-
Epic
-
Resolution: Done
-
Normal
-
None
-
None
-
Implement Certificate-Based Authentication for Container Content on Capsule
-
In Progress
-
False
-
-
-
sat-artemis
-
Feature
-
-
Done
Goal:
- Today we only support basic Username/Password authentication for container content via Capsule registry.
- The goal of this epic is to allow clients to authenticate and access content using the rhsm consumer certs that we also use for yum content.
- We will also continue supporting username/pwd auth for clients, new and old.
- podman has had support for container certs for a while which means podman client is able to serve the certs with the requests to a registry. Flatpak introduces similar support in RHEL 10 which means we can support this for RHEL10 clients.
Also check this: https://docs.google.com/document/d/1TUj3FKUM-noiAtaqSacIfS2iLC2FY4C0O0mZIkp_6Fg/edit?tab=t.0
Proposed solution:
https://community.theforeman.org/t/enable-cert-authentication-for-container-content-flatpaks/42955
1. Allow users to set up cert auth for container content on their clients. This can be done via a remote job/registration template on managed hosts. Investigate using entitlement cert instead of consumer certs.
2. Enhance proxy registry to be able to support cert auth for clients.
Acceptance Criteria:
- As a registered host, I don't need to podman login to access container repositories on the capsule.
- As a registered host, I don't need to podman login to access flatpak index on the capsule.
- See: https://issues.redhat.com/browse/SAT-29028 for :
a) As a registered host, I can only access podman content in my content view environment(s) on the capsule.
b) As a registered host, I can only access flatpak content in my content view environment(s) on the capsule.
- relates to
-
SAT-32491 Flatpak Support for Provisioning: Implement Certificate-Based Authentication for Container Content on Satellite
-
- Release Pending
-