check image access on deis pull
#88
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 tasks
Cryptophobia
requested changes
Jan 14, 2019
Due to the nature of k8s' docker image cache, users can acccess other users' images in some situations (when they land on the same k8s node). That is, once user A has deployed privateregistry.example.com/image-a (with the help of `deis registry:set password=... username=...`), user B can just do `deis pull privateregistry.example.com/image-a` and that will (sometimes) work, since the image is in the k8s cache and thus not pulled again. This commit changes things so that on a `deis pull` (aka `deis build:create`) the controller tries to access the image (with the configured registry credentials, if any) - and then refuses to deploy it to k8s if that fails.
rwos
force-pushed
the
upstream-image-access-check
branch
from
b0a1e56 to
1ce3bc5
Compare
|
@Cryptophobia thanks for the review! I removed the --parallel stuff again |
|
Thank you for the PR and fixing this security issue in a creative way! |
Cryptophobia
approved these changes
Jan 16, 2019
duanhongyi
added a commit
to duanhongyi/controller
that referenced
this pull request
Apr 24, 2023
chore(controller): upgrade requirements pyOpenSSL==23.0.0
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
resolves teamhephy/workflow#78
Essentially, this just attempts a
docker_client.inspect_image(which downloads just the manifest, not the whole image) ondeis pulland that raises an error if it's a private registry and the user didn't add the correct credentials to the app.I think in the default hephy install, with the on-cluster
deis-registry, you can still "steal" other users' source build images by doingdeis pull 127.0.0.1:5555/hephy/some-app:git-$githash. But for that to work, you'd need to somehow guess the app name and the correct git hash - I don't think that's very likely. Plus, that stops working if you use a password-protected off-cluster registry for hephy.