Garden should work with a private registry that has a CA signed cert #31
Comments
|
We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/91802212. |
|
I ran into a similar problem using Concourse. We have a self-signed certificate on our registry. I would need to be able to add our root CA to garden's certificate chain. Here is my stacktrace: |
|
@onsi |
|
@BugRoger update if info.Standalone && authConfig != nil && factory != nil { and recreate release and deploy via bosh. |
|
@goonzoid @hashneo @BugRoger fwiw I'm fairly sure we can work around the issue without updating the docker dependency by simply passing an empty (rather than nil) AuthConfig struct to NewSession() on this line. Perhaps someone might be interested in submitting a PR with that change? |
|
Upfront caveat: complete Go and garden-linux newbie here. Our internal docker registry is setup in this manner, so we couldn't readily use it and Lattice as a gateway towards the larger platform. The last comment from @julz seemed fairly straightforward, so I figured I could possibly pattern match code my way to a solution and move things forward a little bit. Good news is that the suggestion by @julz is in the right direction. The only addition is that the HTTPRequestFactory argument also must be non-nil. With that change, I'm able to successfully build and use the garden-linux binary against our private docker repository. I've made that change (see newbie caveat). I did make an attempt to add a test, but am completely out of my depth (see newbie caveat). I couldn't determine how to pattern match my way into that solution. I'm a little hesitant to turn my change into a full fledged pull request, but can do so or am happy to get a little poke in the right direction with the test or another aspect (or be told that catching up with the docker dependency is the way to ultimately complete this). The other caveat: my testing was of the integration variety and consisted of copying the garden-linux binary into my existing Lattice VM. That uncovered another change, Thanks. |
|
hi @caseyhadden I added a comment on the linked commit, but it looks pretty close to me. You're right that failures related to changes to remove the special vcap user are unrelated (lattice just hasn't updated to the latest garden-linux yet). If you want to try writing an integration test, we have some tests that try to connect to a registry here |
|
Thanks, @julz. Those were just the pointers I needed. I've made those changes and was able to add the test. I've taken a look at the integration tests. I see usage of the docker-registry bits and how it can be configured with a cert. Will have to give some thought as to how to manage the certs themselves in the integration test environment. I'm currently trying to track down the status of our corporate CLA. Indications are that we should have signed and submitted it with our CFF membership, but we can't seem to put our hands on it. I'll create a PR once that is sorted out, assuming this isn't fixed in the meantime. |
|
Fixed by #47 🎉 🎈 |
It currently explodes. Someone running a private registry tried to fetch the Docker image using Lattice and got:
The text was updated successfully, but these errors were encountered: