mirror of
https://github.com/GoogleContainerTools/kaniko
synced 2026-10-18 14:56:05 +02:00
* Add mTLS (client cert) support Add support for Mutual TLS (mTLS) client certificate authentication. The expected format of the new --registry-client-cert flag is the same as the existing --registry-certificate flag, which will allow different client certificates for different registries: --registry-client-cert my.registry.url=/path/to/cert.crt,/path/to/key.key * tidy: Rename mTLS (Client Cert) flag to be in line with others This flag didn't describe that it was for the client certs uses with the registry. Although this should be reasonably obvious, I like the consistency with the other registry flag. * test: Added unit tests for mTLS (Client Cert) loading * test: Add 2 more tests for comma split formatting since the comma splitting is a new portion of code let's make sure that that format works well too in other cases * tidy: Fix formatting of flag help text * tidy: Made invalid cert format error consistent I was running the tests and saw the message: Failed to load client certificate/key '/path/to/client/certificate.cert' for my.registry.name, format is my.registry.name=/path/to/cert,/path/to/key I then realized that it'd be a lot nicer if this showed the user what they input, and how they should change it (rather than decomposing it: Failed to load client certificate/key 'my.registry.name=/path/to/client/certificate.cert', expected format: my.registry.name=/path/to/cert,/path/to/key * test: Fixed incorrect test argument This didn't fail the test before because it's only attempting to show that certs only get loaded and used for their associated registry but it's important to keep this correct. This case is covered by the test below, "RegistriesClientCertificates incorrect cert format" * doc: Add new flag to README.md * mod: Fail to push if there was a problem loading client certs Rather than warning that there was an issue, we should fail if the requested client certificates were not found or failed to load. This feels a lot better than waiting for the build to finish then failing later. * mod: Return an error if the certificate authority fails to load, just like client certs The MakeTransport function was changed in the previous commit to allow returning errors if there was a problem loading certificates, rather than just print warnings. This feels a lot better as you get the error immediately that there's a problem to fix, rather than getting a warning, then later an error that the server's certificate could not be verified. * tidy: fix golint issues
111 lines
4.8 KiB
Go
111 lines
4.8 KiB
Go
/*
|
|
Copyright 2018 Google LLC
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"time"
|
|
|
|
"github.com/GoogleContainerTools/kaniko/pkg/cache"
|
|
"github.com/GoogleContainerTools/kaniko/pkg/config"
|
|
"github.com/GoogleContainerTools/kaniko/pkg/logging"
|
|
"github.com/containerd/containerd/platforms"
|
|
v1 "github.com/google/go-containerregistry/pkg/v1"
|
|
"github.com/pkg/errors"
|
|
"github.com/sirupsen/logrus"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
var (
|
|
opts = &config.WarmerOptions{}
|
|
logLevel string
|
|
logFormat string
|
|
logTimestamp bool
|
|
)
|
|
|
|
func init() {
|
|
RootCmd.PersistentFlags().StringVarP(&logLevel, "verbosity", "v", logging.DefaultLevel, "Log level (trace, debug, info, warn, error, fatal, panic)")
|
|
RootCmd.PersistentFlags().StringVar(&logFormat, "log-format", logging.FormatColor, "Log format (text, color, json)")
|
|
RootCmd.PersistentFlags().BoolVar(&logTimestamp, "log-timestamp", logging.DefaultLogTimestamp, "Timestamp in log output")
|
|
|
|
addKanikoOptionsFlags()
|
|
addHiddenFlags()
|
|
}
|
|
|
|
var RootCmd = &cobra.Command{
|
|
Use: "cache warmer",
|
|
PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
|
|
if err := logging.Configure(logLevel, logFormat, logTimestamp); err != nil {
|
|
return err
|
|
}
|
|
|
|
if len(opts.Images) == 0 {
|
|
return errors.New("You must select at least one image to cache")
|
|
}
|
|
return nil
|
|
},
|
|
Run: func(cmd *cobra.Command, args []string) {
|
|
if _, err := os.Stat(opts.CacheDir); os.IsNotExist(err) {
|
|
err = os.MkdirAll(opts.CacheDir, 0755)
|
|
if err != nil {
|
|
exit(errors.Wrap(err, "Failed to create cache directory"))
|
|
}
|
|
}
|
|
if err := cache.WarmCache(opts); err != nil {
|
|
exit(errors.Wrap(err, "Failed warming cache"))
|
|
}
|
|
|
|
},
|
|
}
|
|
|
|
// addKanikoOptionsFlags configures opts
|
|
func addKanikoOptionsFlags() {
|
|
RootCmd.PersistentFlags().VarP(&opts.Images, "image", "i", "Image to cache. Set it repeatedly for multiple images.")
