Add vendor HTTP header to docker registry

[mfojtik]

@miminar @mtrmac PTAL

@smarterclayton I can add a separate endpoint for the version information. We might also need to advertise the "public master API URL" for the Docker daemon, so it knows where to route the HTTP request to get the image signature from. I guess we can't just use the kubeconfig value and this will need to be a new option for the registry.

We also discussed with @legionus that it should not be that hard to add a completely new endpoint in the registry to serve the Image signatures. Basically, the Docker daemon will have to talk just to registry then. Registry will forward the request to OpenShift API and return the Image signature.

I'm open to both approaches (the registry serving signatures seems easier for Docker guys).

[pweil-]

Thought: could we convince upstream to allow middleware to extend the info endpoint and add all of our goodness there? This makes it non-divergent with the upstream and also allows docker info to be very useful

[mfojtik]

+1 @pweil- I think that is better solution.

We should be able to fill the info endpoint with plugins, vendor string and other information that clients can consume and validate.

[mfojtik]

as learned, the info endpoint is just for docker engine, not registry :-) so ignore the last comment.

we should however add this info into /v2/ endpoint as a HTTP header (X-Registry-Capabilities?). I will look how we can do that.

[pweil-]

+1. too much time in the engine api lately :)

[smarterclayton]

We could just do X-Registry-Supports-Certificate-...: 1

[mtrmac]

We might also need to advertise the "public master API URL" for the Docker daemon, so it knows where to route the HTTP request to get the image signature from.

Yes, this is really needed. AFAIK there is no guarantee that, and not even a structurally good reason to assume that, the registry hostname is also serving the API master.

[mtrmac]

Am I correct in guessing that this was closed because #12504 would replace it?

[mfojtik]

@mtrmac yes, unless something that will block it emerges.