Handle private registries which don't require auth #917
Conversation
|
This fix should be applied, as it does not make sense to add options --username="" --password="" to ansible-container if no authentication is required. |
Error was:
$ ansible-container push --push-to myregistry
Parsing conductor CLI args.
Engine integration loaded. Preparing push. engine=Docker™ daemon
Traceback (most recent call last):
File "/usr/local/bin/conductor", line 11, in <module>
load_entry_point('ansible-container', 'console_scripts', 'conductor')()
File "/_ansible/container/__init__.py", line 19, in __wrapped__
return fn(*args, **kwargs)
File "/_ansible/container/cli.py", line 399, in conductor_commandline
**params)
File "/_ansible/container/__init__.py", line 19, in __wrapped__
return fn(*args, **kwargs)
File "/_ansible/container/core.py", line 959, in conductorcmd_push
username, password = engine.login(username, password, email, url, config_path)
File "/_ansible/container/__init__.py", line 19, in __wrapped__
return fn(*args, **kwargs)
File "/_ansible/container/docker/engine.py", line 1134, in login
u'Please provide login credentials for registry {}.'.format(url))
container.exceptions.AnsibleContainerConductorException: Please provide login credentials for registry myregistry.test.
Conductor terminated. Cleaning up. command_rc=1 conductor_id=6bf66bde1725100e0baf80112dba1112999012dc9c5d94788e363f6ec89d5313 save_container=False
ERROR Conductor exited with status 1
Closes #911
|
@Voronenko could you review this one too :) ? |
|
That's the edge case, @pilou- . Generally, I do not think it is good idea to have private registry without authorization from security point of view. |
|
@gregdek could you merge this one ? |
|
Would like to hear more feedback from @Voronenko on this one -- are you saying that this PR is solving an edge case at the expense of breaking the private registry use case? |
|
This PR doesn't break private registry use case. Credentials (meaning: username and password) can still be provided:
Currently, ansible-container:
ansible-container should not require |
|
@gregdek Nope, it does not break. "Edge case" - wat I want to say, is that having private docker registry without authentication (or even filtered by IP) is the bad security practice. You will rarely meet such setup even in staging environment. So I would see allowance procedure either as attribute near registry creds, indicating that, or perhaps specifying both username and password to empty strings and handle that ... |
ISSUE TYPE
SUMMARY
Allow to push to private registries: remove exception.
Error was:
Fixes #911