puppetlabs / puppetlabs/puppetlabs-docker

Switch to --password-stdin for authentication in docker::registry

Open
#979 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Ruby
Stars
94
Forks
337
Avg merge
11d 15h
Merged PRs (30d)
2

Description

Use Case

I want to be able to authenticate to a private registry in a secure and recommended way, i.e. using --password-stdin and using secrets stored in a vault, not in plaintext in my puppet code/hiera.

Describe the Solution You Would Like

In this module, docker login is not done the recommended way, wich is
cat ~/my_password.txt | docker login --username foo --password-stdin
https://docs.docker.com/reference/cli/docker/login/

Switching to this form of authentication would not only be the recommended way to use docker login, but it would allow to use secrets stored in the vault easily.

Also switching to the recommended way would eliminate the warnings docker registries throw at you when not using "--password-stdin".

Describe Alternatives You've Considered

I tried passing the password parameter with a deferred function - the module does not work this way.

Additional Context

Add any other context or screenshots about the feature request here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the docker::registry authentication entry point and inspect how the current docker login command receives credentials. Check the module's existing tests, if present, before changing behavior. Done means private registry login uses Docker's --password-stdin flow and supports secrets supplied from a vault or deferred value without plaintext credentials in Puppet code or hiera.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, ruby
Domain
devops, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.