commit 0697e011449d5c69a20542145312c089f7748492
author Piotr Dobrowolski <informatic@hackerspace.pl> Thu Jul 02 18:32:24 2020 +0200
committer Piotr Dobrowolski <informatic@hackerspace.pl> Thu Jul 02 18:45:42 2020 +0200
tree 7a2e3b5d5b59a6c82ceb24829def1d8ff13d08b4
parent 7418a5a963ac286b1abf1d3e86348a078dcecaff

cluster/kube/lib/registry: allow auth'd users to pull all images

"Anyone can pull all images" rule did only match on anonymous users. Now
it should match all users, including authenticated ones.

Change-Id: I2205299093feca51f30526ba305eadbaa0a68ecb

cluster/kube/lib/registry.libsonnet

diff --git a/cluster/kube/lib/registry.libsonnet b/cluster/kube/lib/registry.libsonnet
index 2df6da6..d909403 100644
--- a/cluster/kube/lib/registry.libsonnet
+++ b/cluster/kube/lib/registry.libsonnet
@@ -171,7 +171,7 @@
                             comment: "Logged in users can query the catalog.",
                         },
                         {
-                            match: {account: ""},
+                            match: {account: "/.*/"},
                             actions: ["pull"],
                             comment: "Anyone can pull all images.",
                         },