Function support for private registry in RuntimeImageOverride

[RafaelPaulovic]

Description

As a function runtime developer, I want to provide my own custom runtime image from a private registry so that I can have security and privacy into enterprise images.

Reasons

We have an internal custom runtime image that we don't want it to be publicly exposed. We want to run our custom runtime image in BTP Kyma where we shouldn't change its internal modules configurations.

Attachments

In our local Kyma setup with k3d, we append to the default kaniko arguments the k3d insecure registry available within the cluster: --insecure-registry=k3d-kyma-registry:5000. During function image build, kaniko can access and pull the custom runtime.

In BTP Kyma, changes to the serverless deployment are overwritten after some period of time, and we would need to push the custom runtime image to its internal registry so that it can access the image privately.

Error when trying to use a private repository from docker.io:

time="2023-09-27T14:38:57Z" level=info msg="Retrieving image manifest gmttosap/trial:latest"
time="2023-09-27T14:38:57Z" level=info msg="Retrieving image gmttosap/trial:latest from registry index.docker.io"
time="2023-09-27T14:38:57Z" level=error msg="Error while retrieving image from cache: gmttosap/trial:latest GET https://index.docker.io/v2/gmttosap/trial/manifests/latest: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:gmttosap/trial Type:repository]]"
time="2023-09-27T14:38:57Z" level=info msg="Retrieving image manifest gmttosap/trial:latest"
time="2023-09-27T14:38:57Z" level=info msg="Retrieving image gmttosap/trial:latest from registry index.docker.io"
error building image: GET https://index.docker.io/v2/gmttosap/trial/manifests/latest: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:gmttosap/trial Type:repository]]

[kwiatekus]

Its possible to read a user defined secret and inject it into filesystem of kaniko's build container

spec:
  runtime: ...
  runtimeImageOverride: ...
  runtimeImageOverridePullSecret: #reference to secret of type `dockerconfigjson`

In such case kaniko's dockerconfigjson file ( containing the srvls docker-registry config ) will be enriched with user provided pull secret

[kyma-bot]

This issue or PR has been automatically marked as stale due to the lack of recent activity.
Thank you for your contributions.

This bot triages issues and PRs according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 7d of inactivity since lifecycle/stale was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Close this issue or PR with /close

If you think that I work incorrectly, kindly raise an issue with the problem.

/lifecycle stale

[kyma-bot]

This issue or PR has been automatically closed due to the lack of activity.
Thank you for your contributions.

This bot triages issues and PRs according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 7d of inactivity since lifecycle/stale was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle stale

If you think that I work incorrectly, kindly raise an issue with the problem.

/close

[kyma-bot]

@kyma-bot: Closing this issue.

In response to this:

This issue or PR has been automatically closed due to the lack of activity.
Thank you for your contributions.

This bot triages issues and PRs according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 7d of inactivity since lifecycle/stale was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle stale

If you think that I work incorrectly, kindly raise an issue with the problem.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.