fix: do not use image url to get registry auth data.

[jvanz]

Description

Updates the function used to verify container image signature to use only the registry name to get the auth data from docker config.json file. The current implementation uses the whole container image URL. Which failed to find the relevant auth data falling back to a anonymous authentication. This is a problem with private registries where access credentials must be used.

To fix this problem, this commit extract the registry name from the container image URL and use it to get the auth data from the config.json file.

Fix kubewarden/policy-server#912

Test

To test this pull request, you can build kwctl using this changes, execute a docker login in the private registry

1. Generate private/public key pair with cosign
2. Sign docker image
3. Submit signed image to private harbor registry. You can use demo.goharbor.io
4. Create robot account in the harbor instance
5. Login into the private registry using the robot account: docker login ...
6. Build kwctl using this change
7. kwctl run --settings-path settings.yaml --request-path pod_creation_signed.json registry://ghcr.io/kubewarden/policies/verify-image-signatures:v0.2.8

settings.yaml

signatures:
  - image: "PUT YOUR SIGNED CONTAINER IMAGE PREFIX HERE e.g: demo.goharbor.io/testing/*"  
    pubKeys:
      - |
        -----BEGIN PUBLIC KEY-----
       << YOUR COSIGN PUBLIC KEY >>>
        -----END PUBLIC KEY-----

pod_creation_signed.json

{
  "uid": "1299d386-525b-4032-98ae-1949f69f9cfc",
  "kind": {
    "group": "",
    "kind": "Pod",
    "version": "v1"
  },
  "resource": {
    "group": "",
    "version": "v1",
    "resource": "pods"
  },
  "object": {
    "metadata": {
      "name": "nginx"
    },
    "spec": {
      "containers": [
        {
          "image": "PUT YOUR SIGNED CONTAINER IMAGE HERE",
          "name": "test-verify-image-signatures"
        }
      ]
    }
  },
  "operation": "CREATE",
  "requestKind": {
    "group": "",
    "version": "v1",
    "kind": "Pod"
  },
  "userInfo": {
    "username": "alice",
    "uid": "alice-uid",
    "groups": [
      "system:authenticated"
    ]
  }
}

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 2 lines in your changes are missing coverage. Please review.

Project coverage is 41.29%. Comparing base (1075c0e) to head (b1ebe98).

Files	Patch %	Lines
src/verify/mod.rs	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     kubewarden/policy-fetcher#180      +/-   ##
==========================================
- Coverage   41.35%   41.29%   -0.06%     
==========================================
  Files          12       12              
  Lines         723      724       +1     
==========================================
  Hits          299      299              
- Misses        424      425       +1     

Flag	Coverage Δ
integration-tests	13.25% <0.00%> (-0.02%)	⬇️
unit-tests	33.83% <0.00%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[flavio]

The change looks good to me, step number 7 is wrong though, because you're pulling the policy from the ghcr, not from a private registry.

It would also be great to extend kwctl e2e tests to cover operations done against a private registry. We don't need to start a fancy registry like harbor. This can be done with a vanilla docker-distribution (aka docker registry) configured with some env variable.
You can see how this is done here, inside of the unit tests of oci-distribution.

[viccuad]

LGTM. I would also like to have a test for it.

[fabriziosestito]

The change looks good to me, step number 7 is wrong though, because you're pulling the policy from the ghcr, not from a private registry.

It would also be great to extend kwctl e2e tests to cover operations done against a private registry. We don't need to start a fancy registry like harbor. This can be done with a vanilla docker-distribution (aka docker registry) configured with some env variable. You can see how this is done here, inside of the unit tests of oci-distribution.

@flavio @jvanz we already use this in pattern in kwctl e2e tests, see https://github.com/kubewarden/kwctl/blob/1de2f0a7db81e38d4bb5a42cbea059805626b558/tests/e2e.rs#L330

[jvanz]

The change looks good to me, step number 7 is wrong though, because you're pulling the policy from the ghcr, not from a private registry.

It's not wrong. The policy does not need to be in the private registry. We are verifying the container image from the admission request, pod_creation_signed.json in this example