Properly handle container registry redirects to fix metadata stored on a S3 backend

The previous behavior would include the Authorization header, which would
make fetching an S3 blob fail quietly.

Closes #22403

Update sh-fix-container-registry-s3-redirects.yml

1 files changed, 10 insertions, 4 deletions

diff --git a/lib/container_registry/client.rb b/lib/container_registry/client.rb
index 7f5f6d9ddb6..c7263f302ab 100644
--- a/lib/container_registry/client.rb
+++ b/lib/container_registry/client.rb
@@ -75,10 +75,7 @@ module ContainerRegistry
     def redirect_response(location)
       return unless location
 
-      # We explicitly remove authorization token
-      faraday_blob.get(location) do |req|
-        req['Authorization'] = ''
-      end
+      faraday_redirect.get(location)
     end
 
     def faraday
@@ -93,5 +90,14 @@ module ContainerRegistry
         initialize_connection(conn, @options)
       end
     end
+
+    # Create a new request to make sure the Authorization header is not inserted
+    # via the Faraday middleware
+    def faraday_redirect
+      @faraday_redirect ||= Faraday.new(@base_uri) do |conn|
+        conn.request :json
+        conn.adapter :net_http
+      end
+    end
   end
 end