mirror of
https://github.com/GoogleContainerTools/kaniko
synced 2026-10-18 15:55:44 +02:00
* Add mTLS (client cert) support Add support for Mutual TLS (mTLS) client certificate authentication. The expected format of the new --registry-client-cert flag is the same as the existing --registry-certificate flag, which will allow different client certificates for different registries: --registry-client-cert my.registry.url=/path/to/cert.crt,/path/to/key.key * tidy: Rename mTLS (Client Cert) flag to be in line with others This flag didn't describe that it was for the client certs uses with the registry. Although this should be reasonably obvious, I like the consistency with the other registry flag. * test: Added unit tests for mTLS (Client Cert) loading * test: Add 2 more tests for comma split formatting since the comma splitting is a new portion of code let's make sure that that format works well too in other cases * tidy: Fix formatting of flag help text * tidy: Made invalid cert format error consistent I was running the tests and saw the message: Failed to load client certificate/key '/path/to/client/certificate.cert' for my.registry.name, format is my.registry.name=/path/to/cert,/path/to/key I then realized that it'd be a lot nicer if this showed the user what they input, and how they should change it (rather than decomposing it: Failed to load client certificate/key 'my.registry.name=/path/to/client/certificate.cert', expected format: my.registry.name=/path/to/cert,/path/to/key * test: Fixed incorrect test argument This didn't fail the test before because it's only attempting to show that certs only get loaded and used for their associated registry but it's important to keep this correct. This case is covered by the test below, "RegistriesClientCertificates incorrect cert format" * doc: Add new flag to README.md * mod: Fail to push if there was a problem loading client certs Rather than warning that there was an issue, we should fail if the requested client certificates were not found or failed to load. This feels a lot better than waiting for the build to finish then failing later. * mod: Return an error if the certificate authority fails to load, just like client certs The MakeTransport function was changed in the previous commit to allow returning errors if there was a problem loading certificates, rather than just print warnings. This feels a lot better as you get the error immediately that there's a problem to fix, rather than getting a warning, then later an error that the server's certificate could not be verified. * tidy: fix golint issues
166 lines
4.2 KiB
Go
166 lines
4.2 KiB
Go
/*
|
|
Copyright 2018 Google LLC
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package config
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
// CacheOptions are base image cache options that are set by command line arguments
|
|
type CacheOptions struct {
|
|
CacheDir string
|
|
CacheTTL time.Duration
|
|
}
|
|
|
|
// RegistryOptions are all the options related to the registries, set by command line arguments.
|
|
type RegistryOptions struct {
|
|
RegistryMirrors multiArg
|
|
InsecureRegistries multiArg
|
|
SkipTLSVerifyRegistries multiArg
|
|
RegistriesCertificates keyValueArg
|
|
RegistriesClientCertificates keyValueArg
|
|
Insecure bool
|
|
SkipTLSVerify bool
|
|
InsecurePull bool
|
|
SkipTLSVerifyPull bool
|
|
PushRetry int
|
|
}
|
|
|
|
// KanikoOptions are options that are set by command line arguments
|
|
type KanikoOptions struct {
|
|
RegistryOptions
|
|
CacheOptions
|
|
Destinations multiArg
|
|
BuildArgs multiArg
|
|
Labels multiArg
|
|
Git KanikoGitOptions
|
|
IgnorePaths multiArg
|
|
DockerfilePath string
|
|
SrcContext string
|
|
SnapshotMode string
|
|
SnapshotModeDeprecated string
|
|
CustomPlatform string
|
|
CustomPlatformDeprecated string
|
|
Bucket string
|
|
TarPath string
|
|
TarPathDeprecated string
|
|
KanikoDir string
|
|
Target string
|
|
CacheRepo string
|
|
DigestFile string
|
|
ImageNameDigestFile string
|
|
ImageNameTagDigestFile string
|
|
OCILayoutPath string
|
|
Compression Compression
|
|
CompressionLevel int
|
|
ImageFSExtractRetry int
|
|
SingleSnapshot bool
|
|
Reproducible bool
|
|
NoPush bool
|
|
NoPushCache bool
|
|
Cache bool
|
|
Cleanup bool
|
|
CompressedCaching bool
|
|
IgnoreVarRun bool
|
|
SkipUnusedStages bool
|
|
RunV2 bool
|
|
CacheCopyLayers bool
|
|
CacheRunLayers bool
|
|
ForceBuildMetadata bool
|
|
InitialFSUnpacked bool
|
|
}
|
|
|
|
type KanikoGitOptions struct {
|
|
Branch string
|
|
SingleBranch bool
|
|
RecurseSubmodules bool
|
|
}
|
|
|
|
var ErrInvalidGitFlag = errors.New("invalid git flag, must be in the key=value format")
|
|
|
|
func (k *KanikoGitOptions) Type() string {
|
|
return "gitoptions"
|
|
}
|
|
|
|
func (k *KanikoGitOptions) String() string {
|
|
return fmt.Sprintf("branch=%s,single-branch=%t,recurse-submodules=%t", k.Branch, k.SingleBranch, k.RecurseSubmodules)
|
|
}
|
|
|
|
func (k *KanikoGitOptions) Set(s string) error {
|
|
var parts = strings.SplitN(s, "=", 2)
|
|
if len(parts) != 2 {
|
|
return fmt.Errorf("%w: %s", ErrInvalidGitFlag, s)
|
|
}
|
|
switch parts[0] {
|
|
case "branch":
|
|
k.Branch = parts[1]
|
|
case "single-branch":
|
|
v, err := strconv.ParseBool(parts[1])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
k.SingleBranch = v
|
|
case "recurse-submodules":
|
|
v, err := strconv.ParseBool(parts[1])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
k.RecurseSubmodules = v
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Compression is an enumeration of the supported compression algorithms
|
|
type Compression string
|
|
|
|
// The collection of known MediaType values.
|
|
const (
|
|
GZip Compression = "gzip"
|
|
ZStd Compression = "zstd"
|
|
)
|
|
|
|
func (c *Compression) String() string {
|
|
return string(*c)
|
|
}
|
|
|
|
func (c *Compression) Set(v string) error {
|
|
switch v {
|
|
case "gzip", "zstd":
|
|
*c = Compression(v)
|
|
return nil
|
|
default:
|
|
return errors.New(`must be either "gzip" or "zstd"`)
|
|
}
|
|
}
|
|
|
|
func (c *Compression) Type() string {
|
|
return "compression"
|
|
}
|
|
|
|
// WarmerOptions are options that are set by command line arguments to the cache warmer.
|
|
type WarmerOptions struct {
|
|
CacheOptions
|
|
RegistryOptions
|
|
CustomPlatform string
|
|
Images multiArg
|
|
Force bool
|
|
}
|