summaryrefslogtreecommitdiff
path: root/cmd/podman/images
diff options
context:
space:
mode:
authorValentin Rothberg <rothberg@redhat.com>2020-05-13 13:44:29 +0200
committerValentin Rothberg <rothberg@redhat.com>2020-05-29 15:39:37 +0200
commitdc80267b594e41cf7e223821dc1446683f0cae36 (patch)
tree8ca8f81cdf302b1905d7a56f7c5c76ba5468c6f1 /cmd/podman/images
parent78c38460eb8ba9190d414f2da6a1414990cc6cfd (diff)
downloadpodman-dc80267b594e41cf7e223821dc1446683f0cae36.tar.gz
podman-dc80267b594e41cf7e223821dc1446683f0cae36.tar.bz2
podman-dc80267b594e41cf7e223821dc1446683f0cae36.zip
compat handlers: add X-Registry-Auth header support
* Support the `X-Registry-Auth` http-request header. * The content of the header is a base64 encoded JSON payload which can either be a single auth config or a map of auth configs (user+pw or token) with the corresponding registries being the keys. Vanilla Docker, projectatomic Docker and the bindings are transparantly supported. * Add a hidden `--registries-conf` flag. Buildah exposes the same flag, mostly for testing purposes. * Do all credential parsing in the client (i.e., `cmd/podman`) pass the username and password in the backend instead of unparsed credentials. * Add a `pkg/auth` which handles most of the heavy lifting. * Go through the authentication-handling code of most commands, bindings and endpoints. Migrate them to the new code and fix issues as seen. A final evaluation and more tests is still required *after* this change. * The manifest-push endpoint is missing certain parameters and should use the ABI function instead. Adding auth-support isn't really possible without these parts working. * The container commands and endpoints (i.e., create and run) have not been changed yet. The APIs don't yet account for the authfile. * Add authentication tests to `pkg/bindings`. Fixes: #6384 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
Diffstat (limited to 'cmd/podman/images')
-rw-r--r--cmd/podman/images/pull.go14
-rw-r--r--cmd/podman/images/push.go15
2 files changed, 25 insertions, 4 deletions
diff --git a/cmd/podman/images/pull.go b/cmd/podman/images/pull.go
index 7bb4f6d37..9e137b5d6 100644
--- a/cmd/podman/images/pull.go
+++ b/cmd/podman/images/pull.go
@@ -8,6 +8,7 @@ import (
"github.com/containers/image/v5/types"
"github.com/containers/libpod/cmd/podman/registry"
"github.com/containers/libpod/pkg/domain/entities"
+ "github.com/containers/libpod/pkg/util"
"github.com/pkg/errors"
"github.com/spf13/cobra"
"github.com/spf13/pflag"
@@ -17,7 +18,8 @@ import (
// CLI-only fields into the API types.
type pullOptionsWrapper struct {
entities.ImagePullOptions
- TLSVerifyCLI bool // CLI only
+ TLSVerifyCLI bool // CLI only
+ CredentialsCLI string
}
var (
@@ -77,7 +79,7 @@ func pullFlags(flags *pflag.FlagSet) {
flags.BoolVar(&pullOptions.AllTags, "all-tags", false, "All tagged images in the repository will be pulled")
flags.StringVar(&pullOptions.Authfile, "authfile", auth.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&pullOptions.CertDir, "cert-dir", "", "`Pathname` of a directory containing TLS certificates and keys")
- flags.StringVar(&pullOptions.Credentials, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry")
+ flags.StringVar(&pullOptions.CredentialsCLI, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry")
flags.StringVar(&pullOptions.OverrideArch, "override-arch", "", "Use `ARCH` instead of the architecture of the machine for choosing images")
flags.StringVar(&pullOptions.OverrideOS, "override-os", "", "Use `OS` instead of the running OS for choosing images")
flags.BoolVarP(&pullOptions.Quiet, "quiet", "q", false, "Suppress output information when pulling images")
@@ -107,6 +109,14 @@ func imagePull(cmd *cobra.Command, args []string) error {
}
}
+ if pullOptions.CredentialsCLI != "" {
+ creds, err := util.ParseRegistryCreds(pullOptions.CredentialsCLI)
+ if err != nil {
+ return err
+ }
+ pullOptions.Username = creds.Username
+ pullOptions.Password = creds.Password
+ }
// Let's do all the remaining Yoga in the API to prevent us from
// scattering logic across (too) many parts of the code.
pullReport, err := registry.ImageEngine().Pull(registry.GetContext(), args[0], pullOptions.ImagePullOptions)
diff --git a/cmd/podman/images/push.go b/cmd/podman/images/push.go
index 35a6254de..a1614dc7a 100644
--- a/cmd/podman/images/push.go
+++ b/cmd/podman/images/push.go
@@ -7,6 +7,7 @@ import (
"github.com/containers/image/v5/types"
"github.com/containers/libpod/cmd/podman/registry"
"github.com/containers/libpod/pkg/domain/entities"
+ "github.com/containers/libpod/pkg/util"
"github.com/pkg/errors"
"github.com/spf13/cobra"
"github.com/spf13/pflag"
@@ -16,7 +17,8 @@ import (
// CLI-only fields into the API types.
type pushOptionsWrapper struct {
entities.ImagePushOptions
- TLSVerifyCLI bool // CLI only
+ TLSVerifyCLI bool // CLI only
+ CredentialsCLI string
}
var (
@@ -73,7 +75,7 @@ func pushFlags(flags *pflag.FlagSet) {
flags.StringVar(&pushOptions.Authfile, "authfile", auth.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
flags.StringVar(&pushOptions.CertDir, "cert-dir", "", "Path to a directory containing TLS certificates and keys")
flags.BoolVar(&pushOptions.Compress, "compress", false, "Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type as source)")
- flags.StringVar(&pushOptions.Credentials, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry")
+ flags.StringVar(&pushOptions.CredentialsCLI, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry")
flags.StringVar(&pushOptions.DigestFile, "digestfile", "", "Write the digest of the pushed image to the specified file")
flags.StringVarP(&pushOptions.Format, "format", "f", "", "Manifest type (oci, v2s1, or v2s2) to use when pushing an image using the 'dir' transport (default is manifest type of source)")
flags.BoolVarP(&pushOptions.Quiet, "quiet", "q", false, "Suppress output information when pushing images")
@@ -122,6 +124,15 @@ func imagePush(cmd *cobra.Command, args []string) error {
}
}
+ if pushOptions.CredentialsCLI != "" {
+ creds, err := util.ParseRegistryCreds(pushOptions.CredentialsCLI)
+ if err != nil {
+ return err
+ }
+ pushOptions.Username = creds.Username
+ pushOptions.Password = creds.Password
+ }
+
// Let's do all the remaining Yoga in the API to prevent us from scattering
// logic across (too) many parts of the code.
return registry.ImageEngine().Push(registry.GetContext(), source, destination, pushOptions.ImagePushOptions)