-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Pull through cache does not allow anonymous image pulls #1623
Comments
I can reproduce the behaviour locally. Anonymous tokens do not contain any allowed actions.
|
The issue is that in the current context, anonymous users are not allowed to create new distributions or access distributions within a specific namespace by default. When you pull an image through a pull-through cache distribution, you are creating a normal distribution in the background. If you pull the image with an admin user first and then with the anonymous users, it works. I guess we need to revisit how we assign/give permissions during the pull-through caching. |
Okay, after thorough investigation I think I found the root cause of the problem. We are checking the |
The open question is if we want to enable anonymous users, logged-in users, or users with valid permissions to pull content via the pull-through distribution. The related issue is one of the examples where if we define a correct permission set for a custom role, a user with that role is allowed to pull content via the pull-through distribution successfully: #1624 (comment). Are there any security implications of allowing everyone to bloat the caching distribution? We can end up having un-trusted anonymous users pulling everything from third-party registries. |
The only user Pulp creates is |
https://hackmd.io/a1VPKZKySJCHEHMCZ-qdPA Doc with options |
Decision: We will not store AnonymousUser in the database. If the pull-through cache distribution is configured as With RBAC disabled, all (pull-through) distributions are public. Thus, in this case, we would enable anonymous users to pull content through it freely. It will be up to admins to manage the storage size. |
Version
pulp-core: 3.53.0
pulp-container: 2.20.0
Describe the bug
I have a pull-through cache setup and I want to be able to pull images anonymously. It does work if i login with the admin user.
Using the admin user
Expected behavior
The pull should work without needing to login
Additional context
Previous Discussion: https://matrix.to/#/!HWvLQmBGVPfJfTQBAu:matrix.org/$xdzKq3fygVI6w0ginypdtaodaRJhi7Yx6aMTgSowSP0?via=matrix.org&via=ctrl-c.liu.se&via=x9c4.spdns.org
The text was updated successfully, but these errors were encountered: