Deion of problem Multiple instances were reported where a co

azurecr.io is a public registry and should not require users to set either of th

We will also need support for Insecure . As <a class="

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Recommended flags for additional registry configuration <div class="snippet-clip

Add flags to support --local-path workflow that allows user to override registry opts defaults about apps-cli-plugin HOT 5 CLOSED

vmware-tanzu commented on June 8, 2024

Add flags to support --local-path workflow that allows user to override registry opts defaults

from apps-cli-plugin.

Comments (5)

rashedkvm commented on June 8, 2024 1

azurecr.io is a public registry and should not require users to set either of these flags CACertPaths, VerifyCerts, or Insecure. The issue could be related to firewall settings, CORS policy, etc.
As per our team discussion, our goal is only to support TLS connections. For TLS connection to registries with client cert(mTLS) or cert issued by private certificate authorities, we will need additional flag(s) in the apps CLI plugin. Love to get design input regarding the new flag(s).

@danfein ^^

from apps-cli-plugin.

cpage-pivotal commented on June 8, 2024

We will also need support for Insecure. As @rashedkvm notes, firewall/CORS settings are preventing secure access to public signed registries like azurecr.io, and the developer teams that want to use this capability do not have privileges to override this.

from apps-cli-plugin.

atmandhol commented on June 8, 2024

@danfein Can we get Design recco for a CA Certs Path flag that can be used multiple times?

from apps-cli-plugin.

danfein commented on June 8, 2024

Recommendation

--registry-ca-cert

--registry-ca-cert                 string    file path to CA certificate used to authenticate with registry. Flag may be used multiple times

Thinking

registry - included to differentiate this ca cert from other ca certs that may need to be used by other parts of the system.

ca - included to differentiate it from a registry client cert which may also be needed --registry-client-cert

Also considered

--registry-cert - if there was only one cert type would have been a shorter option.

from apps-cli-plugin.

danfein commented on June 8, 2024

Recommended flags for additional registry configuration

 tanzu apps workload create -h
...
--registry-ca-cert       string    file path to CA certificate used to authenticate with registry.Flag may be used multiple times
--registry-username      string    username for authenticating with registry
--registry-password      string    password for authenticating with registry
--registry-token         string    token for authenticating with registry

from apps-cli-plugin.

Recommend Projects