Repository navigation
Allow passing registry credentials via RunnerOptions - #4816
Closed
adi-coderr wants to merge 1 commit into
Closed
adi-coderr wants to merge 1 commit into
adi-coderr wants to merge 1 commit into
Conversation
adi-coderr
requested review from
efiacor,
kispaljr,
liamfallon and
mozesl-nokia
as code owners
October 18, 2026 15:00
✅ Deploy Preview for kptdocs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Credential-store handling, Docker Hub helper lookup, and empty-config parsing can still break valid registry configurations.
3 open issues
What changed in this PR
Adds caller-supplied registry credentials to kpt’s library runner, enabling private-registry tag resolution for custom runners such as Porch.
Changes:
- Adds structured, JSON, and file-based credentials with secret redaction.
- Integrates credentials into regclient with optional ambient-credential isolation.
- Adds parsing, redaction, and authenticated tag-resolution tests.
| File | Description |
|---|---|
| pkg/lib/runneroptions/runneroptions.go | Exposes registry credentials in runner options. |
| pkg/lib/runneroptions/credentials.go | Implements credential conversion, parsing, and redaction. |
| pkg/lib/runneroptions/credentials_test.go | Tests credential parsing and masking. |
| pkg/fn/runtime/runner.go | Configures regclient with supplied credentials. |
| pkg/fn/runtime/runner_test.go | Tests runner credential handling and tag resolution. |
| pkg/fn/runtime/lister_test.go | Tests authenticated registry tag listing. |
Review effort: Balanced
adi-coderr
force-pushed
the
fix/runneroptions-registry-credentials
branch
from
October 18, 2026 20:26
fc7fa63 to
3a90b84
Compare
adi-coderr
force-pushed
the
fix/runneroptions-registry-credentials
branch
from
October 18, 2026 21:20
3a90b84 to
bff8fba
Compare
Signed-off-by: adi-coderr <personalworkadi@gmail.com>
adi-coderr
force-pushed
the
fix/runneroptions-registry-credentials
branch
from
October 18, 2026 21:28
bff8fba to
2645bee
Compare
Comment on lines
+397
to
+399
| cmd := exec.Command(helper, "list") | ||
| cmd.Stdin = strings.NewReader("") | ||
| if out, err := cmd.Output(); err == nil { |
Comment on lines
+229
to
+231
| hosts, err = parseDockerConfigJSON([]byte(`{"credsStore":"pass"}`), true) | ||
| require.NoError(t, err) | ||
| assert.Nil(t, hosts) |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This Fixes: #4813
Description
Previously,
RunnerOptionsonly allowed passing custom TLS certificates (ExtraTlsCerts), while registry credentials were hardcoded toregclient.WithDockerCreds().In custom runners and multi-tenant environments (such as Porch's pod evaluator), container execution supports private registries via Kubernetes Secrets (
imagePullSecrets), but tag resolution and listing on the kpt side would fail with401 Unauthorized/ repository not found becauseregclienthad no access to the corresponding registry credentials.This change introduces
RegistryCredentialsinRunnerOptionsso callers can supply credentials for private registries when resolving tags and listing images.Key Changes
Added
RegistryCredentialstoRunnerOptions(pkg/lib/runneroptions):Hosts(RegistryHost) with usernames, passwords, tokens, and TLS settings.DockerConfigJSON([]byte) to consume Kubernetes Secrets (e.g.secret.Data[".dockerconfigjson"]or.dockercfg) directly without writing files to disk.DockerConfigFilefor custom file paths.DisableDefaultDockerCredsto enable strict multi-tenant isolation by disabling host/node ambient credentials.Security Considerations:
fmt.Stringer,fmt.GoStringer, andjson.Marshalerfor bothRegistryCredentialsandRegistryHostto ensure credentials (Password,Token,ClientKey,DockerConfigJSON) are always redacted ([REDACTED]) in logs, error traces, and JSON serialization./tmp.DOCKER_AUTH_CONFIG), preventing race conditions and cross-tenant credential leakage in concurrent environments like Porch.regclientIntegration (pkg/fn/runtime/runner.go):regclient.WithConfigHost(...)and optional config files toregclient.WithDockerCredsFile(...).Verification & Testing
pkg/lib/runneroptions/credentials_test.go):config.json(auths), base64 credentials, tokens, credential helpers, and legacy.dockercfg.String(),GoString(), andMarshalJSON().pkg/fn/runtime):TestRegClientLister_Authentication: Verifies 401 Unauthorized without credentials vs 200 OK with credentials against private registry endpoints.TestNewRunner_RegistryCredentials: Verifies runner initialization withHosts,DockerConfigJSON, andDockerConfigFile, including live semver tag resolution (^1.0->v1.1.0/v1.2.0) against private registries.make test-fn-eval T=".*": All 60+ containerized KRM function evaluation tests pass.make test-fn-render T="image-pull-policy.*": All image pull policy tests pass.