Claus Ibsen created CAMEL-26685:
-----------------------------------
Summary: camel-docker - imagepull/imagepush: use endpoint auth
only for its own registry
Key: CAMEL-26685
URL: https://issues.apache.org/jira/browse/CAMEL-26685
Project: Camel
Issue Type: Improvement
Components: camel-docker
Reporter: Claus Ibsen
Assignee: Claus Ibsen
Fix For: 4.24.0
The {{imagepull}} and {{imagepush}} operations of the camel-docker producer
always attach the authentication of the endpoint ({{username}}, {{password}},
{{email}}, {{serverAddress}}) to the pull or push command, whatever registry
the image reference points to. The image reference comes from the
{{repository}} / {{name}} options or from the {{CamelDockerRepository}} /
{{CamelDockerName}} headers. When no {{username}} is configured, the operations
fail with a {{NullPointerException}} ("Configured username is null.") from
docker-java's {{DockerClient.authConfig()}}, so pulling a public image without
a login does not work.
h3. Behaviour today
* {{imagepull}} and {{imagepush}} call {{client.authConfig()}} and pass the
result to {{withAuthConfig(...)}} for every image, also when the image is
hosted on a different registry than the configured {{serverAddress}}.
* Without a configured {{username}} both operations throw a
{{NullPointerException}}.
h3. Behaviour after the change
* The endpoint authentication is attached only when a {{username}} is
configured and the registry host of the image reference equals the registry
host of the endpoint's {{serverAddress}}.
* For an image on another registry the pull or push runs without
authentication, and a DEBUG log line says why.
* Without a {{username}} the operations run without authentication instead of
failing.
h3. Code changes
* {{AsyncDockerProducer}} ({{executePullImageRequest}},
{{executePushImageRequest}}): decide whether to attach the {{AuthConfig}}; do
not call {{client.authConfig()}} when no username is set.
* {{DockerHelper}}: new helper that returns the registry host of an image
reference, following the Docker reference rules: the first path component is a
registry when it contains {{.}} or {{:}} or is {{localhost}}, otherwise it is
Docker Hub. Docker Hub aliases ({{docker.io}}, {{index.docker.io}},
{{registry-1.docker.io}}, {{https://index.docker.io/v1/}}) are normalised to
one value; scheme, path and a trailing {{/v1/}} on {{serverAddress}} are
ignored; host and port are compared case-insensitively; a tag or digest suffix
does not change the host.
* Docs: {{docker-component.adoc}} and the
{{allowConnectionAndCredentialsFromHeaders}} Javadoc in {{DockerConfiguration}}
describe that pull and push use the endpoint authentication only for images in
the registry of {{serverAddress}} (regenerate the catalog copies if an option
description changes).
* Upgrade guide 4.24 (camel-docker section): {{imagepull}} / {{imagepush}} of
an image whose registry differs from {{serverAddress}} no longer send the
endpoint's username and password; set {{serverAddress}} to the registry of the
images, or use one endpoint per registry.
h3. Tests
JUnit 5 + Mockito, in
{{components/camel-docker/src/test/java/org/apache/camel/component/docker/headers/}}
(stub {{authConfig()}} on the mocked client):
* {{PullImageCmdHeaderTest}} / {{PushImageCmdHeaderTest}}: an image of the
configured registry gets the endpoint authentication; an image of another
registry gets none ({{withAuthConfig}} never called).
* {{PullImageCmdHeaderTest}}: without a username the pull runs and
{{client.authConfig()}} is not called.
* {{DockerHelperTest}}: registry host of image references (Docker Hub short
names, {{library/}} names, host:port, {{localhost}}, digests, mixed case).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
