Kube Play - cannot build FROM private registries with self signed certs need to Support SystemContext flags

[ygalblum]

While working on the test for #20889, I found that I was unable to use images on a private registry on the FROM line of the Containerfile.

The reason was that the private registry created for the test (https://github.com/containers/podman/blob/main/test/system/helpers.registry.bash#L19) uses a self signed certificate and kube play did not pass the --tls-verify=false to the build step (currently here: https://github.com/containers/podman/blob/main/pkg/domain/infra/abi/play.go#L1026, but may move a little).

From what I was able to find, the solution is to set the SystemContext field of the buildahDefine.BuildOptions (https://github.com/containers/podman/blob/main/vendor/github.com/containers/buildah/define/build.go#L211).

podman build does it here (https://github.com/containers/podman/blob/main/cmd/podman/common/build.go#L411) by calling buildah code at the cmd level.

Now the discussion

First, we need to decide whether podman kube play --build=true should support this request? If not, then we should probably document in the kube play page about build that it is not supported.

If yes, then we should first decide where should the values for the build come from. Should the come from the CLI argument or from the YAML file itself. The CLI already supports these arguments but they are used only for pulling the actual image, not for pulling an image to build upon.

@vrothberg @rhatdan WDYT?

[vrothberg]

I was never a fan of allowing kube play to build images. It breaks the separation of concerns and it either provides a limited set of functionality that works for some examples or it requires adding the entire CLI of podman build to the kube play. The build functionality is also not supported for remote clients, making it a poor experience on the Mac and Windows.

In this specific example of --tls-verify=false I would vote for configuring /etc/containers/registries.conf and set insecure=true for the specific registry. If you all agree, we could add that information to the man pages.

[Luap99]

In general I agree with that statement however since there is already a --tls-verify option then I would say we should just use it. Seem weird to only use it for pull but not when the build pulls.

[vrothberg]

Great call, @Luap99. Makes total sense.

[ygalblum]

Please note that that it does not end with this flag. The same goes for --authfile.

[vrothberg]

I think we can pass down the existing flags to build. For the rest, I have no good answer.

[ygalblum]

#20966 added support for passing all flags existing in kube play to the build process. The implement ion used existing tools, so when additional flags are added to kube play they will be passed as well.