Skip to content
This repository was archived by the owner on Mar 9, 2022. It is now read-only.

Commit d0b4eec

Browse files
dmcgowandmcgowan
committed
Add configuration for registry configuration directory
Signed-off-by: Derek McGowan <[email protected]>
1 parent c209d01 commit d0b4eec

6 files changed

Lines changed: 709 additions & 6 deletions

File tree

‎pkg/config/config.go‎

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -144,18 +144,27 @@ type TLSConfig struct {
144144

145145
// Registry is registry settings configured
146146
type Registry struct {
147+
// ConfigPath is a path to the root directory containing registry-specific
148+
// configurations
149+
ConfigPath string `toml:"config_path" json:"config_path"`
150+
151+
// Headers adds additional HTTP headers that get sent to all registries
152+
Headers map[string][]string `toml:"headers" json:"headers"`
153+
147154
// Mirrors are namespace to mirror mapping for all namespaces.
155+
// This option will not be used when ConfigPath is provided.
156+
// DEPRECATED: Use ConfigPath instead. Remove in containerd 1.6.
148157
Mirrors map[string]Mirror `toml:"mirrors" json:"mirrors"`
158+
149159
// Configs are configs for each registry.
150160
// The key is the domain name or IP of the registry.
161+
// This option will be fully deprecated for ConfigPath in the future.
151162
Configs map[string]RegistryConfig `toml:"configs" json:"configs"`
152163

153164
// Auths are registry endpoint to auth config mapping. The registry endpoint must
154165
// be a valid url with host specified.
155-
// DEPRECATED: Use Configs instead. Remove in containerd 1.4.
166+
// DEPRECATED: Use ConfigPath instead. Remove in containerd 1.5.
156167
Auths map[string]AuthConfig `toml:"auths" json:"auths"`
157-
// Headers adds additional HTTP headers that get sent to all registries
158-
Headers map[string][]string `toml:"headers" json:"headers"`
159168
}
160169

161170
// RegistryConfig contains configuration used to communicate with the registry.
@@ -164,6 +173,8 @@ type RegistryConfig struct {
164173
Auth *AuthConfig `toml:"auth" json:"auth"`
165174
// TLS is a pair of CA/Cert/Key which then are used when creating the transport
166175
// that communicates with the registry.
176+
// This field will not be used when ConfigPath is provided.
177+
// DEPRECATED: Use ConfigPath instead. Remove in containerd 1.6.
167178
TLS *TLSConfig `toml:"tls" json:"tls"`
168179
}
169180

@@ -346,6 +357,28 @@ func ValidatePluginConfig(ctx context.Context, c *PluginConfig) error {
346357
}
347358
}
348359

360+
useConfigPath := c.Registry.ConfigPath != ""
361+
if len(c.Registry.Mirrors) > 0 {
362+
if useConfigPath {
363+
return errors.Errorf("`mirrors` cannot be set when `config_path` is provided")
364+
}
365+
log.G(ctx).Warning("`mirrors` is deprecated, please use `config_path` instead")
366+
}
367+
368+
var hasDeprecatedTLS bool
369+
for _, r := range c.Registry.Configs {
370+
if r.TLS != nil {
371+
hasDeprecatedTLS = true
372+
break
373+
}
374+
}
375+
if hasDeprecatedTLS {
376+
if useConfigPath {
377+
return errors.Errorf("`configs.tls` cannot be set when `config_path` is provided")
378+
}
379+
log.G(ctx).Warning("`configs.tls` is deprecated, please use `config_path` instead")
380+
}
381+
349382
// Validation for deprecated auths options and mapping it to configs.
350383
if len(c.Registry.Auths) != 0 {
351384
if c.Registry.Configs == nil {
@@ -356,7 +389,7 @@ func ValidatePluginConfig(ctx context.Context, c *PluginConfig) error {
356389
config.Auth = &auth
357390
c.Registry.Configs[endpoint] = config
358391
}
359-
log.G(ctx).Warning("`auths` is deprecated, please use registry`configs` instead")
392+
log.G(ctx).Warning("`auths` is deprecated, please use `configs` instead")
360393
}
361394

