]

I would like @tejal29 's point of view. Best of all would be @darkdragn 's return 😏

[antechrestos]

@tejal29 @bputt in fact I've just tested it against my companies' registry that uses a self-signed certificate and found out that this change does not bring what I was looking for. Looking further, I found out that this change uses an ssl authentication and does not import the registry certificate. I tested to use ssl authentication on gitlab registry and did not succeeded.

I am going to submit a new PR that allows user to import a registry certificate.

See #1037

[antechrestos]

@darkdragn does the change brought by #1037 suits your needs? If so, could you close this PR?
Thanks.

[bputt]

@antechrestos I can test the change once you release a newer version and push it up to dockerhub

[antechrestos]

@bputt I am not a core contributor. Hence I cannot make a release.

However you may checkout the project and run a make image to build the image locally. Otherwise we shall wait for 0.19 to be released.

[tejal29]

@antechrestos you can make a docker image and push it docker hub if you have access to a public registry.

All you have to do is run make images

REGISTRY=<your-registry> make images

and then you can push the images via docker command.

[antechrestos]

@bputt #1037 was released in 0.19 and the current version is 0.22.
Can you confirm us that your problem is solved?

@tejal29 the current change brought by this pull request was to provide a key pair of key to authenticate against a private registry?

It seems to be the analogue of protecting the daemon socket

Because currently we already have options to provide per registry certificates option.

@darkdragn can you confirm us that this pull request can be closed?

[tejal29]

@bputt #1037 was released in 0.19 and the current version is 0.22.
Can you confirm us that your problem is solved?

@tejal29 the current change brought by this pull request was to provide a key pair of key to authenticate against a private registry?

It seems to be the analogue of protecting the daemon socket

Because currently we already have options to provide per registry certificates option.

@darkdragn can you confirm us that this pull request can be closed?

Thanks @antechrestos for the explanation. Will wait for @darkdragn response.

[tejal29]

closing due to inactivity