-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
buildctl: Add configured TLS certificate to trust store when making c…
…alls to registry auth Signed-off-by: njucjc <njucjc@gmail.com>
- Loading branch information
Showing
6 changed files
with
262 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| package build | ||
|
|
||
| import ( | ||
| "encoding/csv" | ||
| "strings" | ||
|
|
||
| "github.com/pkg/errors" | ||
|
|
||
| "github.com/moby/buildkit/session/auth/authprovider" | ||
| ) | ||
|
|
||
| func parseRegistryAuthTLSContextCSV(s string) (authprovider.AuthTLSContextEntry, error) { | ||
| authTLSContext := authprovider.AuthTLSContextEntry{} | ||
| csvReader := csv.NewReader(strings.NewReader(s)) | ||
| fields, err := csvReader.Read() | ||
| if err != nil { | ||
| return authTLSContext, err | ||
| } | ||
| for _, field := range fields { | ||
| key, value, ok := strings.Cut(field, "=") | ||
| if !ok { | ||
| return authTLSContext, errors.Errorf("invalid value %s", field) | ||
| } | ||
| key = strings.ToLower(key) | ||
| switch key { | ||
| case "host": | ||
| authTLSContext.Host = value | ||
| case "ca": | ||
| authTLSContext.CA = value | ||
| case "cert": | ||
| authTLSContext.Cert = value | ||
| case "key": | ||
| authTLSContext.Key = value | ||
| } | ||
| } | ||
| if authTLSContext.Host == "" { | ||
| return authTLSContext, errors.New("--registry-auth-tlscontext requires host=<host>") | ||
| } | ||
| if authTLSContext.CA == "" { | ||
| if authTLSContext.Cert == "" || authTLSContext.Key == "" { | ||
| return authTLSContext, errors.New("--registry-auth-tlscontext requires ca=<ca> or cert=<cert>,key=<key>") | ||
| } | ||
| } else { | ||
| if (authTLSContext.Cert != "" && authTLSContext.Key == "") || (authTLSContext.Cert == "" && authTLSContext.Key != "") { | ||
| return authTLSContext, errors.New("--registry-auth-tlscontext requires cert=<cert>,key=<key>") | ||
| } | ||
| } | ||
| return authTLSContext, nil | ||
| } | ||
|
|
||
| func ParseRegistryAuthTLSContext(registryAuthTLSContext []string) ([]authprovider.AuthTLSContextEntry, error) { | ||
| var tlsContexts []authprovider.AuthTLSContextEntry | ||
| for _, c := range registryAuthTLSContext { | ||
| authTLSContext, err := parseRegistryAuthTLSContextCSV(c) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| tlsContexts = append(tlsContexts, authTLSContext) | ||
| } | ||
| return tlsContexts, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| package build | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "github.com/moby/buildkit/session/auth/authprovider" | ||
| ) | ||
|
|
||
| func TestParseRegistryAuthTLSContext(t *testing.T) { | ||
| type testCase struct { | ||
| registryAuthTLSContext []string //--registry-auth-tlscontext | ||
| expected []authprovider.AuthTLSContextEntry | ||
| expectedErr string | ||
| } | ||
| testCases := []testCase{ | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,ca=~/ca-file,cert=~/cert-file,key=~/key-file", | ||
| }, | ||
| expected: []authprovider.AuthTLSContextEntry{ | ||
| { | ||
| Host: "tcp://myserver:2376", | ||
| CA: "~/ca-file", | ||
| Cert: "~/cert-file", | ||
| Key: "~/key-file", | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,cert=~/cert-file,key=~/key-file", | ||
| }, | ||
| expected: []authprovider.AuthTLSContextEntry{ | ||
| { | ||
| Host: "tcp://myserver:2376", | ||
| Cert: "~/cert-file", | ||
| Key: "~/key-file", | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,ca=~/ca-file", | ||
| }, | ||
| expected: []authprovider.AuthTLSContextEntry{ | ||
| { | ||
| Host: "tcp://myserver:2376", | ||
| CA: "~/ca-file", | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,ca=~/ca-file,key=~/key-file", | ||
| }, | ||
| expectedErr: "--registry-auth-tlscontext requires cert=<cert>,key=<key>", | ||
| }, | ||
| { | ||
| registryAuthTLSContext: []string{ | ||
| "host=tcp://myserver:2376,ca=~/ca-file,cert=~/cert-file,key=~/key-file", | ||
| "host=https://myserver:2376,ca=/path/to/my/ca.crt,cert=/path/to/my/cert.crt,key=/path/to/my/key.crt", | ||
| }, | ||
| expected: []authprovider.AuthTLSContextEntry{ | ||
| { | ||
| Host: "tcp://myserver:2376", | ||
| CA: "~/ca-file", | ||
| Cert: "~/cert-file", | ||
| Key: "~/key-file", | ||
| }, | ||
| { | ||
| Host: "https://myserver:2376", | ||
| CA: "/path/to/my/ca.crt", | ||
| Cert: "/path/to/my/cert.crt", | ||
| Key: "/path/to/my/key.crt", | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range testCases { | ||
| im, err := ParseRegistryAuthTLSContext(tc.registryAuthTLSContext) | ||
| if tc.expectedErr == "" { | ||
| require.EqualValues(t, tc.expected, im) | ||
| } else { | ||
| require.Error(t, err) | ||
| require.Contains(t, err.Error(), tc.expectedErr) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package authprovider | ||
|
|
||
| type AuthConfig struct { | ||
| RootCAs []string | ||
| KeyPairs []TLSKeyPair | ||
| } | ||
|
|
||
| type TLSKeyPair struct { | ||
| Key string | ||
| Certificate string | ||
| } | ||
|
|
||
| type AuthTLSContextEntry struct { | ||
| Host string | ||
| CA string | ||
| Cert string | ||
| Key string | ||
| } | ||
|
|
||
| func parseAuthConfigs(tlsContexts []AuthTLSContextEntry) map[string]*AuthConfig { | ||
| authConfigs := make(map[string]*AuthConfig) | ||
| for _, c := range tlsContexts { | ||
| _, ok := authConfigs[c.Host] | ||
| if !ok { | ||
| authConfigs[c.Host] = &AuthConfig{} | ||
| } | ||
| if c.CA != "" { | ||
| authConfigs[c.Host].RootCAs = append(authConfigs[c.Host].RootCAs, c.CA) | ||
| } | ||
| if c.Cert != "" && c.Key != "" { | ||
| authConfigs[c.Host].KeyPairs = append(authConfigs[c.Host].KeyPairs, TLSKeyPair{ | ||
| Key: c.Key, | ||
| Certificate: c.Cert, | ||
| }) | ||
| } | ||
| } | ||
| return authConfigs | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters