-
Notifications
You must be signed in to change notification settings - Fork 461
Description
Is your feature request related to a problem? Please describe.
In #5901, we've implemented custom CA cert support for extensions from OCI registries.
v1beta1.Repository also allows setting cert and key files that are currently used for classic helm repos, but are unsupported by OCI registries.
The idea of supporting mTLS for OCI registries came up during the review of #5901 that implemented custom TLS transport support for OCI registry clients, but only considered CA cert, while client auth certs remained ignored.
Describe the solution you would like
We could reuse certFile and keyFile fields of v1beta1.Repository to implement mTLS support for OCI registries.
Describe alternatives you've considered
n/a
Additional context
Initial discussion about supporting mTLS for OCI registries started while discussing #5877 (comment)
Later, #5901 implemented CA cert support for OCI registries leaving mTLS behind due to limited time constraints and to avoid scope creep.
We do not have a request for this feature from anyone yet, but after #5901, it should be relatively easy to implement if/when needed.