Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add docker authorization for docker operations #503

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
+27 −15
Open

add docker authorization for docker operations #503

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a0f321f
add docker authorization
tashima42 Nov 12, 2024
3b4d086
return plain text creds
tashima42 Nov 12, 2024
bcf3fd0
get auth from env on the command
tashima42 Nov 12, 2024
9df23a5
fix error handling and var checks
tashima42 Nov 12, 2024
8cfcb92
set password and username
tashima42 Nov 12, 2024
d52508e
set password and username with flags
tashima42 Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions cmd/release/cmd/generate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ var (
ignoreImages []string
checkImages []string
registry string
username string
password string
rancherMissingImagesJSONOutput bool
rke2PrevMilestone string
rke2Milestone string
Expand Down Expand Up @@ -140,7 +142,7 @@ var rancherGenerateMissingImagesListSubCmd = &cobra.Command{
if len(checkImages) == 0 && imagesListURL == "" {
return errors.New("either --images-list-url or --check-images must be provided")
}
missingImages, err := rancher.GenerateMissingImagesList(imagesListURL, registry, concurrencyLimit, checkImages, ignoreImages, verbose)
missingImages, err := rancher.GenerateMissingImagesList(imagesListURL, registry, username, password, concurrencyLimit, checkImages, ignoreImages, verbose)
if err != nil {
return err
}
Expand All @@ -163,7 +165,7 @@ var rancherGenerateDockerImagesDigestsSubCmd = &cobra.Command{
Use: "docker-images-digests",
Short: "Generate a file with images digests from an images list",
RunE: func(cmd *cobra.Command, args []string) error {
return rancher.GenerateDockerImageDigests(rancherImagesDigestsOutputFile, rancherImagesDigestsImagesURL, rancherImagesDigestsRegistry, verbose)
return rancher.GenerateDockerImageDigests(rancherImagesDigestsOutputFile, rancherImagesDigestsImagesURL, rancherImagesDigestsRegistry, username, password, verbose)
},
}

Expand Down Expand Up @@ -303,9 +305,13 @@ func init() {
rancherGenerateMissingImagesListSubCmd.Flags().StringSliceVarP(&ignoreImages, "ignore-images", "g", make([]string, 0), "Images to ignore when checking for missing images without the version. e.g: rancher/rancher")
rancherGenerateMissingImagesListSubCmd.Flags().StringSliceVarP(&checkImages, "check-images", "k", make([]string, 0), "Images to check for when checking for missing images with the version. e.g: rancher/rancher-agent:v2.9.0")
rancherGenerateMissingImagesListSubCmd.Flags().StringVarP(&registry, "registry", "r", "registry.rancher.com", "Registry where the images should be located at")
rancherGenerateMissingImagesListSubCmd.Flags().StringVarP(&username, "username", "u", "", "Docker registry username")
rancherGenerateMissingImagesListSubCmd.Flags().StringVarP(&password, "password", "p", "", "Docker registry password")

// rancher generate docker-images-digests
rancherGenerateDockerImagesDigestsSubCmd.Flags().StringVarP(&rancherImagesDigestsOutputFile, "output-file", "o", "", "Output file with images digests")
rancherGenerateDockerImagesDigestsSubCmd.Flags().StringVarP(&username, "username", "u", "", "Docker registry username")
rancherGenerateDockerImagesDigestsSubCmd.Flags().StringVarP(&password, "password", "p", "", "Docker registry password")
if err := rancherGenerateDockerImagesDigestsSubCmd.MarkFlagRequired("output-file"); err != nil {
fmt.Println(err.Error())
os.Exit(1)
Expand Down
32 changes: 19 additions & 13 deletions release/rancher/rancher.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -435,7 +435,7 @@ func formatContentLine(line string) string {
return strings.TrimSpace(line)
}

func GenerateMissingImagesList(imagesListURL, registry string, concurrencyLimit int, checkImages, ignoreImages []string, verbose bool) ([]string, error) {
func GenerateMissingImagesList(imagesListURL, registry, username, password string, concurrencyLimit int, checkImages, ignoreImages []string, verbose bool) ([]string, error) {
if len(checkImages) == 0 {
if imagesListURL == "" {
return nil, errors.New("if no images are provided, an images list URL must be provided")
Expand Down Expand Up @@ -479,7 +479,7 @@ func GenerateMissingImagesList(imagesListURL, registry string, concurrencyLimit
continue
}

