Skip to content

Commit 502adc1

Browse files
fabriziosestitofabriziosestito
authored
Merge pull request #394 from alegrey91/issue/384
feat: support authentication for registries
2 parents ad51c36 + 318a69c commit 502adc1

19 files changed

Lines changed: 923 additions & 19 deletions

File tree

‎Tiltfile‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,13 @@ update_settings(k8s_upsert_timeout_secs=300)
55

66
# Setup a development registry so we can push images to it
77
# and use them to test the scanner.
8-
k8s_yaml("./hack/registry.yaml")
8+
# To setup a private registry, set `use_private_registry: true`
9+
# on the configuration file.
10+
use_private_registry = settings.get("use_private_registry", False)
11+
if use_private_registry:
12+
k8s_yaml("./hack/private-registry.yaml")
13+
else:
14+
k8s_yaml("./hack/registry.yaml")
915

1016
k8s_resource(
1117
"dev-registry",

‎api/v1alpha1/registry_types.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ type Registry struct {
4949
Status RegistryStatus `json:"status,omitempty"`
5050
}
5151

52+
// IsPrivate returns true when the registry requires authentication.
53+
func (r *Registry) IsPrivate() bool {
54+
return r.Spec.AuthSecret != ""
55+
}
56+
5257
// +kubebuilder:object:root=true
5358

5459
// RegistryList contains a list of Registry

‎charts/sbombastic/templates/worker/role.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,9 @@ rules:
4040
- patch
4141
- update
4242
- watch
43+
- apiGroups:
44+
- ""
45+
resources:
46+
- secrets
47+
verbs:
48+
- get

‎cmd/worker/main.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"github.com/rancher/sbombastic/internal/handlers/registry"
2121
"github.com/rancher/sbombastic/internal/messaging"
2222
"github.com/rancher/sbombastic/pkg/generated/clientset/versioned/scheme"
23+
k8sscheme "k8s.io/client-go/kubernetes/scheme"
2324
)
2425

2526
func main() { //nolint:funlen // This function is intentionally long to keep the main logic together.
@@ -77,6 +78,10 @@ func main() { //nolint:funlen // This function is intentionally long to keep the
7778
logger.Error("Error adding storagev1alpha1 to scheme", "error", err)
7879
os.Exit(1)
7980
}
81+
if err = k8sscheme.AddToScheme(scheme); err != nil {
82+
logger.Error("Error adding kubernetes to scheme", "error", err)
83+
os.Exit(1)
84+
}
8085
k8sClient, err := client.New(config, client.Options{Scheme: scheme})
8186
if err != nil {
8287
logger.Error("Error creating k8s client", "error", err)

‎docs/private_registry.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Private Registries
2+
3+
SBOMbastic supports private registries to scan for images. In order to make it work, please follow the steps listed below.
4+
5+
## Create the Secret
6+
7+
SBOMbastic relies on the docker `config.json` file to manage the authentication to the registries.
8+
9+
The first step to setup a private registry is to create a `Secret` with the `config.json` content, having the following structure:
10+
11+
```yaml
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: my-auth-secret
16+
namespace: default
17+
data:
18+
.dockerconfigjson: ewoJImF1dGhzIjogewoJCSJkZXYtcmVnaXN0cnkuZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbDo1MDAwIjogewoJCQkiYXV0aCI6ICJkWE5sY2pwd1lYTnpkMjl5WkE9PSIKCQl9Cgl9Cn0KCg==
19+
type: kubernetes.io/dockerconfigjson
20+
```
21+
22+
The `.dockerconfigjson` field is a base64 value, with the `config.json` content.
23+
24+
Here's an example:
25+
26+
```json
27+
{
28+
"auths": {
29+
"myprivateregistry.example": {
30+
"auth": "dXNlcjpwYXNzd29yZA=="
31+
}
32+
}
33+
}
34+
```
35+
36+
For more info, please take a look to the Kubernetes [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).
37+
38+
### Tip
39+
40+
Save the `config.json` into a file and use the following command to save it into the `Secret` file:
41+
42+
```sh
43+
cat dockerconfig.json | base64 -w 0 | xclip -sel clipboard
44+
```
45+
46+
## Create the Registry
47+
48+
Once your `Secret` is ready, you can reference it on the `Registry` configuration, specifying the name in the `Registry` field `spec.authSecret`.
49+
50+
```yaml
51+
apiVersion: sbombastic.rancher.io/v1alpha1
52+
kind: Registry
53+
metadata:
54+
name: my-first-registry
55+
namespace: default
56+
spec:
57+
uri: dev-registry.default.svc.cluster.local:5000
58+
scanInterval: 1h
59+
authSecret: my-auth-secret
60+
```
61+
62+
This will allow SBOMbastic to scan for images from private registries.
63+
64+
**Please, note**:
65+
66+
The `Secret` and the `Registry` must be defined inside of the very same `Namespace`.

