Files
kaniko/pkg/config/options.go
T
Eric 7525828ef9 Add mTLS (client cert) registry authentication (#2180)
* Add mTLS (client cert) support

Add support for Mutual TLS (mTLS) client certificate authentication.
The expected format of the new --registry-client-cert flag is the same
as the existing --registry-certificate flag, which will allow
different client certificates for different registries:

--registry-client-cert my.registry.url=/path/to/cert.crt,/path/to/key.key

* tidy: Rename mTLS (Client Cert) flag to be in line with others

This flag didn't describe that it was for the client certs uses with
the registry. Although this should be reasonably obvious, I like the
consistency with the other registry flag.

* test: Added unit tests for mTLS (Client Cert) loading

* test: Add 2 more tests for comma split formatting

since the comma splitting is a new portion of code let's make sure
that that format works well too in other cases

* tidy: Fix formatting of flag help text

* tidy: Made invalid cert format error consistent

I was running the tests and saw the message:

Failed to load client certificate/key '/path/to/client/certificate.cert' for my.registry.name, format is my.registry.name=/path/to/cert,/path/to/key

I then realized that it'd be a lot nicer if this showed the user what
they input, and how they should change it (rather than decomposing it:

Failed to load client certificate/key 'my.registry.name=/path/to/client/certificate.cert', expected format: my.registry.name=/path/to/cert,/path/to/key

* test: Fixed incorrect test argument

This didn't fail the test before because it's only attempting to show
that certs only get loaded and used for their associated registry but
it's important to keep this correct.

This case is covered by the test below, "RegistriesClientCertificates
incorrect cert format"

* doc: Add new flag to README.md

* mod: Fail to push if there was a problem loading client certs

Rather than warning that there was an issue, we should fail if the
requested client certificates were not found or failed to load.

This feels a lot better than waiting for the build to finish then
failing later.

* mod: Return an error if the certificate authority fails to load, just like client certs

The MakeTransport function was changed in the previous commit to
allow returning errors if there was a problem loading certificates,
rather than just print warnings.

This feels a lot better as you get the error immediately that there's
a problem to fix, rather than getting a warning, then later an error
that the server's certificate could not be verified.

* tidy: fix golint issues
2023-05-18 14:20:51 -07:00

166 lines
4.2 KiB
Go

/*
Copyright 2018 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package config
import (
"errors"
"fmt"
"strconv"
"strings"
"time"
)
// CacheOptions are base image cache options that are set by command line arguments
type CacheOptions struct {
CacheDir string
CacheTTL time.Duration
}
// RegistryOptions are all the options related to the registries, set by command line arguments.
type RegistryOptions struct {
RegistryMirrors multiArg
InsecureRegistries multiArg
SkipTLSVerifyRegistries multiArg
RegistriesCertificates keyValueArg
RegistriesClientCertificates keyValueArg
Insecure bool
SkipTLSVerify bool
InsecurePull bool
SkipTLSVerifyPull bool
PushRetry int
}
// KanikoOptions are options that are set by command line arguments
type KanikoOptions struct {
RegistryOptions
CacheOptions
Destinations multiArg
BuildArgs multiArg
Labels multiArg
Git KanikoGitOptions
IgnorePaths multiArg
DockerfilePath string
SrcContext string
SnapshotMode string
SnapshotModeDeprecated string
CustomPlatform string
CustomPlatformDeprecated string
Bucket string
TarPath string
TarPathDeprecated string
KanikoDir string
Target string
CacheRepo string
DigestFile string
ImageNameDigestFile string
ImageNameTagDigestFile string
OCILayoutPath string
Compression Compression
CompressionLevel int
ImageFSExtractRetry int
SingleSnapshot bool
Reproducible bool
NoPush bool
NoPushCache bool
Cache bool
Cleanup bool
CompressedCaching bool
IgnoreVarRun bool
SkipUnusedStages bool
RunV2 bool
CacheCopyLayers bool
CacheRunLayers bool
ForceBuildMetadata bool
InitialFSUnpacked bool
}
type KanikoGitOptions struct {
Branch string
SingleBranch bool
RecurseSubmodules bool
}
var ErrInvalidGitFlag = errors.New("invalid git flag, must be in the key=value format")
func (k *KanikoGitOptions) Type() string {
return "gitoptions"
}
func (k *KanikoGitOptions) String() string {
return fmt.Sprintf("branch=%s,single-branch=%t,recurse-submodules=%t", k.Branch, k.SingleBranch, k.RecurseSubmodules)
}
func (k *KanikoGitOptions) Set(s string) error {
var parts = strings.SplitN(s, "=", 2)
if len(parts) != 2 {
return fmt.Errorf("%w: %s", ErrInvalidGitFlag, s)
}
switch parts[0] {
case "branch":
k.Branch = parts[1]
case "single-branch":
v, err := strconv.ParseBool(parts[1])
if err != nil {
return err
}
k.SingleBranch = v
case "recurse-submodules":
v, err := strconv.ParseBool(parts[1])
if err != nil {
return err
}
k.RecurseSubmodules = v
}
return nil
}
// Compression is an enumeration of the supported compression algorithms
type Compression string
// The collection of known MediaType values.
const (
GZip Compression = "gzip"
ZStd Compression = "zstd"
)
func (c *Compression) String() string {
return string(*c)
}
func (c *Compression) Set(v string) error {
switch v {
case "gzip", "zstd":
*c = Compression(v)
return nil
default:
return errors.New(`must be either "gzip" or "zstd"`)
}
}
func (c *Compression) Type() string {
return "compression"
}
// WarmerOptions are options that are set by command line arguments to the cache warmer.
type WarmerOptions struct {
CacheOptions
RegistryOptions
CustomPlatform string
Images multiArg
Force bool
}