ko publish --insecure-registry falls back to HTTP for communication

[adambkaplan]

When the --insecure-registry option is passed to ko publish, ko falls back to using HTTP for image registry communication. This is problematic because some container registries (notably, OpenShift's internal registry) only publish HTTPS endpoints. Technically these image registries are secured - however they may be using untrusted/self-signed certificates.

Based on the work in #369 and #396, this behavior appears intentional to work with a local docker/distribution instance (ex - using KinD). Would it make sense to add a second --tls-verify flag, which defaults to true, but when false will ignore X.509 certificate errors?

[imjasonh]

Just to make sure I understand the issue, --insecure-registry toggles both InsecureSkipVerify (which you want), and name.Insecure (skip TLS entirely and fallback to http; which you don't want). Is that correct?

This is a bit unfortunate, since it will be thorny to change the semantics of the existing --insecure-registry flag that people might be using. Adding a new flag, --tls-skip-verify (or --tls-verify(=true)) might also be confusing, and we'd have to be careful to document how the two interact.

Let me think about it some more and see if anything comes out of it.

cc @jonjohnsonjr

[adambkaplan]

Just to make sure I understand the issue, --insecure-registry toggles both InsecureSkipVerify (which you want), and name.Insecure (skip TLS entirely and fallback to http; which you don't want). Is that correct?

That is correct.

Adding a new flag, --tls-skip-verify (or --tls-verify(=true)) might also be confusing, and we'd have to be careful to document how the two interact.

Indeed, that will be a challenge. My initial thought is to provide the following:

• New flag --tls-skip-verify, which toggles InsecureSkipVerify, we document this as "Use HTTPS, but skip verifying TLS certificates."
• Update the documentation for --insecure-registry to state --tls-skip-verify is effectively set to true (and will override any setting that is otherwise provided). Document as "Use HTTP and bypass any use of TLS encryption."

[adambkaplan]

Played around with this today, unfortunately we have a collision with a deprecated kubectl flag --insecure-skip-tls-verify.

We could go past deprecation and remove the flag, at the risk of breaking users who have untrusted kube apiservers 😱.

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.