Merge pull request #85 from srl-labs/fix/never-pull-via-cri-directly

fix: always ask manager to create puller pod if image is not present, fixes issues w/ insecure registries

launcher/image.go

@@ -78,22 +78,11 @@ func (c *clabernetes) image() {
 		return
 	}
 
-	if len(configuredPullSecrets) == 0 {
-		c.logger.Info("no pull secrets configured, pulling image ourselves with no credentials...")
-
-		err = imageManager.Pull(c.imageName)
-		if err != nil {
-			handleImagePullThroughModeAlwaysPanic(c.imagePullThroughMode)
-
-			return
-		}
-	} else {
-		err = c.requestImagePull(imageManager, configuredPullSecrets)
-		if err != nil {
-			handleImagePullThroughModeAlwaysPanic(c.imagePullThroughMode)
+	err = c.requestImagePull(imageManager, configuredPullSecrets)
+	if err != nil {
+		handleImagePullThroughModeAlwaysPanic(c.imagePullThroughMode)
 
-			return
-		}
+		return
 	}
 
 	c.copyImageFromCRI(imageManager)

launcher/image/containerd.go

@@ -37,30 +37,6 @@ func (m *containerdManager) Present(imageName string) (bool, error) {
 	return true, nil
 }
 
-func (m *containerdManager) Pull(imageName string) error {
-	pullCmd := exec.Command(
-		"nerdctl",
-		"--address",
-		"/clabernetes/.node/containerd.sock",
-		"--namespace",
-		"k8s.io",
-		"image",
-		"pull",
-		imageName,
-		"--quiet",
-	)
-
-	pullCmd.Stdout = m.logger
-	pullCmd.Stderr = m.logger
-
-	err := pullCmd.Run()
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
 func (m *containerdManager) Export(imageName, destination string) error {
 	exportCmd := exec.Command(
 		"nerdctl",

launcher/image/manager.go

@@ -29,9 +29,6 @@ func NewImageManager(logger claberneteslogging.Instance, criKind string) (Manage
 type Manager interface {
 	// Present checks if the image is already present in the node.
 	Present(imageName string) (bool, error)
-	// Pull pulls the given image -- this is used if/when there are no pull secrets found, since we
-	// can very easily pull via the cri if we dont have to think about secrets.
-	Pull(imageName string) error
 	// Export is the main reason we are using this and not the cri interface directly (cri has no
 	// service for export!) -- and does what it says: exports an image to disk.
 	Export(imageName, destination string) error