Configure jib.allowInsecureRegistries as required

[briandealwis]

Exposes docker.isInsecure → docker.IsInsecure and adds some tests (wasn't actually testing the value from insecureRegistries).

Fixes #2664

[chanseokoh]

Even with -Djib.allowInsecureRegistries=true, Jib will not send credentials if HTTP (insecure HTTPS will work), unless setting -DsendCredentialsOverHttp=true. Should we set it too?

[briandealwis]

I've been thinking this over and I don't think we should unless we change allowInsecureRegistries to specify a set of registries rather than a blanket true/false. I might be ok for my password to be sent in the clear to my.corp.registry.local, but not to registry-1.docker.io.

[chanseokoh]

I think it's OK to not set -DsendCredentialsOverHttp=true. No need at least for now.

BTW, registry-1.docker.io is a secure registry, so I guess allowInsecureRegistries has no effect on it?

[briandealwis]

I only meant registry-1.docker.io as an hypothetical example — like a corporate firewall that prevented HTTPS connections to *.docker.io but inadvertently allowed HTTP connections. If we included sendCredentialsOverHttp then Jib would cascade and send the password in the clear.

[chanseokoh]

That's a fair point. So, I guess this PR is good and final as it stands now?

[briandealwis]

I think it's good to go.

[nkubala]

LGTM, but looks like some of the unit tests need to be updated?

[briandealwis]

Oh jeepers, I can't believe I inverted the test condition 😊