fix(registry): preserve blocked and insecure registries when converting v1 registries.conf

Previously the legacy v1 fallback wrote an empty v2 registries.conf, which discarded host blocked-registry and insecure-registry policy. Now we parse the host v1 file, convert it to v2, and validate the result, falling back to an empty file only if the v1 file has no settings or conversion fails.

Author: ElasticClaw

pkg/docker/registry/registriesconf.go

@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"sync"
 
+	"github.com/BurntSushi/toml"
 	"github.com/pkg/errors"
 	"go.podman.io/image/v5/pkg/sysregistriesv2"
 	"go.podman.io/image/v5/types"
@@ -52,6 +53,14 @@ func findDefaultRegistriesConfPath() (string, error) {
 		if isValidV2RegistriesConf(hostPath) {
 			return hostPath, nil
 		}
+		// Host has a v1 or otherwise invalid config. Try to preserve its
+		// blocked/insecure/search registry settings by converting to v2.
+		convertedPath, err := convertHostRegistriesConfToV2(hostPath)
+		if err == nil {
+			return convertedPath, nil
+		}
+		// If conversion fails, fall back to an empty v2 file rather than
+		// letting the operation fail entirely.
 	}
 
 	return writeDefaultRegistriesConf()
@@ -63,6 +72,52 @@ func isValidV2RegistriesConf(path string) bool {
 	return err == nil
 }
 
+func convertHostRegistriesConfToV2(hostPath string) (string, error) {
+	data, err := os.ReadFile(hostPath)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to read host registries.conf")
+	}
+
+	var v1 sysregistriesv2.V1RegistriesConf
+	if err := toml.Unmarshal(data, &v1); err != nil {
+		return "", errors.Wrap(err, "failed to parse v1 registries.conf")
+	}
+	if !v1.Nonempty() {
+		// Nothing to preserve; use the empty fallback.
+		return "", errors.New("v1 registries.conf is empty")
+	}
+
+	v2, err := v1.ConvertToV2()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to convert v1 registries.conf to v2")
+	}
+
+	dir, err := os.MkdirTemp("", "kots-registries-conf")
+	if err != nil {
+		return "", errors.Wrap(err, "failed to create registries.conf temp dir")
+	}
+	path := filepath.Join(dir, "registries.conf")
+
+	f, err := os.Create(path)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to create converted registries.conf")
+	}
+	defer f.Close()
+
+	enc := toml.NewEncoder(f)
+	if err := enc.Encode(v2); err != nil {
+		return "", errors.Wrap(err, "failed to encode converted registries.conf")
+	}
+
+	// Validate that the generated v2 file can be loaded by the library.
+	ctx := &types.SystemContext{SystemRegistriesConfPath: path}
+	if _, err := sysregistriesv2.TryUpdatingCache(ctx); err != nil {
+		return "", errors.Wrap(err, "generated v2 registries.conf is invalid")
+	}
+
+	return path, nil
+}
+
 func writeDefaultRegistriesConf() (string, error) {
 	dir, err := os.MkdirTemp("", "kots-registries-conf")
 	if err != nil {

pkg/docker/registry/registriesconf_test.go

@@ -3,10 +3,12 @@ package registry
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.podman.io/image/v5/pkg/sysregistriesv2"
 	"go.podman.io/image/v5/types"
 )
 
@@ -44,6 +46,74 @@ registries = ['registry.access.redhat.com']
 	require.NoError(t, SetSystemRegistriesConfPath(sys))
 	assert.NotEqual(t, hostPath, sys.SystemRegistriesConfPath)
 	assert.NotEmpty(t, sys.SystemRegistriesConfPath)
+
+	// Verify the generated v2 file preserves the search registry.
+	ctx := &types.SystemContext{SystemRegistriesConfPath: sys.SystemRegistriesConfPath}
+	v2, err := sysregistriesv2.TryUpdatingCache(ctx)
+	require.NoError(t, err)
+	assert.Contains(t, v2.UnqualifiedSearchRegistries, "registry.access.redhat.com")
+}
+
+func TestSetSystemRegistriesConfPath_PreservesV1BlockedAndInsecureRegistries(t *testing.T) {
+	resetRegistriesConfPathOnce()
+
+	dir := t.TempDir()
+	hostPath := filepath.Join(dir, "registries.conf")
+	content := `[registries.search]
+registries = ['registry.access.redhat.com']
+
+[registries.block]
+registries = ['docker.io', 'registry.hub.docker.com']
+
+[registries.insecure]
+registries = ['insecure-registry.example.com']
+`
+	require.NoError(t, os.WriteFile(hostPath, []byte(content), 0644))
+
+	t.Setenv("CONTAINERS_REGISTRIES_CONF", hostPath)
+
+	sys := &types.SystemContext{}
+	require.NoError(t, SetSystemRegistriesConfPath(sys))
+	assert.NotEqual(t, hostPath, sys.SystemRegistriesConfPath)
+	assert.NotEmpty(t, sys.SystemRegistriesConfPath)
+
+	ctx := &types.SystemContext{SystemRegistriesConfPath: sys.SystemRegistriesConfPath}
+
+	reg, err := sysregistriesv2.FindRegistry(ctx, "docker.io/library/busybox")
+	require.NoError(t, err)
+	require.NotNil(t, reg)
+	assert.True(t, reg.Blocked, "expected docker.io to be blocked")
+
+	reg, err = sysregistriesv2.FindRegistry(ctx, "insecure-registry.example.com/app:latest")
+	require.NoError(t, err)
+	require.NotNil(t, reg)
+	assert.True(t, reg.Insecure, "expected insecure-registry.example.com to be insecure")
+
+	v2, err := sysregistriesv2.TryUpdatingCache(ctx)
+	require.NoError(t, err)
+	assert.Contains(t, v2.UnqualifiedSearchRegistries, "registry.access.redhat.com")
+}
+
+func TestSetSystemRegistriesConfPath_FallsBackToEmptyV2WhenV1ConfigIsEmpty(t *testing.T) {
+	resetRegistriesConfPathOnce()
+
+	dir := t.TempDir()
+	hostPath := filepath.Join(dir, "registries.conf")
+	content := `[registries.search]
+registries = []
+`
+	require.NoError(t, os.WriteFile(hostPath, []byte(content), 0644))
+
+	t.Setenv("CONTAINERS_REGISTRIES_CONF", hostPath)
+
+	sys := &types.SystemContext{}
+	require.NoError(t, SetSystemRegistriesConfPath(sys))
+	assert.NotEqual(t, hostPath, sys.SystemRegistriesConfPath)
+	assert.NotEmpty(t, sys.SystemRegistriesConfPath)
+
+	data, err := os.ReadFile(sys.SystemRegistriesConfPath)
+	require.NoError(t, err)
+	assert.Empty(t, strings.TrimSpace(string(data)))
 }
 
 func TestSetSystemRegistriesConfPath_FallsBackWhenHostConfigMissing(t *testing.T) {