Insecure Fetch/Push with publish

[kameshsampath]

As a developer using apko in test/build environment, I would like to build and push using apko publish to insecure registries e.g. local docker registry.

[kaniini]

It is already possible with apko publish --local.

[kameshsampath]

@kaniini - --local is fine if we want to load into docker demon. But in this case let say I start a registry docker run -p 5000:50001 registry:2 and I want to push to localhost:5001/example/my-image using apko. This requires images to be pushed w/o TLS. Tools like crane, ko all have this option of using --insecure in addition to --local.

CC: @imjasonh

[kaniini]

Got it. Yes, we can add --insecure for that purpose.

[imjasonh]

crane and ko have an --insecure flag, and we hate it. It conflates two things, "allow HTTP", and "allow HTTPS without verifying TLS", and users who only want one are forced to allow both.

I'd recommend two flags, --insecure-allow-http and --insecure-tls-skip-verify, and if you personally only need one, only implement that one for now.

The problem is that conflation of the two flags might exist so deeply into go-containerregistry that it will be hard to separate, but I think we can do it, and I'm willing to help. If we crack it, we can roll out the same flags to crane and ko and everybody wins.

[kaniini]

Yeah lets see if we can split the flags. That would be ideal.