cephadm: allow pulling from insecure registries

Signed-off-by: Joao Eduardo Luis <joao@suse.com>

diff --git a/src/cephadm/cephadm b/src/cephadm/cephadm
index ed392bd187d75cb9eacabdafc5aaa72270631e48..0b487b489aec3069241127f828f9e829db35cd5c 100755 (executable)
--- a/src/cephadm/cephadm
+++ b/src/cephadm/cephadm
@@ -3725,12 +3725,12 @@ def command_version(ctx):
 def command_pull(ctx):
     # type: (CephadmContext) -> int
 
-    _pull_image(ctx, ctx.image)
+    _pull_image(ctx, ctx.image, ctx.insecure)
     return command_inspect_image(ctx)
 
 
-def _pull_image(ctx, image):
-    # type: (CephadmContext, str) -> None
+def _pull_image(ctx, image, insecure=False):
+    # type: (CephadmContext, str, bool) -> None
     logger.info('Pulling container image %s...' % image)
 
     ignorelist = [
@@ -3740,8 +3740,12 @@ def _pull_image(ctx, image):
     ]
 
     cmd = [ctx.container_engine.path, 'pull', image]
-    if isinstance(ctx.container_engine, Podman) and os.path.exists('/etc/ceph/podman-auth.json'):
-        cmd.append('--authfile=/etc/ceph/podman-auth.json')
+    if isinstance(ctx.container_engine, Podman):
+        if insecure:
+            cmd.append('--tls-verify=false')
+
+        if os.path.exists('/etc/ceph/podman-auth.json'):
+            cmd.append('--authfile=/etc/ceph/podman-auth.json')
     cmd_str = ' '.join(cmd)
 
     for sleep_secs in [1, 4, 25]:
@@ -7401,6 +7405,11 @@ def _get_parser():
     parser_pull = subparsers.add_parser(
         'pull', help='pull latest image version')
     parser_pull.set_defaults(func=command_pull)
+    parser_pull.add_argument(
+        '--insecure',
+        action='store_true',
+        help=argparse.SUPPRESS,
+    )
 
     parser_inspect_image = subparsers.add_parser(
         'inspect-image', help='inspect local container image')

diff --git a/src/cephadm/tests/test_cephadm.py b/src/cephadm/tests/test_cephadm.py
index d95f76ea1b8f4f7be059f9c1e6a6e87d75b1d0ad..af1d086c5a7c1626dec99a775d986d4f81500781 100644 (file)
--- a/src/cephadm/tests/test_cephadm.py
+++ b/src/cephadm/tests/test_cephadm.py
@@ -1362,6 +1362,7 @@ class TestPull:
     def test_error(self, get_image_info_from_inspect, call, sleep):
         ctx = cd.CephadmContext()
         ctx.container_engine = mock_podman()
+        ctx.insecure = False
 
         call.return_value = ('', '', 0)
         retval = cd.command_pull(ctx)

diff --git a/src/pybind/mgr/cephadm/module.py b/src/pybind/mgr/cephadm/module.py
index 41476c1c99207f1ddf9c75b039d754fb5d2cd206..4742e01932e61de53609bf763fa8ee44bdaa3544 100644 (file)
--- a/src/pybind/mgr/cephadm/module.py
+++ b/src/pybind/mgr/cephadm/module.py
@@ -295,6 +295,12 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule,
             default=None,
             desc='Custom repository password'
         ),
+        Option(
+            'registry_insecure',
+            type='bool',
+            default=False,
+            desc='Registry is to be considered insecure (no TLS available). Only for development purposes.'
+        ),
         Option(
             'use_repo_digest',
             type='bool',
@@ -402,6 +408,7 @@ class CephadmOrchestrator(orchestrator.Orchestrator, MgrModule,
             self.registry_url: Optional[str] = None
             self.registry_username: Optional[str] = None
             self.registry_password: Optional[str] = None
+            self.registry_insecure: bool = False
             self.use_repo_digest = True
             self.default_registry = ''
             self.autotune_memory_target_ratio = 0.0

diff --git a/src/pybind/mgr/cephadm/serve.py b/src/pybind/mgr/cephadm/serve.py
index c93e95cc26c046a49e5b98078df4dff1120b6c46..e8734cfd21fce4f06dd7afae59d04bad4b3f3ce0 100644 (file)
--- a/src/pybind/mgr/cephadm/serve.py
+++ b/src/pybind/mgr/cephadm/serve.py
@@ -1309,7 +1309,11 @@ class CephadmServe:
             self._registry_login(host, self.mgr.registry_url,
                                  self.mgr.registry_username, self.mgr.registry_password)
 
-        j = self._run_cephadm_json(host, '', 'pull', [], image=image_name, no_fsid=True)
+        pullargs: List[str] = []
+        if self.mgr.registry_insecure:
+            pullargs.append("--insecure")
+
+        j = self._run_cephadm_json(host, '', 'pull', pullargs, image=image_name, no_fsid=True)
 
         r = ContainerInspectInfo(
             j['image_id'],