[kots]: add firewall check for the pull registry

[mrsimonemms]

Description

Adds a simple check to ensure that a network connection can be made to the pull registry. The command curl https://eu.gcr.io/v2/ does actually (correctly) return an unauthorized error as the check is that it can make an HTTP connection in the timeout. However, it still exits with a code 0.

If it fails to connect within the timeout, it will exit with a non-zero error code.

In airgapped, it runs against the pull repository.

Related Issue(s)

Fixes #10244

How to test

Install in a non-airgapped and airgapped environment

Release Notes

[kots]: add firewall check for the pull registry

Documentation

Werft options:

• /werft with-preview

[corneliusludmann]

Implementation looks good. 👍 Looking forward to having this released! 🚀

---

The only concern of my always paranoid mind is whether the v2/ endpoint is actually reachable for all supported registries? Is this a common endpoint that is used in the image pull protocol? Or could it be that some registries do not answer properly on this path but only on the actual full image path?

The second rather minor question is whether we need to check the status code as well? Or set the -L flag to follow redirects? What is, when the registry is behind a proxy? Could it happen that the proxy answers with an okayish status code (that lets curl run successfully) but the actual registry is still not reachable? Maybe in case of a redirect?

Don't know. Maybe I'm overthinking this.

/hold in case you want to test something after my comment. Otherwise, feel free to remove the hold label.

[mrsimonemms]

My understanding based upon the API spec is that it's always on /v2. But, as we know from the AWS implementation, there's no guarantee that it's been implemented correctly just because it's in the spec.

For the second point, I don't think we need to follow the -L or check the status. In fact, if you run curl https://eu.gcr.io/v2/, you'll see that it actually returns a 401 error - the test is checking that something is terminating that call and not timing out.

The other way we could do this is to simply not test airgapped installations. The test is that they can access the pull registry - in an airgapped installation, they'd have had to connect to their pull registry to get the KOTS images anyway so maybe this test doesn't actually add anything to the party.

[mrsimonemms]

@corneliusludmann I've amended the PR so that it doesn't test in an airgapped environment. I'll leave for you to remove the "hold" if/when you're ready