|
|
RootCmd.PersistentFlags().StringVarP(&opts.CacheDir, "cache-dir", "c", "/cache", "Directory of the cache.")
|
|
RootCmd.PersistentFlags().BoolVarP(&opts.Force, "force", "f", false, "Force cache overwriting.")
|
|
RootCmd.PersistentFlags().DurationVarP(&opts.CacheTTL, "cache-ttl", "", time.Hour*336, "Cache timeout in hours. Defaults to two weeks.")
|
|
RootCmd.PersistentFlags().BoolVarP(&opts.InsecurePull, "insecure-pull", "", false, "Pull from insecure registry using plain HTTP")
|
|
RootCmd.PersistentFlags().BoolVarP(&opts.SkipTLSVerifyPull, "skip-tls-verify-pull", "", false, "Pull from insecure registry ignoring TLS verify")
|
|
RootCmd.PersistentFlags().VarP(&opts.InsecureRegistries, "insecure-registry", "", "Insecure registry using plain HTTP to pull. Set it repeatedly for multiple registries.")
|
|
RootCmd.PersistentFlags().VarP(&opts.SkipTLSVerifyRegistries, "skip-tls-verify-registry", "", "Insecure registry ignoring TLS verify to pull. Set it repeatedly for multiple registries.")
|
|
opts.RegistriesCertificates = make(map[string]string)
|
|
RootCmd.PersistentFlags().VarP(&opts.RegistriesCertificates, "registry-certificate", "", "Use the provided certificate for TLS communication with the given registry. Expected format is 'my.registry.url=/path/to/the/server/certificate'.")
|
|
opts.RegistriesClientCertificates = make(map[string]string)
|
|
RootCmd.PersistentFlags().VarP(&opts.RegistriesClientCertificates, "registry-client-cert", "", "Use the provided client certificate for mutual TLS (mTLS) communication with the given registry. Expected format is 'my.registry.url=/path/to/client/cert,/path/to/client/key'.")
|
|
RootCmd.PersistentFlags().VarP(&opts.RegistryMirrors, "registry-mirror", "", "Registry mirror to use as pull-through cache instead of docker.io. Set it repeatedly for multiple mirrors.")
|
|
RootCmd.PersistentFlags().StringVarP(&opts.CustomPlatform, "customPlatform", "", "", "Specify the build platform if different from the current host")
|
|
|
|
// Default the custom platform flag to our current platform, and validate it.
|
|
if opts.CustomPlatform == "" {
|
|
opts.CustomPlatform = platforms.Format(platforms.Normalize(platforms.DefaultSpec()))
|
|
}
|
|
if _, err := v1.ParsePlatform(opts.CustomPlatform); err != nil {
|
|
logrus.Fatalf("Invalid platform %q: %v", opts.CustomPlatform, err)
|
|
}
|
|
}
|
|
|
|
// addHiddenFlags marks certain flags as hidden from the executor help text
|
|
func addHiddenFlags() {
|
|
RootCmd.PersistentFlags().MarkHidden("azure-container-registry-config")
|
|
}
|
|
|
|
func exit(err error) {
|
|
fmt.Println(err)
|
|
os.Exit(1)
|
|
}
|