‎examples/private-registry/dockerconfig.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"auths": {
3+
"myprivateregistry.example": {
4+
"auth": "dXNlcjpwYXNzd29yZA=="
5+
}
6+
}
7+
}

‎examples/private-registry/registry.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: sbombastic.rancher.io/v1alpha1
2+
kind: Registry
3+
metadata:
4+
name: my-first-registry
5+
namespace: default
6+
spec:
7+
uri: dev-registry.default.svc.cluster.local:5000
8+
scanInterval: 1h
9+
authSecret: my-auth-secret

‎examples/private-registry/secret.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: my-auth-secret
5+
namespace: default
6+
data:
7+
.dockerconfigjson: ewoJImF1dGhzIjogewoJCSJkZXYtcmVnaXN0cnkuZGVmYXVsdC5zdmMuY2x1c3Rlci5sb2NhbDo1MDAwIjogewoJCQkiYXV0aCI6ICJkWE5sY2pwd1lYTnpkMjl5WkE9PSIKCQl9Cgl9Cn0KCg==
8+
type: kubernetes.io/dockerconfigjson
9+

‎go.mod‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ require (
88
github.com/Masterminds/squirrel v1.5.4
99
github.com/aquasecurity/trivy v0.65.0
1010
github.com/aquasecurity/trivy-db v0.0.0-20250723062229-56ec1e482238
11+
github.com/docker/cli v28.3.2+incompatible
12+
github.com/docker/docker v28.3.3+incompatible
1113
github.com/go-logr/logr v1.4.3
1214
github.com/google/go-cmp v0.7.0
1315
github.com/google/go-containerregistry v0.20.6
@@ -20,7 +22,10 @@ require (
2022
github.com/spdx/tools-golang v0.5.5
2123
github.com/spf13/cobra v1.9.1
2224
github.com/stretchr/testify v1.11.1
25+
github.com/testcontainers/testcontainers-go v0.38.0
26+
github.com/testcontainers/testcontainers-go/modules/registry v0.38.0
2327
go.yaml.in/yaml/v3 v3.0.4
28+
k8s.io/api v0.33.3
2429
k8s.io/apimachinery v0.33.3
2530
k8s.io/apiserver v0.33.3
2631
k8s.io/client-go v0.33.3
@@ -141,6 +146,7 @@ require (
141146
github.com/containerd/typeurl/v2 v2.2.3 // indirect
142147
github.com/coreos/go-semver v0.3.1 // indirect
143148
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
149+
github.com/cpuguy83/dockercfg v0.3.2 // indirect
144150
github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46 // indirect
145151
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
146152
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -149,15 +155,14 @@ require (
149155
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
150156
github.com/distribution/reference v0.6.0 // indirect
151157
github.com/dlclark/regexp2 v1.11.0 // indirect
152-
github.com/docker/cli v28.3.2+incompatible // indirect
153158
github.com/docker/distribution v2.8.3+incompatible // indirect
154-
github.com/docker/docker v28.3.3+incompatible // indirect
155159
github.com/docker/docker-credential-helpers v0.9.3 // indirect
156160
github.com/docker/go v1.5.1-1 // indirect
157161
github.com/docker/go-connections v0.5.0 // indirect
158162
github.com/docker/go-units v0.5.0 // indirect
159163
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
160164
github.com/dustin/go-humanize v1.0.1 // indirect
165+
github.com/ebitengine/purego v0.8.4 // indirect
161166
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
162167
github.com/emirpasic/gods v1.18.1 // indirect
163168
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
@@ -181,6 +186,7 @@ require (
181186
github.com/go-json-experiment/json v0.0.0-20250223041408-d3c622f1b874 // indirect
182187
github.com/go-logr/stdr v1.2.2 // indirect
183188
github.com/go-logr/zapr v1.3.0 // indirect
189+
github.com/go-ole/go-ole v1.3.0 // indirect
184190
github.com/go-openapi/analysis v0.23.0 // indirect
185191
github.com/go-openapi/errors v0.22.1 // indirect
186192
github.com/go-openapi/jsonpointer v0.21.0 // indirect
@@ -254,7 +260,9 @@ require (
254260
github.com/liamg/memoryfs v1.6.0 // indirect
255261
github.com/lib/pq v1.10.9 // indirect
256262
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
263+
github.com/lufia/plan9stats v0.0.0-20240226150601-1dcf7310316a // indirect
257264
github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 // indirect
265+
github.com/magiconair/properties v1.8.10 // indirect
258266
github.com/mailru/easyjson v0.9.0 // indirect
259267
github.com/masahiro331/go-disk v0.0.0-20240625071113-56c933208fee // indirect
260268
github.com/masahiro331/go-ebs-file v0.0.0-20240917043618-e6d2bea5c32e // indirect
@@ -275,7 +283,9 @@ require (
275283
github.com/mitchellh/reflectwalk v1.0.2 // indirect
276284
github.com/moby/buildkit v0.23.2 // indirect
277285
github.com/moby/docker-image-spec v1.3.1 // indirect
286+
github.com/moby/go-archive v0.1.0 // indirect
278287
github.com/moby/locker v1.0.1 // indirect
288+
github.com/moby/patternmatcher v0.6.0 // indirect
279289
github.com/moby/spdystream v0.5.0 // indirect
280290
github.com/moby/sys/atomicwriter v0.1.0 // indirect
281291
github.com/moby/sys/mountinfo v0.7.2 // indirect
@@ -315,6 +325,7 @@ require (
315325
github.com/pkg/errors v0.9.1 // indirect
316326
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
317327
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
328+
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
318329
github.com/prometheus/client_golang v1.22.0 // indirect
319330
github.com/prometheus/client_model v0.6.2 // indirect
320331
github.com/prometheus/common v0.62.0 // indirect
@@ -334,6 +345,7 @@ require (
334345
github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
335346
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
336347
github.com/shibumi/go-pathspec v1.3.0 // indirect
348+
github.com/shirou/gopsutil/v4 v4.25.5 // indirect
337349
github.com/shopspring/decimal v1.4.0 // indirect
338350
github.com/sigstore/cosign/v2 v2.2.4 // indirect
339351
github.com/sigstore/protobuf-specs v0.4.1 // indirect
@@ -356,6 +368,8 @@ require (
356368
github.com/tetratelabs/wazero v1.9.0 // indirect
357369
github.com/theupdateframework/go-tuf v0.7.0 // indirect
358370
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
371+
github.com/tklauser/go-sysconf v0.3.13 // indirect
372+
github.com/tklauser/numcpus v0.7.0 // indirect
359373
github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
360374
github.com/transparency-dev/merkle v0.0.2 // indirect
361375
github.com/twitchtv/twirp v8.1.3+incompatible // indirect
@@ -373,6 +387,7 @@ require (
373387
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
374388
github.com/xlab/treeprint v1.2.0 // indirect
375389
github.com/yashtewari/glob-intersection v0.2.0 // indirect
390+
github.com/yusufpapurcu/wmi v1.2.4 // indirect
376391
github.com/zclconf/go-cty v1.16.3 // indirect
377392
github.com/zclconf/go-cty-yaml v1.1.0 // indirect
378393
github.com/zeebo/errs v1.4.0 // indirect
@@ -425,9 +440,7 @@ require (
425440
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
426441
gopkg.in/warnings.v0 v0.1.2 // indirect
427442
gopkg.in/yaml.v3 v3.0.1 // indirect
428-
gotest.tools/v3 v3.4.0 // indirect
429443
helm.sh/helm/v3 v3.18.6 // indirect
430-
k8s.io/api v0.33.3 // indirect
431444
k8s.io/apiextensions-apiserver v0.33.3 // indirect
432445
k8s.io/cli-runtime v0.33.3 // indirect
433446
k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect

