-
Notifications
You must be signed in to change notification settings - Fork 3.8k
Description
Description
Error messages returned from registries should hide sensitive information.
Registries sometimes return a body with an error which contains useful information, but also sensitive data. For example in a setup with a private docker registry with S3 Storage the error on timeout contains full signed URL that can be used to download data that might be restricted. This only can be done during the signed URL timeout (1200s).
Steps to reproduce the issue:
- Setup a private docker registry with S3 Storage
- Setup a Kubernetes cluster with containerd
- Set imagePullSecrets of pods with secret credentials for the private registry
- In the event of a timeout the error contains full signed URL
Describe the results you received:
Kubernetes event on pod contains the following error
Warning Failed 3m36s kubelet Failed to pull image "my-private-registry.io/default/nginx:latest": rpc error: code = Unknown desc = failed to pull and unpack image "my-private-registry.io/default/nginx:latest": failed to copy: httpReaderSeeker: failed open: failed to do request: Get https://s3-endpoint/docker-hub/docker/registry/v2/blobs/sha256/79/7...dsdasdas/data?X-Amz-Algorithm=PLAIN_TEXT&X-Amz-Credential=PLAIN_TEXT&X-Amz-Date=PLAIN_TEXT&X-Amz-Expires=1200&X-Amz-SignedHeaders=host&X-Amz-Signature=PLAIN_TEXT: net/http: TLS handshake timeout
Describe the results you expected:
The error to hide sensitive information
Warning Failed 3m36s kubelet Failed to pull image "my-private-registry.io/default/nginx:latest": rpc error: code = Unknown desc = failed to pull and unpack image "my-private-registry.io/default/nginx:latest": failed to copy: httpReaderSeeker: failed open: failed to do request: Get https://s3-endpoint/docker-hub/docker/registry/v2/blobs/sha256/79/7...dsdasdas/data?X-Amz-Algorithm=REDACTED&X-Amz-Credential=REDACTED&X-Amz-Date=REDACTED&X-Amz-Expires=1200&X-Amz-SignedHeaders=host&X-Amz-Signature=REDACTED: net/http: TLS handshake timeout
What version of containerd are you using:
Container Runtime Version: containerd://1.4.3