func(ctx context.Context, missingImagesChan chan string, image, imageVersion string, repositoryAuths map[string]string, mu *sync.RWMutex) {
func(ctx context.Context, missingImagesChan chan string, image, imageVersion, username, password string, repositoryAuths map[string]string, mu *sync.RWMutex) {
errGroup.Go(func() error {
// if any other check failed, stop running to prevent wasting resources
// this doesn't include 404's since it is expected it does include any other errors
Expand All @@ -495,7 +495,7 @@ func GenerateMissingImagesList(imagesListURL, registry string, concurrencyLimit

auth, ok = repositoryAuths[image]
if !ok {
auth, err = registryAuth(rgInfo.AuthURL, rgInfo.Service, image)
auth, err = registryAuth(rgInfo.AuthURL, rgInfo.Service, image, username, password)
if err != nil {
cancel()
return err
Expand All @@ -517,7 +517,7 @@ func GenerateMissingImagesList(imagesListURL, registry string, concurrencyLimit
return nil
}
})
}(ctx, missingImagesChan, image, imageVersion, repositoryAuths, &mu)
}(ctx, missingImagesChan, image, imageVersion, username, password, repositoryAuths, &mu)

}
if err := errGroup.Wait(); err != nil {
Expand Down Expand Up @@ -632,15 +632,15 @@ func validateRepoImage(repoImage string) error {
return nil
}

func GenerateDockerImageDigests(outputFile, imagesFileURL, registry string, verbose bool) error {
imagesDigests, err := dockerImagesDigests(imagesFileURL, registry)
func GenerateDockerImageDigests(outputFile, imagesFileURL, registry, username, password string, verbose bool) error {
imagesDigests, err := dockerImagesDigests(imagesFileURL, registry, username, password)
if err != nil {
return err
}
return createAssetFile(outputFile, imagesDigests)
}

func dockerImagesDigests(imagesFileURL, registry string) (imageDigest, error) {
func dockerImagesDigests(imagesFileURL, registry, username, password string) (imageDigest, error) {
imagesList, err := artifactImageList(imagesFileURL, registry)
if err != nil {
return nil, err
Expand All @@ -652,7 +652,7 @@ func dockerImagesDigests(imagesFileURL, registry string) (imageDigest, error) {
}

imagesDigests := make(imageDigest)
var repositoryAuths = make(map[string]string)
repositoryAuths := make(map[string]string)

for _, imageAndVersion := range imagesList {
if imageAndVersion == "" || imageAndVersion == " " {
Expand All @@ -666,7 +666,7 @@ func dockerImagesDigests(imagesFileURL, registry string) (imageDigest, error) {
imageVersion := splitImage[1]

if _, ok := repositoryAuths[image]; !ok {
auth, err := registryAuth(rgInfo.AuthURL, rgInfo.Service, image)
auth, err := registryAuth(rgInfo.AuthURL, rgInfo.Service, image, username, password)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -804,19 +804,25 @@ func checkIfImageExists(registryBaseURL, img, imgVersion, auth string) (bool, er
return true, nil
}

func registryAuth(authURL, service, image string) (string, error) {
func registryAuth(authURL, service, image, username, password string) (string, error) {
httpClient := ecmHTTP.NewClient(time.Second * 15)
scope := "repository:" + image + ":pull"
url := authURL + "?scope=" + scope + "&service=" + service
res, err := httpClient.Get(url)
req, err := http.NewRequest(http.MethodGet, url, nil)
if err != nil {
return "", err
}
if len(username) > 1 && len(password) > 1 {
req.SetBasicAuth(username, password)
}
res, err := httpClient.Do(req)
if err != nil {
return "", err
}
defer res.Body.Close()

if res.StatusCode != http.StatusOK {
return "", errors.New("expected status code to be 200, got: " + strconv.Itoa(res.StatusCode))
}
defer res.Body.Close()

var auth registryAuthToken
if err := json.NewDecoder(res.Body).Decode(&auth); err != nil {
Expand Down
Loading