Client Certificate Authentication

[rbkaspr]

Does Kaniko support the concept of authenticating to a secure registry using client TLS certificates?

For reference, looking for something similar to this: https://docs.docker.com/engine/security/certificates/

[tejal29]

@rbkaspr @antechrestos did some great work to add a new flag -registry-certificate
#1037

I am going to get this in next release v0.19.0

I am going to mark this as duplicate of #1100

[Jonher937]

Hi, #1037 does not seem to address the issue that the author describes, I believe this should be re-opened @tejal29
The link to the docker documentation does not match what --registry-certificate does.

From my understanding the --registry-certificate allows you to pass a certificate that is used in the check of the registry's certificate, if the passed and the actual certificate matches we ignore the CA author because the passed and actual certificate is what we expect.

What the author requests is the functionality to inherit or being able to pass a certificate + private key to be used for TLS authentication against the registry endpoint (Client certificate Authentication).

[rbkaspr]

@Jonher937 is correct, I am asking for information on how to have Kaniko authenticate with a registry using client certificates rather than a username and password, which is something my organization requires.

[rbkaspr]

@tejal29 Can this issue be reopened, or does Kaniko support this functionality now?

[theycallmeloki]

+1, I too would love the ability to authenticate purely with a certificate without a username-password combination, this might be related to this fixed issue

This is mostly because I followed instructions for a quick install trow registry and am able to build and push with certificates stored in /etc/docker/certs.d for both regular docker as well as the buildx docker builders

Kaniko however does not seem to accept just a certificate and insists on being presented with a username and password authentication scheme to push images into the registry