-
Notifications
You must be signed in to change notification settings - Fork 528
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
transport: Don't pass default service if unset #1360
Conversation
Codecov Report
@@ Coverage Diff @@
## main #1360 +/- ##
==========================================
- Coverage 74.20% 74.19% -0.01%
==========================================
Files 113 113
Lines 8439 8436 -3
==========================================
- Hits 6262 6259 -3
Misses 1571 1571
Partials 606 606
Continue to review full report at Codecov.
|
@imjasonh Hi, thank you for super quick fix. |
When this PR is merged I'll make sure to update Kaniko's dependency to pick it up. Then Kaniko will publish a commit-tagged image with that change that you can try out. |
@imjasonh Hello, Thank you for the merging the PR. Could you please point to kaniko image, with merged fix? I see something is related to is: If possible to -debug version: Thank you in advance. Regards. |
The Kaniko commit that bumped the dep to include this change was This means there's an image, |
Hi, I am so sorry, but kaniko
Kaniko doesn't log HTTP traffic. Is there Thank you. |
If the issue is pulling that image, you could definitely do a
|
Hi, @imjasonh . Example with curl how JWT bearer token defines reply from registry proxy: TOKEN1=`curl -X GET -sH 'Accept-encoding: gzip' 'https://registry-proxy.domain.com/v2/auth?scope=repository:rh-osbs/ubi9:pull&service=registry-proxy.domain.com' | jq -r '.token'`
TOKEN2=`curl -X GET -sH 'Accept-encoding: gzip' 'https://registry-proxy.domain.com/v2/auth?scope=repository:rh-osbs/ubi9:pull' | jq -r '.token'`
# TOKEN1 - with &service=registry-proxy.domain.com fails
curl -H "Authorization: Bearer $TOKEN1" -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" 'https://registry-proxy.domain.com/v2/rh-osbs/ubi9/manifests/latest'
{"error": "Invalid audience"}
^^^^^ exactly in the same way how kaniko fails.
# TOKEN1 - without &service:
curl -H "Authorization: Bearer $TOKEN2" -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" 'https://registry-proxy.domain.com/v2/rh-osbs/ubi9/manifests/latest'
{
"manifests": [
... Decoded TOKEN1 payload: {
"iss": "quay",
"aud": "registry-proxy.domain.com", <-------------------------- with &service=registry-proxy.domain.com
"nbf": 1652113788,
"iat": 1652113788,
"exp": 1652117388,
"sub": "rh-osbs+internal_registry_proxy_3",
"access": [
{
"type": "repository",
"name": "rh-osbs/ubi9",
"actions": [
"pull"
]
}
],
"context": {
"version": 2,
"entity_kind": "robot",
"entity_reference": "rh-osbs+internal_registry_proxy_3",
"kind": "user",
"user": "rh-osbs+internal_registry_proxy_3",
"com.apostille.roots": {
"rh-osbs/ubi9": "$disabled"
},
"com.apostille.root": "$disabled"
}
} Decoded TOKEN2 payload: {
"iss": "quay",
"aud": "quay.io", <---------------------------- correct audience
"nbf": 1652113800,
"iat": 1652113800,
"exp": 1652117400,
"sub": "rh-osbs+internal_registry_proxy_3",
"access": [
{
"type": "repository",
"name": "rh-osbs/ubi9",
"actions": [
"pull"
]
}
],
"context": {
"version": 2,
"entity_kind": "robot",
"entity_reference": "rh-osbs+internal_registry_proxy_3",
"kind": "user",
"user": "rh-osbs+internal_registry_proxy_3",
"com.apostille.roots": {
"rh-osbs/ubi9": "$disabled"
},
"com.apostille.root": "$disabled"
}
} With the above, I can assume that kaniko adds: &service=registry-proxy.domain.com
|
That's super helpful! So that makes it seem like Kaniko is still adding the proxy's URL as the service, because the www-authenticate header doesn't provide one. That's unexpected if this PR is included (which I believe it is...) Can you try running Kaniko with that commit-tagged image, with |
I will try to provide the info with |
Hello @imjasonh , unfortunatelly it doesn't show the same verbosity as
|
@imjasonh Hello, any updates on this? |
Fixes #1359