{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/41965","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/41965/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/41965/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/41965/events","html_url":"https://github.com/kubernetes/kubernetes/issues/41965","id":209712133,"number":41965,"title":"Cannot specify client cert and client key in image pull secret","user":{"login":"hobti01","id":4631304,"avatar_url":"https://avatars3.githubusercontent.com/u/4631304?v=3","gravatar_id":"","url":"https://api.github.com/users/hobti01","html_url":"https://github.com/hobti01","followers_url":"https://api.github.com/users/hobti01/followers","following_url":"https://api.github.com/users/hobti01/following{/other_user}","gists_url":"https://api.github.com/users/hobti01/gists{/gist_id}","starred_url":"https://api.github.com/users/hobti01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hobti01/subscriptions","organizations_url":"https://api.github.com/users/hobti01/orgs","repos_url":"https://api.github.com/users/hobti01/repos","events_url":"https://api.github.com/users/hobti01/events{/privacy}","received_events_url":"https://api.github.com/users/hobti01/received_events","type":"User","site_admin":false},"labels":[{"id":617149945,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-sig","name":"needs-sig","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-02-23T09:49:47Z","updated_at":"2017-06-01T00:48:56Z","closed_at":null,"body":"I have searched for all issues containing \"client cert pull\" and also \"docker-registry\".  I've located one issue which is strongly related, but not the same.  Ideally mutual TLS authentication is handled in one improvement.\r\n#41040 Asks how to use a server cert (ca.crt) without adding to /etc/docker/certs.d on each node and seems to incorrectly states that the client cert and key can be specified with `kubectl secret docker-registry` (AFAIK, the client cert and client key that can be specified are used to connect to the API server.  They are definitely not added to the generated secret).\r\n\r\n**Kubernetes version** (use `kubectl version`):\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"5\", GitVersion:\"v1.5.2\", GitCommit:\"08e099554f3c31f6e6f07b448ab3ed78d0520507\", GitTreeState:\"clean\", BuildDate:\"2017-\r\n01-12T04:57:25Z\", GoVersion:\"go1.7.4\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"5\", GitVersion:\"v1.5.2\", GitCommit:\"08e099554f3c31f6e6f07b448ab3ed78d0520507\", GitTreeState:\"clean\", BuildDate:\"2017-\r\n01-12T04:52:34Z\", GoVersion:\"go1.7.4\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n**Environment**:\r\n- **Cloud provider or hardware configuration**: GKE with gCloud Shell for kubectl\r\n- **OS** (e.g. from /etc/os-release): Debian GNU/Linux 8 (jessie)\r\n- **Kernel** (e.g. `uname -a`): Linux cs-6282-devshell-vm-7d07fe2a-a8f5-4e2d-bf2b-e8c744a77ad3-2d1 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1 (2016-12-30) x86_64 GNU/Linux\r\n\r\n**What happened**:\r\n```\r\n$ kubectl create secret docker-registry image-pull \\\r\n--docker-username=my-username \\\r\n--docker-password=\"my-password\" \\\r\n--docker-server=\"my-registry.example.com\" \\\r\n--client-certificate=/etc/docker/certs.d/my-registry.example.com/client.cert \\\r\n--client-key=/etc/docker/certs.d/my-registry.example.com/client.key \\\r\n--docker-email=\"my-email@example.com\"\r\n$ kubectl get secret image-pull -o yaml | grep dockercfg\\: | awk '{print $2}' | base64 -D\r\n{\"my-registry.example.com\":{\"username\":\"my-username\",\"password\":\"my-password\",\"email\":\"my-mail@example.com\",\"auth\":\"bXktdXNlcm5hbWU6bXktcGFzc3dvcmQ=\"}}\r\n# No client cert!\r\n```\r\n**What you expected to happen**:\r\nI expect the client-certificate and client-key to be part of the secret so that they are used during image pull.\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\nCreate a client certificate and then attempt to add it to a pull secret:\r\n```\r\n# create a self-signed client certificate as an example\r\n$ openssl req -nodes -new -x509 -keyout client.key -out client.cert\r\n# other instructions above\r\n```\r\nIn story form: Use a docker registry that requires a client certificate for authentication.  Attempt to add a client cert to a pull secret and use that cert for pulling images.  It seems that the only way to use a client cert is by adding the cert and key to the /etc/docker/certs.d/{registry} directory on every host.  This is not possible in many environments, including GKE.\r\n\r\n**Anything else we need to know**:\r\nEven if the client cert and key were stored within the Secret object, I think that's only half the problem.  The cert and key would also need to be used by docker for the image pull and I think the only supported method is files on the host.\r\nThis might require changes upstream within docker to work?  I don't think kubectl will write the client cert and key onto each host, which may be an information leakage problem.\r\n\r\nI'm creating this issue to initiate or locate a discussion about how to configure mutual TLS authentication/client cert authentication for image pulls.\r\n\r\nUpdate: Perhaps Kubernetes could be a [Docker Credential Helper](https://github.com/docker/docker-credential-helpers)?\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/305358006","html_url":"https://github.com/kubernetes/kubernetes/issues/41965#issuecomment-305358006","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/41965","id":305358006,"user":{"login":"k8s-merge-robot","id":13653959,"avatar_url":"https://avatars3.githubusercontent.com/u/13653959?v=3","gravatar_id":"","url":"https://api.github.com/users/k8s-merge-robot","html_url":"https://github.com/k8s-merge-robot","followers_url":"https://api.github.com/users/k8s-merge-robot/followers","following_url":"https://api.github.com/users/k8s-merge-robot/following{/other_user}","gists_url":"https://api.github.com/users/k8s-merge-robot/gists{/gist_id}","starred_url":"https://api.github.com/users/k8s-merge-robot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k8s-merge-robot/subscriptions","organizations_url":"https://api.github.com/users/k8s-merge-robot/orgs","repos_url":"https://api.github.com/users/k8s-merge-robot/repos","events_url":"https://api.github.com/users/k8s-merge-robot/events{/privacy}","received_events_url":"https://api.github.com/users/k8s-merge-robot/received_events","type":"User","site_admin":false},"created_at":"2017-06-01T00:48:56Z","updated_at":"2017-06-01T00:48:56Z","body":"@hobti01 There are no sig labels on this issue. Please [add a sig label](https://github.com/kubernetes/test-infra/blob/master/commands.md) by:<br>(1) mentioning a sig: `@kubernetes/sig-<team-name>-misc`<br>(2) specifying the label manually: `/sig <label>`<br><br>_Note: method (1) will trigger a notification to the team. You can find the team list [here](https://github.com/kubernetes/community/blob/master/sig-list.md)._"}}
{"actor":{"display_login":"k8s-merge-robot"}}