search

replicatedhq / outdated

Kubectl plugin to find and report outdated images running in a Kubernetes cluster
https://outdated.sh
Apache License 2.0
426 stars 23 forks source link

Option to validate against private registries #46

Open adriananeci opened 3 years ago

adriananeci commented 3 years ago

Is there any option to validate images that are coming from private registries?

marccampbell commented 3 years ago

@adamancini Because outdated runs as a kubectl plugin, it uses your local registry credentials. Private images will be scanned, if you are also logged in to the same registries from your workstation.

We could pull image pull secrets from the podSpec when we scan and use those credentials also/instead. I haven't thought through the feasibility or security implications of this, except to know that we need to think through the security implications before doing it.

Does docker login work for private images now? Or are you looking for a more automated solution that uses the cluster credentials?

adriananeci commented 3 years ago

I'm able to successfully login to the private registry using docker login locally, but still no luck with validating images. I'm still getting Unable to get image data

  1. Validate local docker login

    ❯ docker login anecik8sinfrastructure.azurecr.io
Authenticating with existing credentials...
Login Succeeded

  2. Manually pull the image

    ❯ docker pull anecik8sinfrastructure.azurecr.io/net/hellotcp:v1.0.0
v1.0.0: Pulling from net/hellotcp
4f4fb700ef54: Pull complete
c6d5d55350d6: Pull complete
5ff22a2c5594: Pull complete
Digest: sha256:2231321833a45f430161d2baec56fc35a4e6f107aa5de8f4aa4363fc57963a5d
Status: Downloaded newer image for anecik8sinfrastructure.azurecr.io/net/hellotcp:v1.0.0
anecik8sinfrastructure.azurecr.io/net/hellotcp:v1.0.0

  3. Run outdated plugin

    
❯ kubectl outdated

Image Current Latest Behind ................................ anecik8sinfrastructure.azurecr.io/net/hellotcp v1.0.0 Unable to get image data ................................



On the other hand, I think it would be a more elegant way to get `imagePullSecrets` from the podSpec than running docker login. What security implications do you think can block such a feature?