362395
// Validation for stream_idle_timeout

‎pkg/config/config_test.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,46 @@ func TestValidateConfig(t *testing.T) {
320320
},
321321
expectedErr: "invalid stream idle timeout",
322322
},
323+
"conflicting mirror registry config": {
324+
config: &PluginConfig{
325+
ContainerdConfig: ContainerdConfig{
326+
DefaultRuntimeName: RuntimeDefault,
327+
Runtimes: map[string]Runtime{
328+
RuntimeDefault: {
329+
Type: "default",
330+
},
331+
},
332+
},
333+
Registry: Registry{
334+
ConfigPath: "/etc/containerd/conf.d",
335+
Mirrors: map[string]Mirror{
336+
"something.io": {},
337+
},
338+
},
339+
},
340+
expectedErr: "`mirrors` cannot be set when `config_path` is provided",
341+
},
342+
"conflicting tls registry config": {
343+
config: &PluginConfig{
344+
ContainerdConfig: ContainerdConfig{
345+
DefaultRuntimeName: RuntimeDefault,
346+
Runtimes: map[string]Runtime{
347+
RuntimeDefault: {
348+
Type: "default",
349+
},
350+
},
351+
},
352+
Registry: Registry{
353+
ConfigPath: "/etc/containerd/conf.d",
354+
Configs: map[string]RegistryConfig{
355+
"something.io": {
356+
TLS: &TLSConfig{},
357+
},
358+
},
359+
},
360+
},
361+
expectedErr: "`configs.tls` cannot be set when `config_path` is provided",
362+
},
323363
} {
324364
t.Run(desc, func(t *testing.T) {
325365
err := ValidatePluginConfig(context.Background(), test.config)

‎pkg/server/image_pull.go‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"net"
2626
"net/http"
2727
"net/url"
28+
"path/filepath"
2829
"strings"
2930
"time"
3031

@@ -34,6 +35,7 @@ import (
3435
"github.com/containerd/containerd/log"
3536
distribution "github.com/containerd/containerd/reference/docker"
3637
"github.com/containerd/containerd/remotes/docker"
38+
"github.com/containerd/containerd/remotes/docker/config"
3739
"github.com/containerd/imgcrypt"
3840
"github.com/containerd/imgcrypt/images/encryption"
3941
imagespec "github.com/opencontainers/image-spec/specs-go/v1"
@@ -99,7 +101,7 @@ func (c *criService) PullImage(ctx context.Context, r *runtime.PullImageRequest)
99101
var (
100102
resolver = docker.NewResolver(docker.ResolverOptions{
101103
Headers: c.config.Registry.Headers,
102-
Hosts: c.registryHosts(r.GetAuth()),
104+
Hosts: c.registryHosts(ctx, r.GetAuth()),
103105
})
104106
isSchema1 bool
105107
imageHandler containerdimages.HandlerFunc = func(_ context.Context,
@@ -310,8 +312,41 @@ func (c *criService) getTLSConfig(registryTLSConfig criconfig.TLSConfig) (*tls.C
310312
return tlsConfig, nil
311313
}
312314

315+
func hostDirFromRoots(roots []string) func(string) (string, error) {
316+
rootfn := make([]func(string) (string, error), len(roots))
317+
for i := range roots {
318+
rootfn[i] = config.HostDirFromRoot(roots[i])
319+
}
320+
return func(host string) (dir string, err error) {
321+
for _, fn := range rootfn {
322+
dir, err = fn(host)
323+
if (err != nil && !errdefs.IsNotFound(err)) || (dir != "") {
324+
break
325+
}
326+
}
327+
return
328+
}
329+
}
330+
313331
// registryHosts is the registry hosts to be used by the resolver.
314-
func (c *criService) registryHosts(auth *runtime.AuthConfig) docker.RegistryHosts {
332+
func (c *criService) registryHosts(ctx context.Context, auth *runtime.AuthConfig) docker.RegistryHosts {
333+
paths := filepath.SplitList(c.config.Registry.ConfigPath)
334+
if len(paths) > 0 {
335+
hostOptions := config.HostOptions{}
336+
hostOptions.Credentials = func(host string) (string, string, error) {
337+
hostauth := auth
338+
if hostauth == nil {
339+
config := c.config.Registry.Configs[host]
340+
if config.Auth != nil {
341+
hostauth = toRuntimeAuthConfig(*config.Auth)
342+
}
343+
}
344+
return ParseAuth(hostauth, host)
345+
}
346+
hostOptions.HostDir = hostDirFromRoots(paths)
347+
348+
return config.ConfigureHosts(ctx, hostOptions)
349+
}
315350
return func(host string) ([]docker.RegistryHost, error) {
316351
var registries []docker.RegistryHost
317352

‎vendor/github.com/containerd/containerd/remotes/docker/config/config_unix.go‎

Lines changed: 40 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/containerd/containerd/remotes/docker/config/config_windows.go‎

Lines changed: 41 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)