‎go.sum‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1138,6 +1138,7 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
11381138
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
11391139
github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
11401140
github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
1141+
github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
11411142
github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
11421143
github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
11431144
github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
@@ -1856,6 +1857,8 @@ github.com/testcontainers/testcontainers-go/modules/k3s v0.37.0 h1:lqwknybf56hBL
18561857
github.com/testcontainers/testcontainers-go/modules/k3s v0.37.0/go.mod h1:RIsXAxAUiaDNfsGsYcZB1TyDn2mqy52lO0HrGFts8cs=
18571858
github.com/testcontainers/testcontainers-go/modules/localstack v0.38.0 h1:3ljIy6FmHtFhZsZwsaMIj/27nCRm0La7N/dl5Jou8AA=
18581859
github.com/testcontainers/testcontainers-go/modules/localstack v0.38.0/go.mod h1:BTsbqWC9huPV8Jg8k46Jz4x1oRAA9XGxneuuOOIrtKY=
1860+
github.com/testcontainers/testcontainers-go/modules/registry v0.38.0 h1:L/SFC/1j1KLARSHTHlNP918GVAyG/a8ME/LEQk286hY=
1861+
github.com/testcontainers/testcontainers-go/modules/registry v0.38.0/go.mod h1:dwVM1Qrw0IGkqXfvw04KmRO/wcTEOURrwS9Ui+86eRU=
18591862
github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
18601863
github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
18611864
github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
@@ -2259,6 +2262,7 @@ golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7w
22592262
golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22602263
golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22612264
golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
2265+
golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22622266
golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22632267
golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22642268
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2283,6 +2287,7 @@ golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7w
22832287
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22842288
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22852289
golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
2290+
golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22862291
golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22872292
golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
22882293
golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2783,8 +2788,8 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
27832788
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
27842789
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
27852790
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
2786-
gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
2787-
gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
2791+
gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
2792+
gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
27882793
helm.sh/helm/v3 v3.18.6 h1:S/2CqcYnNfLckkHLI0VgQbxgcDaU3N4A/46E3n9wSNY=
27892794
helm.sh/helm/v3 v3.18.6/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
27902795
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

0 commit comments

Comments
 (0)