Skip to content

Comments

WIP: Add --tls-details#6691

Draft
mtrmac wants to merge 22 commits intocontainers:mainfrom
mtrmac:tls-behavior
Draft

WIP: Add --tls-details#6691
mtrmac wants to merge 22 commits intocontainers:mainfrom
mtrmac:tls-behavior

Conversation

@mtrmac
Copy link
Contributor

@mtrmac mtrmac commented Feb 17, 2026

What type of PR is this?

/kind feature

What this PR does / why we need it:

Add --tls-details options to many CLI operations, exposing containers/container-libs#623 . Hopefully this will also be sufficient for integration into Podman, confirmation of that TBD.

How to verify it

TBD. This should have at least some smoke tests

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

I’m fairly unsatisfied with the CLI top level:

  • I have intentionally been very conservative, adding a --tls-details option wherever there is a SystemContext. Some of that is almost certainly unnecessary (buildah tag), but I wanted to avoid surprises like buildah manifest inspect. I’m not sure how else to make this maintainable over a longer term, ensuring that contributors of new features don’t forget to add the --tls-details option.
  • The way parse.SystemContextFromOptions silently ignores undeclared options, and requires the CLI layer to individually declare each new option, makes for a finely tuned CLI options sets but it’s fairly hard to track or ensure consistency. (I have no ambition of significantly restructuring that in this PR.)

Does this PR introduce a user-facing change?

Many subcommands now expose a `--tls-details` option, allowing to tune TLS settings using a `containers-tls-details.yaml(5)` file.

@packit-as-a-service
Copy link

Ephemeral COPR build failed. @containers/packit-build please check.

4 similar comments
@packit-as-a-service
Copy link

Ephemeral COPR build failed. @containers/packit-build please check.

@packit-as-a-service
Copy link

Ephemeral COPR build failed. @containers/packit-build please check.

@packit-as-a-service
Copy link

Ephemeral COPR build failed. @containers/packit-build please check.

@packit-as-a-service
Copy link

Ephemeral COPR build failed. @containers/packit-build please check.

@mtrmac mtrmac force-pushed the tls-behavior branch 4 times, most recently from 929d193 to fa4f264 Compare February 18, 2026 19:41
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
It's surprising to have it in a package that otherwise
contains almost exclusively type definitions, and we are
breaking the API either way.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
I can't see much of a benefit to abstracting this; if anything,
using named struct fields instead of unnamed parameters increases
clarity and decreases the risk of a mismatch.

Intentionally a minimal refactor, leaving the sourceCtx/destinationCtx
variables. That will be cleaned up momentarily.

Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
It _probably_ does not matter, src should read from c/storage,
but there's a few layers of abstraction and there is BlobCache,
so fill it to be safe.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
... when trying to add an unknown-arch list item

Maybe this should just strip specifically the architecture options, instead.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Probably makes no difference, but it's easier to do it than
worry.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
This does not do anything without declaring the option first.
That will come momentarily.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant