-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #4211 from njucjc/support-auth-tls
buildctl: Add configured TLS certificate to trust store when making calls to registry auth
- Loading branch information
Showing
8 changed files
with
288 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| package build | ||
|
|
||
| import ( | ||
| "encoding/csv" | ||
| "strings" | ||
|
|
||
| "github.com/moby/buildkit/session/auth/authprovider" | ||
| "github.com/pkg/errors" | ||
| ) | ||
|
|
||
| type authTLSContextEntry struct { | ||
| Host string | ||
| CA string | ||
| Cert string | ||
| Key string | ||
| } | ||
|
|
||
| func parseRegistryAuthTLSContextCSV(s string) (authTLSContextEntry, error) { | ||
| authTLSContext := authTLSContextEntry{} | ||
| csvReader := csv.NewReader(strings.NewReader(s)) | ||
| fields, err := csvReader.Read() | ||
| if err != nil { | ||
| return authTLSContext, err | ||
| } | ||
| for _, field := range fields { | ||
| key, value, ok := strings.Cut(field, "=") | ||
| if !ok { | ||
| return authTLSContext, errors.Errorf("invalid value %s", field) | ||
| } | ||
| key = strings.ToLower(key) | ||
| switch key { | ||
| case "host": | ||
| authTLSContext.Host = value | ||
| case "ca": | ||
| authTLSContext.CA = value | ||
| case "cert": | ||
| authTLSContext.Cert = value | ||
| case "key": | ||
| authTLSContext.Key = value | ||
| } | ||
| } | ||
| if authTLSContext.Host == "" { | ||
| return authTLSContext, errors.New("--registry-auth-tlscontext requires host=<host>") | ||
| } | ||
| if authTLSContext.CA == "" { | ||
| if authTLSContext.Cert == "" || authTLSContext.Key == "" { | ||
| return authTLSContext, errors.New("--registry-auth-tlscontext requires ca=<ca> or cert=<cert>,key=<key>") | ||
| } | ||
| } else { | ||
| if (authTLSContext.Cert != "" && authTLSContext.Key == "") || (authTLSContext.Cert == "" && authTLSContext.Key != "") { | ||
| return authTLSContext, errors.New("--registry-auth-tlscontext requires cert=<cert>,key=<key>") | ||
| } | ||
| } | ||
| return authTLSContext, nil | ||
| } | ||
|
|
||
| func ParseRegistryAuthTLSContext(registryAuthTLSContext []string) (map[string]*authprovider.AuthTLSConfig, error) { | ||
| var tlsContexts []authTLSContextEntry | ||
| for _, c := range registryAuthTLSContext { | ||
| authTLSContext, err := parseRegistryAuthTLSContextCSV(c) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| tlsContexts = append(tlsContexts, authTLSContext) | ||
| } | ||
|
|
||
| authConfigs := make(map[string]*authprovider.AuthTLSConfig) | ||
| for _, c := range tlsContexts { | ||
| _, ok := authConfigs[c.Host] | ||
| if !ok { | ||
| authConfigs[c.Host] = &authprovider.AuthTLSConfig{} | ||
| } | ||
| if c.CA != "" { | ||
| authConfigs[c.Host].RootCAs = append(authConfigs[c.Host].RootCAs, c.CA) | ||
| } | ||
| if c.Cert != "" && c.Key != "" { | ||
| authConfigs[c.Host].KeyPairs = append(authConfigs[c.Host].KeyPairs, authprovider.TLSKeyPair{ | ||
| Key: c.Key, | ||
| Certificate: c.Cert, | ||
| }) | ||
| } | ||
| } | ||
| return authConfigs, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,109 @@ | ||
| package build | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/moby/buildkit/session/auth/authprovider" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestParseRegistryAuthTLSContext(t *testing.T) { | ||
| type testCase struct { | ||
| registryAuthTLSContext []string //--registry-auth-tlscontext | ||
| expected map[string]*authprovider.AuthTLSConfig | ||
| expectedErr string | ||
| } | ||
| testCases := []testCase{ | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,ca=/home/admin/ca-file,cert=/home/admin/cert-file,key=/home/admin/key-file", | ||
| }, | ||
| expected: map[string]*authprovider.AuthTLSConfig{ | ||
| "tcp://myserver:2376": { | ||
| RootCAs: []string{ | ||
| "/home/admin/ca-file", | ||
| }, | ||
| KeyPairs: []authprovider.TLSKeyPair{ | ||
| { | ||
| Key: "/home/admin/key-file", | ||
| Certificate: "/home/admin/cert-file", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,cert=/home/admin/cert-file,key=/home/admin/key-file", | ||
| }, | ||
| expected: map[string]*authprovider.AuthTLSConfig{ | ||
| "tcp://myserver:2376": { | ||
| KeyPairs: []authprovider.TLSKeyPair{ | ||
| { | ||
| Key: "/home/admin/key-file", | ||
| Certificate: "/home/admin/cert-file", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,ca=/home/admin/ca-file", | ||
| }, | ||
| expected: map[string]*authprovider.AuthTLSConfig{ | ||
| "tcp://myserver:2376": { | ||
| RootCAs: []string{ | ||
| "/home/admin/ca-file", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,ca=/home/admin/ca-file,key=/home/admin/key-file", | ||
| }, | ||
| expectedErr: "--registry-auth-tlscontext requires cert=<cert>,key=<key>", | ||
| }, | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,ca=/home/admin/ca-file,cert=/home/admin/cert-file,key=/home/admin/key-file", | ||
| "host=https://myserver:2376,ca=/path/to/my/ca.crt,cert=/path/to/my/cert.crt,key=/path/to/my/key.crt", | ||
| }, | ||
| expected: map[string]*authprovider.AuthTLSConfig{ | ||
| "tcp://myserver:2376": { | ||
| RootCAs: []string{ | ||
| "/home/admin/ca-file", | ||
| }, | ||
| KeyPairs: []authprovider.TLSKeyPair{ | ||
| { | ||
| Key: "/home/admin/key-file", | ||
| Certificate: "/home/admin/cert-file", | ||
| }, | ||
| }, | ||
| }, | ||
| "https://myserver:2376": { | ||
| RootCAs: []string{ | ||
| "/path/to/my/ca.crt", | ||
| }, | ||
| KeyPairs: []authprovider.TLSKeyPair{ | ||
| { | ||
| Key: "/path/to/my/key.crt", | ||
| Certificate: "/path/to/my/cert.crt", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range testCases { | ||
| im, err := ParseRegistryAuthTLSContext(tc.registryAuthTLSContext) | ||
| if tc.expectedErr == "" { | ||
| require.EqualValues(t, tc.expected, im) | ||
| } else { | ||
| require.Error(t, err) | ||
| require.Contains(t, err.Error(), tc.expectedErr) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| package authprovider | ||
|
|
||
| type AuthTLSConfig struct { | ||
| RootCAs []string | ||
| KeyPairs []TLSKeyPair | ||
| } | ||
|
|
||
| type TLSKeyPair struct { | ||
| Key string | ||
| Certificate string | ||
| } |
Oops, something went wrong.