Skip to content

Commit ecb881e

Browse files
AkihiroSudaAkihiroSuda
committed
add imgcrypt stream processors to the default config
Enable the following config by default: ```toml version = 2 [plugins."io.containerd.grpc.v1.cri".image_decryption] key_model = "node" [stream_processors] [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"] accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"] returns = "application/vnd.oci.image.layer.v1.tar+gzip" path = "ctd-decoder" args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"] env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"] [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"] accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"] returns = "application/vnd.oci.image.layer.v1.tar" path = "ctd-decoder" args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"] env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"] ``` Fix issue 5128 Signed-off-by: Akihiro Suda <[email protected]>
1 parent ac2726e commit ecb881e

5 files changed

Lines changed: 59 additions & 16 deletions

File tree

‎cmd/containerd/command/config.go‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,15 @@ import (
2020
gocontext "context"
2121
"io"
2222
"os"
23+
"path/filepath"
2324

2425
"github.com/BurntSushi/toml"
2526
"github.com/containerd/containerd/defaults"
27+
"github.com/containerd/containerd/images"
2628
"github.com/containerd/containerd/pkg/timeout"
2729
"github.com/containerd/containerd/services/server"
2830
srvconfig "github.com/containerd/containerd/services/server/config"
31+
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
2932
"github.com/urfave/cli"
3033
)
3134

@@ -125,7 +128,38 @@ func platformAgnosticDefaultConfig() *srvconfig.Config {
125128
MaxRecvMsgSize: defaults.DefaultMaxRecvMsgSize,
126129
MaxSendMsgSize: defaults.DefaultMaxSendMsgSize,
127130
},
128-
DisabledPlugins: []string{},
129-
RequiredPlugins: []string{},
131+
DisabledPlugins: []string{},
132+
RequiredPlugins: []string{},
133+
StreamProcessors: streamProcessors(),
134+
}
135+
}
136+
137+
func streamProcessors() map[string]srvconfig.StreamProcessor {
138+
const (
139+
ctdDecoder = "ctd-decoder"
140+
basename = "io.containerd.ocicrypt.decoder.v1"
141+
)
142+
decryptionKeysPath := filepath.Join(defaults.DefaultConfigDir, "ocicrypt", "keys")
143+
ctdDecoderArgs := []string{
144+
"--decryption-keys-path", decryptionKeysPath,
145+
}
146+
ctdDecoderEnv := []string{
147+
"OCICRYPT_KEYPROVIDER_CONFIG=" + filepath.Join(defaults.DefaultConfigDir, "ocicrypt", "ocicrypt_keyprovider.conf"),
148+
}
149+
return map[string]srvconfig.StreamProcessor{
150+
basename + ".tar.gzip": {
151+
Accepts: []string{images.MediaTypeImageLayerGzipEncrypted},
152+
Returns: ocispec.MediaTypeImageLayerGzip,
153+
Path: ctdDecoder,
154+
Args: ctdDecoderArgs,
155+
Env: ctdDecoderEnv,
156+
},
157+
basename + ".tar": {
158+
Accepts: []string{images.MediaTypeImageLayerEncrypted},
159+
Returns: ocispec.MediaTypeImageLayer,
160+
Path: ctdDecoder,
161+
Args: ctdDecoderArgs,
162+
Env: ctdDecoderEnv,
163+
},
130164
}
131165
}

‎docs/cri/decryption.md‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,32 +15,31 @@ In this model encryption is tied to worker nodes. The usecase here revolves arou
1515

1616
### Configuring image decryption for "node" key model
1717

18-
The default configuration does not handle decrypting encrypted container images.
18+
This is the default model since containerd v1.5.
1919

20-
An example for configuring the "node" key model for container image decryption:
21-
22-
Configure `cri` to enable decryption with "node" key model
20+
For containerd v1.4, you need to add the following configuration to `/etc/containerd/config.toml` and restart the `containerd` service manually.
2321
```toml
22+
version = 2
23+
2424
[plugins."io.containerd.grpc.v1.cri".image_decryption]
2525
key_model = "node"
26-
```
2726

28-
Configure `containerd` daemon [`stream_processors`](https://github.com/containerd/containerd/blob/master/docs/stream_processors.md) to handle the
29-
encrypted mediatypes.
30-
```toml
3127
[stream_processors]
3228
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
3329
accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
3430
returns = "application/vnd.oci.image.layer.v1.tar+gzip"
35-
path = "/usr/local/bin/ctd-decoder"
36-
args = ["--decryption-keys-path", "/keys"]
31+
path = "ctd-decoder"
32+
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
33+
env= ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
3734
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
3835
accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
3936
returns = "application/vnd.oci.image.layer.v1.tar"
40-
path = "/usr/local/bin/ctd-decoder"
41-
args = ["--decryption-keys-path", "/keys"]
37+
path = "ctd-decoder"
38+
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
39+
env= ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
4240
```
4341

44-
In this example, container image decryption is set to use the "node" key model. In addition, the decryption [`stream_processors`](https://github.com/containerd/containerd/blob/master/docs/stream_processors.md) are configured as specified in [containerd/imgcrypt project](https://github.com/containerd/imgcrypt), with the additional field `--decryption-keys-path` configured to specify where decryption keys are located locally in the node.
42+
In this example, container image decryption is set to use the "node" key model.
43+
In addition, the decryption [`stream_processors`](https://github.com/containerd/containerd/blob/master/docs/stream_processors.md) are configured as specified in [containerd/imgcrypt project](https://github.com/containerd/imgcrypt), with the additional field `--decryption-keys-path` configured to specify where decryption keys are located locally in the node.
4544

46-
After modify this config, you need restart the `containerd` service.
45+
The `$OCICRYPT_KEYPROVIDER_CONFIG` environment variable is used for [ocicrypt keyprovider protocol](https://github.com/containers/ocicrypt/blob/master/docs/keyprovider.md).

‎images/mediatypes.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ const (
4949
MediaTypeContainerd1CheckpointRuntimeOptions = "application/vnd.containerd.container.checkpoint.runtime.options+proto"
5050
// Legacy Docker schema1 manifest
5151
MediaTypeDockerSchema1Manifest = "application/vnd.docker.distribution.manifest.v1+prettyjws"
52+
// Encypted media types
53+
MediaTypeImageLayerEncrypted = ocispec.MediaTypeImageLayer + "+encrypted"
54+
MediaTypeImageLayerGzipEncrypted = ocispec.MediaTypeImageLayerGzip + "+encrypted"
5255
)
5356

5457
// DiffCompression returns the compression as defined by the layer diff media

‎pkg/cri/config/config_unix.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,5 +72,8 @@ func DefaultConfig() PluginConfig {
7272
TolerateMissingHugetlbController: true,
7373
DisableHugetlbController: true,
7474
IgnoreImageDefinedVolumes: false,
75+
ImageDecryption: ImageDecryption{
76+
KeyModel: KeyModelNode,
77+
},
7578
}
7679
}

‎pkg/cri/config/config_windows.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,5 +67,9 @@ func DefaultConfig() PluginConfig {
6767
MaxConcurrentDownloads: 3,
6868
IgnoreImageDefinedVolumes: false,
6969
// TODO(windows): Add platform specific config, so that most common defaults can be shared.
70+
71+
ImageDecryption: ImageDecryption{
72+
KeyModel: KeyModelNode,
73+
},
7074
}
7175
}

0 commit comments

Comments
 (0)