Oci support expanded - #1
Open
Cyper-Madsen wants to merge 8 commits into
Open
Conversation
Complete rewrite of the OCI pull/push implementation: Pull: - Unified on go-containerregistry (removed oras-go, distribution/reference) - Multi-manifest index support (searches for kustomize artifact type) - Silently skips Docker-format manifests - Proper OCI artifact media types (application/vnd.cncf.kustomize.layer.v1.tar+gzip) - Custom HTTP client support for TLS Push: - Uses go-containerregistry tarball + crane for pushing - Kustomization validation (optional — directory can be published without one) - Proper OCI manifest + config media types - Multi-target push support CLI: - Working `kustomize publish` command with --path flag - Rejects implicit/explicit `latest` tag - Validates kustomization if present Testing: - Replaced testcontainers with in-process httptest registry (no Docker needed) - Replaced mdelapenya/tlscert with stdlib crypto/x509 - Removed dockercfg dependency - E2E krusty tests for oci:// in resources - Upgraded go-containerregistry v0.21.5 → v0.21.9 Dependencies removed: oras-go, distribution/reference, testcontainers, mdelapenya/tlscert, cpuguy83/dockercfg
Author
|
@Clockwork-Muse I am not the big opensource committer, so if it is wrong place to point the pull request let me know :) but as I continued work on your branch I thought this would be best |
Cyper-Madsen
force-pushed
the
oci_support
branch
from
August 26, 2026 10:35
1f40322 to
afcbbfa
Compare
Extends kustomize localize to handle oci:// references: - hasRef() recognizes OCI URLs and validates explicit tags/digests - Rejects implicit 'latest' to ensure reproducible builds - locOciRootPath generates deterministic local paths from OCI refs - locloader validates OCI references before localizing OCI references in kustomization resources are now localized recursively, downloading the artifact and rewriting the reference to a local path.
Adds KUSTOMIZE_OCI_USERNAME and KUSTOMIZE_OCI_PASSWORD environment variables for registry authentication in CI/CD environments where Docker is not installed. Implements a custom authn.Keychain that checks env vars first and falls back to authn.DefaultKeychain (Docker config). Used by both puller and pusher. Usage: export KUSTOMIZE_OCI_USERNAME=myuser export KUSTOMIZE_OCI_PASSWORD=mytoken kustomize build oci://registry/repo:tag
Adds opt-in cosign signature verification by shelling out to the cosign CLI binary. This avoids ~300 transitive dependencies from sigstore/cosign/v2 which would be unacceptable for the api module vendored into kubectl. Triggered by setting KUSTOMIZE_OCI_COSIGN_KEY env var: KUSTOMIZE_OCI_COSIGN_KEY=cosign.pub kustomize build oci://registry/repo:tag Behavior: - No key configured → verification skipped (default) - Key set, cosign on PATH → runs cosign verify --key <key> <ref> - Key set, cosign not installed → clear error message KUSTOMIZE_OCI_COSIGN_INSECURE=1 allows HTTP registries and skips transparency log verification (for testing). Includes integration tests with real key generation, signing, and verification against in-process registry (skipped if cosign not installed).
Resolves TODO(monopole) comments. Previously, cycle detection compared raw URL strings with HasPrefix, which couldn't distinguish between different branches/tags of the same repo. Now uses structured field comparison: - Git: same Host + RepoPath + Ref + overlapping KustRootPath = cycle - OCI: same repository + tag/digest + overlapping path = cycle This means: - oci://registry/repo:v1.0.0 and oci://registry/repo:v2.0.0 → NOT a cycle - Same repo+ref but one path is parent of another → still a cycle Adds path-boundary awareness to avoid false matches (e.g. foo/bar vs foo/barbaz).
Adds examples/ociRegistry.md covering: - URL format (oci:// scheme, tags, digests, subpaths) - Building from OCI registries - Publishing with kustomize publish - Localizing OCI references - Authentication (Docker config + env vars) - SemVer tag resolution - Publish annotations (--source, --revision) - File exclusions (.kustomizeignore, --exclude) Updates examples/README.md with link to the new guide.
Cyper-Madsen
force-pushed
the
oci_support
branch
from
August 26, 2026 10:36
afcbbfa to
d4afd41
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
│ Disclosure: This implementation was developed with AI assistance. All code has been manually tested, reviewed and verified in addition to the implemented unit and integration tests, but Go is not my main language.
Adds the ability to pull kustomization directories from OCI registries and push them for sharing, enabling versioned, signed distribution of kustomization
bundles through standard container registries.
Summary of Changes
Core OCI pull/push implementation (api/internal/oci/)
Pull kustomization artifacts from OCI registries using oci:// scheme URLs
Push/publish kustomization directories to OCI registries as OCI artifacts
Support for tag, digest (@sha256:...), and semver constraint resolution
Subdirectory references within artifacts via //path syntax
Docker credential keychain integration for registry auth
Publish command (kustomize/commands/publish/)
New kustomize publish CLI command to package and push kustomizations
Kustomization validation before push (field checks, path locality)
OCI annotation support (--source, --revision) for provenance
.kustomizeignore and --exclude flag for file exclusions
Rejects implicit latest tag to enforce explicit versioning
Authentication
Cosign signature verification
Localize support
Testing
Documentation