WIP Save authfile in container config.

[neVERberleRfellerER]

This is one possible approach usable as base for #6188 .

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: neVERberleRfellerER
To complete the pull request process, please assign jwhonce
You can assign the PR to them by writing /assign @jwhonce in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

Hi @neVERberleRfellerER. Thanks for your PR.

I'm waiting for a containers member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[vrothberg]

Just a couple of nits. Can you add a test to https://github.com/containers/libpod/blob/master/test/e2e/inspect_test.go to make sure we're not regressing in the future?

@rhatdan LGTM

[vrothberg]

Please add a comment.

[vrothberg]

Suggested change

	//Authfile is path to used authfile
	// Authfile is the path to the auth file used at container creation.

[vrothberg]

Suggested change

	//Authfile is path to authfile to use
	// Authfile is the path to auth file to use

[vrothberg]

@mheon PTAL Cool to put that in the config or shall we use a label?

[vrothberg]

Note that it's important to only store the auth file if it was actually specified by the user on the CLI via --authfile. We shouldn't store the default one. This way we are making sure that we can establish a priority for which authfile is being used during auto updates.

[mheon]

@vrothberg I'll admit I haven't been paying attention to the previous discussion here - what's the logic for making this a part of container config? Pros/cons vs. using labels? My initial instinct is that we should use a label, but I could be convinced otherwise.

[vrothberg]

@vrothberg I'll admit I haven't been paying attention to the previous discussion here - what's the logic for making this a part of container config? Pros/cons vs. using labels? My initial instinct is that we should use a label, but I could be convinced otherwise.

@neVERberleRfellerER is currently working on wiring authfile support into podman auto-update. A podman auto-update --authfile=... is already a big step forward but it's not quite enough for @neVERberleRfellerER's use case. Different containers might be pulled from the same registry but from different namespaces which may require different credentials. Hence, one authfile isn't enough.

The idea now is to store the authfile at container-creation time. During auto-update, we can look up if a container was created with a non-default authfile and use that instead when contacting the registry.

I recall that you preferred storing certain data in labels rather than extending the container config. This may be such a case.

[mheon]

My initial impression from this is that it should probably be a label similar to the ones we use for Inspect options (it's not strictly necessary for Libpod operation, but if it's there we'll know what to do with it).

[neVERberleRfellerER]

Since #6188 has been merged this isn't useful anymore. Let me know if you want authfile in container config for different reasons.
@vrothberg Thank you for everything.