This repository has been archived by the owner on Dec 7, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 228
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add loading credentials from docker cli config
This adds a package pkg/runtime/auth with helpers to read the docker cli config and load the credentials for the host name of a given image. This is based on nerdctl's dockerconfigresolver. When using containerd as the runtime, the credentials from docker cli config is loaded into a containerd remote resolver and passed to the containerd remote option used for pulling. When using docker as the runtime, the credentials from docker cli config is loaded into the docker image pull options in the required format.
- Loading branch information
Showing
33 changed files
with
2,702 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| package auth | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/containerd/containerd/remotes/docker" | ||
| dockercliconfig "github.com/docker/cli/cli/config" | ||
| "github.com/docker/cli/cli/config/credentials" | ||
| dockercliconfigtypes "github.com/docker/cli/cli/config/types" | ||
| log "github.com/sirupsen/logrus" | ||
| ) | ||
|
|
||
| // NOTE: The file is based on nerdctl's dockerconfigresolver. | ||
| // Refer: https://github.com/containerd/nerdctl/blob/v0.8.1/pkg/imgutil/dockerconfigresolver/dockerconfigresolver.go | ||
|
|
||
| // AuthCreds is for docker.WithAuthCreds used in containerd remote resolver. | ||
| type AuthCreds func(string) (string, string, error) | ||
|
|
||
| // NewAuthCreds returns an AuthCreds which loads the credentials from the | ||
| // docker client config. | ||
| func NewAuthCreds(refHostname string) (AuthCreds, error) { | ||
| // Load does not raise an error on ENOENT | ||
| dockerConfigFile, err := dockercliconfig.Load("") | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| // DefaultHost converts "docker.io" to "registry-1.docker.io", | ||
| // which is wanted by credFunc . | ||
| credFuncExpectedHostname, err := docker.DefaultHost(refHostname) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| var credFunc AuthCreds | ||
|
|
||
| authConfigHostnames := []string{refHostname} | ||
| if refHostname == "docker.io" || refHostname == "registry-1.docker.io" { | ||
| // "docker.io" appears as ""https://index.docker.io/v1/" in ~/.docker/config.json . | ||
| // GetAuthConfig takes the hostname part as the argument: "index.docker.io" | ||
| authConfigHostnames = append([]string{"index.docker.io"}, refHostname) | ||
| } | ||
|
|
||
| for _, authConfigHostname := range authConfigHostnames { | ||
| // GetAuthConfig does not raise an error on ENOENT | ||
| ac, err := dockerConfigFile.GetAuthConfig(authConfigHostname) | ||
| if err != nil { | ||
| log.Errorf("cannot get auth config for authConfigHostname=%q (refHostname=%q): %v", | ||
| authConfigHostname, refHostname, err) | ||
| } else { | ||
| // When refHostname is "docker.io": | ||
| // - credFuncExpectedHostname: "registry-1.docker.io" | ||
| // - credFuncArg: "registry-1.docker.io" | ||
| // - authConfigHostname: "index.docker.io" | ||
| // - ac.ServerAddress: "https://index.docker.io/v1/". | ||
| if !isAuthConfigEmpty(ac) { | ||
| if ac.ServerAddress == "" { | ||
| log.Warnf("failed to get ac.ServerAddress for authConfigHostname=%q (refHostname=%q)", | ||
| authConfigHostname, refHostname) | ||
| } else { | ||
| acsaHostname := credentials.ConvertToHostname(ac.ServerAddress) | ||
| if acsaHostname != authConfigHostname { | ||
| return nil, fmt.Errorf("expected the hostname part of ac.ServerAddress (%q) to be authConfigHostname=%q, got %q", | ||
| ac.ServerAddress, authConfigHostname, acsaHostname) | ||
| } | ||
| } | ||
|
|
||
| // if ac.RegistryToken != "" { | ||
| // // Even containerd/CRI does not support RegistryToken as of v1.4.3, | ||
| // // so, nobody is actually using RegistryToken? | ||
| // log.Warnf("ac.RegistryToken (for %q) is not supported yet (FIXME)", authConfigHostname) | ||
| // } | ||
|
|
||
| credFunc = func(credFuncArg string) (string, string, error) { | ||
| if credFuncArg != credFuncExpectedHostname { | ||
| return "", "", fmt.Errorf("expected credFuncExpectedHostname=%q (refHostname=%q), got credFuncArg=%q", | ||
| credFuncExpectedHostname, refHostname, credFuncArg) | ||
| } | ||
| if ac.IdentityToken != "" { | ||
| return "", ac.IdentityToken, nil | ||
| } | ||
| return ac.Username, ac.Password, nil | ||
| } | ||
| break | ||
| } | ||
| } | ||
| } | ||
| // credFunc can be nil here. | ||
| return credFunc, nil | ||
| } | ||
|
|
||
| func isAuthConfigEmpty(ac dockercliconfigtypes.AuthConfig) bool { | ||
| if ac.IdentityToken != "" || ac.Username != "" || ac.Password != "" || ac.RegistryToken != "" { | ||
| return false | ||
| } | ||
| return true | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.