Add smart-proxy mTLS auth for container registry

[sbernhard]

Allow smart-proxies to pull/push container images against Katello's registry using their existing Foreman SSL client certificate. A new container_registry_auth_enabled flag on SmartProxy opts proxies in explicitly.

Katello PR: #11776
Smart Proxy PR: theforeman/smart-proxy#948
Smart Proxy Ansible Director: ATIX-AG/smart_proxy_ansible_director#24

Note: I have created this PRs to discuss how to use the katello container registry with smart-proxies.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 08052928-ae80-48cd-891b-df57f9b65bff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sbernhard]

what do you think about this @ianballou - its a PR to start the discussion.
Could be the necessary addition to be able to push to "internal" repos (but also to comon repos) from foreman-proxies of the discussion in https://community.theforeman.org/t/rfc-katello-repositories-for-internal-use/46785/3

[ianballou]

I've personally never come up with a reason to push content from a smart proxy into Katello, only the other way around. At the moment I can't think of a reason why it would hurt, but I'm curious what foreman_ansible_director's use case is for pushing containers from the smart proxy to Katello.

Are the containers being built on the smart proxy and then pushed to Katello to redistribute them elsewhere?

[sbernhard]

I've personally never come up with a reason to push content from a smart proxy into Katello, only the other way around. At the moment I can't think of a reason why it would hurt, but I'm curious what foreman_ansible_director's use case is for pushing containers from the smart proxy to Katello.

Are the containers being built on the smart proxy and then pushed to Katello to redistribute them elsewhere?

Yes, this is exactly the use case. :-)