[
https://issues.apache.org/jira/browse/CAMEL-26685?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26685 started by Claus Ibsen.
-------------------------------------------
> camel-docker - imagepull/imagepush: use endpoint auth only for its own
> registry
> -------------------------------------------------------------------------------
>
> Key: CAMEL-26685
> URL: https://issues.apache.org/jira/browse/CAMEL-26685
> Project: Camel
> Issue Type: Improvement
> Components: camel-docker
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.24.0
>
>
> The {{imagepull}} and {{imagepush}} operations of the camel-docker producer
> always attach the authentication of the endpoint ({{username}}, {{password}},
> {{email}}, {{serverAddress}}) to the pull or push command, whatever registry
> the image reference points to. The image reference comes from the
> {{repository}} / {{name}} options or from the {{CamelDockerRepository}} /
> {{CamelDockerName}} headers. When no {{username}} is configured, the
> operations fail with a {{NullPointerException}} ("Configured username is
> null.") from docker-java's {{DockerClient.authConfig()}}, so pulling a public
> image without a login does not work.
> h3. Behaviour today
> * {{imagepull}} and {{imagepush}} call {{client.authConfig()}} and pass the
> result to {{withAuthConfig(...)}} for every image, also when the image is
> hosted on a different registry than the configured {{serverAddress}}.
> * Without a configured {{username}} both operations throw a
> {{NullPointerException}}.
> h3. Behaviour after the change
> * The endpoint authentication is attached only when a {{username}} is
> configured and the registry host of the image reference equals the registry
> host of the endpoint's {{serverAddress}}.
> * For an image on another registry the pull or push runs without
> authentication, and a DEBUG log line says why.
> * Without a {{username}} the operations run without authentication instead of
> failing.
> h3. Code changes
> * {{AsyncDockerProducer}} ({{executePullImageRequest}},
> {{executePushImageRequest}}): decide whether to attach the {{AuthConfig}}; do
> not call {{client.authConfig()}} when no username is set.
> * {{DockerHelper}}: new helper that returns the registry host of an image
> reference, following the Docker reference rules: the first path component is
> a registry when it contains {{.}} or {{:}} or is {{localhost}}, otherwise it
> is Docker Hub. Docker Hub aliases ({{docker.io}}, {{index.docker.io}},
> {{registry-1.docker.io}}, {{https://index.docker.io/v1/}}) are normalised to
> one value; scheme, path and a trailing {{/v1/}} on {{serverAddress}} are
> ignored; host and port are compared case-insensitively; a tag or digest
> suffix does not change the host.
> * Docs: {{docker-component.adoc}} and the
> {{allowConnectionAndCredentialsFromHeaders}} Javadoc in
> {{DockerConfiguration}} describe that pull and push use the endpoint
> authentication only for images in the registry of {{serverAddress}}
> (regenerate the catalog copies if an option description changes).
> * Upgrade guide 4.24 (camel-docker section): {{imagepull}} / {{imagepush}} of
> an image whose registry differs from {{serverAddress}} no longer send the
> endpoint's username and password; set {{serverAddress}} to the registry of
> the images, or use one endpoint per registry.
> h3. Tests
> JUnit 5 + Mockito, in
> {{components/camel-docker/src/test/java/org/apache/camel/component/docker/headers/}}
> (stub {{authConfig()}} on the mocked client):
> * {{PullImageCmdHeaderTest}} / {{PushImageCmdHeaderTest}}: an image of the
> configured registry gets the endpoint authentication; an image of another
> registry gets none ({{withAuthConfig}} never called).
> * {{PullImageCmdHeaderTest}}: without a username the pull runs and
> {{client.authConfig()}} is not called.
> * {{DockerHelperTest}}: registry host of image references (Docker Hub short
> names, {{library/}} names, host:port, {{localhost}}, digests, mixed case).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
