Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fetch Kubernetes images using tag@hash rather to prevent invalid downloads #4104

Closed
tstromberg opened this issue Apr 16, 2019 · 7 comments
Closed

Fetch Kubernetes images using tag@hash rather to prevent invalid downloads #4104

tstromberg opened this issue Apr 16, 2019 · 7 comments
Labels
good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. kind/feature Categorizes issue or PR as related to a new feature. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. priority/backlog Higher priority than priority/awaiting-more-evidence. roadmap/2019 Items on the 2019 roadmap

Comments

@tstromberg
Copy link
Contributor

Currently, if a user uses --image-repository, they may end up with images that do not match the official Kubernetes ones.

We should use digests or some other mechanism to prevent mirror poisoning.
@tstromberg tstromberg added priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. kind/feature Categorizes issue or PR as related to a new feature. labels Apr 16, 2019
@tstromberg tstromberg mentioned this issue Apr 30, 2019
Merged
@tstromberg tstromberg added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. labels May 7, 2019
@tstromberg
Copy link
Contributor Author

tstromberg commented May 7, 2019 •
edited
Loading

kubeadm evidently supports tag@hash fetches. We should consider using this for all image pulls.

One idea is to have a program that can automatically generate tag@hash versions to store in the minikube code base. We can start by using this program manually, but eventually have it run nightly, proposing PR's when any hashes change.

@tstromberg tstromberg added the help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. label May 7, 2019
@tstromberg tstromberg changed the title Prevent --image-repository users from downloading poisoned images Fetch Kubernetes images using tag@hash rather to prevent invalid downloads May 7, 2019
@tstromberg tstromberg added roadmap/2019 Items on the 2019 roadmap r/2019q2 Issue was last reviewed 2019q2 labels May 23, 2019
@tstromberg tstromberg removed priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels Jul 12, 2019
@tstromberg tstromberg added the priority/backlog Higher priority than priority/awaiting-more-evidence. label Aug 16, 2019
@tstromberg tstromberg removed the r/2019q2 Issue was last reviewed 2019q2 label Sep 20, 2019
@medyagh medyagh added the good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. label Dec 16, 2019
@medyagh
Copy link
Member

medyagh commented Dec 16, 2019

this should be an easy add, I would be happy to review any PR that does this

@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 16, 2020
@fejta-bot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Apr 15, 2020
@fejta-bot
Copy link

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

@k8s-ci-robot
Copy link
Contributor

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@prasadkatti prasadkatti mentioned this issue Jun 11, 2020
Closed
@prasadkatti
Copy link
Contributor

While this would prevent mirror poisoning, it would also prevent people from experimenting with custom images (ref. #8421). Since most people use minikube as a dev environment, if we implement this we might want to provide users to ability to opt out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. kind/feature Categorizes issue or PR as related to a new feature. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. priority/backlog Higher priority than priority/awaiting-more-evidence. roadmap/2019 Items on the 2019 roadmap
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@tstromberg @medyagh @prasadkatti @k8s-ci-robot @fejta-bot