This repository has been archived by the owner on Sep 2, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 19
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[feature] implement kim-native credentials (#71)
Introduce `kim builder login` that works very much like `docker login`
but instead stores the resulting Docker `config.json` in a kubernetes
secret in the builder namespace. This secret is rendered to disk in a
temp directory for `build` operations (to satisfy buildkit) but is
leveraged as an in-memory keyring for shipping auth credentials for
`push` / `pull` operations. If the secret setup by the `login` cli
operation does not exist, kim reverts to the existing behavior of
consulting the `${DOCKER_CONFIG}/config.json` for registry credentials.
Addresses #64
Signed-off-by: Jacob Blain Christen <jacob@rancher.com>- Loading branch information
Showing
8 changed files
with
217 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| package login | ||
|
|
||
| import ( | ||
| "bufio" | ||
| "fmt" | ||
| "io/ioutil" | ||
| "net/url" | ||
| "os" | ||
| "strings" | ||
|
|
||
| "github.com/moby/term" | ||
| "github.com/pkg/errors" | ||
| "github.com/rancher/kim/pkg/client" | ||
| "github.com/rancher/kim/pkg/client/builder" | ||
| wrangler "github.com/rancher/wrangler-cli" | ||
| "github.com/spf13/cobra" | ||
| "k8s.io/kubernetes/pkg/credentialprovider" | ||
| ) | ||
|
|
||
| func Command() *cobra.Command { | ||
| return wrangler.Command(&CommandSpec{}, cobra.Command{ | ||
| Use: "login [OPTIONS] [SERVER]", | ||
| Short: "Establish credentials for a registry.", | ||
| DisableFlagsInUseLine: true, | ||
| Args: cobra.ExactArgs(1), | ||
| }) | ||
| } | ||
|
|
||
| type CommandSpec struct { | ||
| builder.Login | ||
| } | ||
|
|
||
| func (s *CommandSpec) Run(cmd *cobra.Command, args []string) error { | ||
| k8s, err := client.DefaultConfig.Interface() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if s.PasswordStdin { | ||
| if s.Password != "" { | ||
| return errors.New("--password and --password-stdin are mutually exclusive") | ||
| } | ||
| if s.Username == "" { | ||
| return errors.New("must provide --username with --password-stdin") | ||
| } | ||
| password, err := ioutil.ReadAll(cmd.InOrStdin()) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| s.Password = strings.TrimSuffix(string(password), "\n") | ||
| s.Password = strings.TrimSuffix(s.Password, "\r") | ||
| } | ||
| if (s.Username == "" || s.Password == "") && !term.IsTerminal(os.Stdout.Fd()) { | ||
| return errors.New("cannot perform interactive login from non tty device") | ||
| } | ||
| if s.Username == "" { | ||
| fmt.Fprintf(os.Stdout, "Username: ") | ||
| reader := bufio.NewReader(os.Stdin) | ||
| line, _, err := reader.ReadLine() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| s.Username = strings.TrimSpace(string(line)) | ||
| } | ||
| if s.Password == "" { | ||
| state, err := term.SaveState(os.Stdin.Fd()) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| fmt.Fprintf(os.Stdout, "Password: ") | ||
| term.DisableEcho(os.Stdin.Fd(), state) | ||
| reader := bufio.NewReader(os.Stdin) | ||
| line, _, err := reader.ReadLine() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| fmt.Fprintln(os.Stdout) | ||
| term.RestoreTerminal(os.Stdin.Fd(), state) | ||
| s.Password = strings.TrimSpace(string(line)) | ||
| if s.Password == "" { | ||
| return errors.New("password is required") | ||
| } | ||
| } | ||
| server, err := credentialprovider.ParseSchemelessURL(args[0]) | ||
| if err != nil { | ||
| if server, err = url.Parse(args[0]); err != nil { | ||
| return err | ||
| } | ||
| } | ||
| // special case for [*.]docker.io -> https://index.docker.io/v1/ | ||
| if strings.HasSuffix(server.Host, "docker.io") { | ||
| server.Scheme = "https" | ||
| server.Host = "index.docker.io" | ||
| if server.Path == "" { | ||
| server.Path = "/v1/" | ||
| } | ||
| return s.Login.Do(cmd.Context(), k8s, server.String()) | ||
| } | ||
| return s.Login.Do(cmd.Context(), k8s, server.Host) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| package builder | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
|
|
||
| "github.com/rancher/kim/pkg/client" | ||
| corev1 "k8s.io/api/core/v1" | ||
| apierr "k8s.io/apimachinery/pkg/api/errors" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/labels" | ||
| "k8s.io/client-go/util/retry" | ||
| "k8s.io/kubernetes/pkg/credentialprovider" | ||
| ) | ||
|
|
||
| type Login struct { | ||
| Password string `usage:"Password" short:"p"` | ||
| PasswordStdin bool `usage:"Take the password from stdin"` | ||
| Username string `usage:"Username" short:"u"` | ||
| } | ||
|
|
||
| func (s *Login) Do(_ context.Context, k *client.Interface, server string) error { | ||
| return retry.RetryOnConflict(retry.DefaultRetry, func() error { | ||
| login, err := k.Core.Secret().Get(k.Namespace, "kim-docker-config", metav1.GetOptions{}) | ||
| if apierr.IsNotFound(err) { | ||
| dockerConfigJSON := credentialprovider.DockerConfigJSON{ | ||
| Auths: map[string]credentialprovider.DockerConfigEntry{ | ||
| server: { | ||
| Username: s.Username, | ||
| Password: s.Password, | ||
| }, | ||
| }, | ||
| } | ||
| dockerConfigJSONBytes, err := json.Marshal(&dockerConfigJSON) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| login = &corev1.Secret{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: "kim-docker-config", | ||
| Namespace: k.Namespace, | ||
| Labels: labels.Set{ | ||
| "app.kubernetes.io/managed-by": "kim", | ||
| }, | ||
| }, | ||
| Type: corev1.SecretTypeDockerConfigJson, | ||
| Data: map[string][]byte{ | ||
| corev1.DockerConfigJsonKey: dockerConfigJSONBytes, | ||
| }, | ||
| } | ||
| _, err = k.Core.Secret().Create(login) | ||
| return err | ||
| } | ||
| var dockerConfigJSON credentialprovider.DockerConfigJSON | ||
| if dockerConfigJSONBytes, ok := login.Data[corev1.DockerConfigJsonKey]; ok { | ||
| if err := json.Unmarshal(dockerConfigJSONBytes, &dockerConfigJSON); err != nil { | ||
| return err | ||
| } | ||
| } | ||
| dockerConfigJSON.Auths[server] = credentialprovider.DockerConfigEntry{ | ||
| Username: s.Username, | ||
| Password: s.Password, | ||
| } | ||
| dockerConfigJSONBytes, err := json.Marshal(&dockerConfigJSON) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| login.Type = corev1.SecretTypeDockerConfigJson | ||
| login.Data[corev1.DockerConfigJsonKey] = dockerConfigJSONBytes | ||
| _, err = k.Core.Secret().Update(login) | ||
| return err | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters