Introduce global.containerRegistryCACertSecret

[gcapizzi]

Is there a related GitHub Issue?

#1920

What is this change about?

This introduces a way to set a custom CA certificate to be used when contacting the container registry. It does so by accepting a Secret containing a ca.crt key and mounting that key as a file under /etc/ssl/certs.

Given /etc/ssl/certs is one of the default locations used by Golang to build its system certificates pool, there's no more need to accept the REGISTRY_CA_FILE environment variable and set a dedicated http.Transport, so this PR removes that code.

Does this PR introduce a breaking change?

Yes, as REGISTRY_CA_FILE won't have any effect after this gets merged.

[gcapizzi]

This is not properly tested yet.

I have modified deploy-on-kind.sh so that:

• twuni/docker-registry was installed with tlsSecretName set to a Secret containing a certificate that I have signed with my own CA certificate;
• Korifi was installed with global.containerRegistryCACertSecret set to a Secret containing the CA certificate.

I am getting the following error, which I don't really understand:

{"level":"info","ts":"2022-12-06T17:10:28.183923454Z","logger":"http-logger","msg":"request","correlation-id":"99ad93da-b47b-471f-aac4-73fbc6cf3492","url":"/v3/packages/b10204ab-f3eb-46bf-994f-bf357f4b1f4c/upload","method":"POST","remoteAddr":"10.244.0.17:39738","contentLength":921}
{"level":"info","ts":"2022-12-06T17:10:28.265822007Z","logger":"PackageHandler","msg":"Error calling UploadSourceImage","correlation-id":"99ad93da-b47b-471f-aac4-73fbc6cf3492","err":"pushing image ref 'localregistry-docker-registry.default.svc:30050/packages' failed: failed to upload image: HEAD https://localregistry-docker-registry.default.svc:30050/v2/packages/blobs/sha256:6ea850dc4998e09d838430999d44ef93f17a1f15d6db372894b49f01e4e2f487: unexpected status code 401 Unauthorized (HEAD responses have no body, use GET for details)"}
{"level":"info","ts":"2022-12-06T17:10:28.265962198Z","logger":"PackageHandler","msg":"handler returned error","correlation-id":"99ad93da-b47b-471f-aac4-73fbc6cf3492","error":"pushing image ref 'localregistry-docker-registry.default.svc:30050/packages' failed: failed to upload image: HEAD https://localregistry-docker-registry.default.svc:30050/v2/packages/blobs/sha256:6ea850dc4998e09d838430999d44ef93f17a1f15d6db372894b49f01e4e2f487: unexpected status code 401 Unauthorized (HEAD responses have no body, use GET for details)"}
{"level":"info","ts":"2022-12-06T17:10:28.266005943Z","logger":"http-logger","msg":"response","correlation-id":"99ad93da-b47b-471f-aac4-73fbc6cf3492","status":502,"size":131,"durationMillis":82}

Note
Due to a weird behaviour of go-containerregisty, a registry URL containing .local will switch the client to plain HTTP. I have worked around this by using localregistry-docker-registry.default.svc (without the final .cluster.local) everywhere.

[gcapizzi]

I was able to test this locally all the way to a Kpack build-init failure. I tried to use cert-injection-webhook to fix it but with no success. I think this is mergeable, as our bit probably works (I was able to manually check the API change as it successfully uploaded the sources, I wasn't able to check the kpack-image-builder change as I never got to a built image). I'll keep this as a draft as me might want to wait until after releasing before merging it.

[georgethebeatle]

LGTM