summaryrefslogtreecommitdiff
path: root/cmd
diff options
context:
space:
mode:
Diffstat (limited to 'cmd')
-rw-r--r--cmd/podman/common/completion.go43
-rw-r--r--cmd/podman/common/create.go8
-rw-r--r--cmd/podman/common/create_opts.go1
-rw-r--r--cmd/podman/common/specgen.go1
-rw-r--r--cmd/podman/images/build.go75
-rw-r--r--cmd/podman/main.go1
-rw-r--r--cmd/podman/secrets/create.go80
-rw-r--r--cmd/podman/secrets/inspect.go82
-rw-r--r--cmd/podman/secrets/list.go99
-rw-r--r--cmd/podman/secrets/rm.go58
-rw-r--r--cmd/podman/secrets/secret.go25
11 files changed, 469 insertions, 4 deletions
diff --git a/cmd/podman/common/completion.go b/cmd/podman/common/completion.go
index 09dd74e20..ff15983cd 100644
--- a/cmd/podman/common/completion.go
+++ b/cmd/podman/common/completion.go
@@ -212,6 +212,28 @@ func getImages(cmd *cobra.Command, toComplete string) ([]string, cobra.ShellComp
return suggestions, cobra.ShellCompDirectiveNoFileComp
}
+func getSecrets(cmd *cobra.Command, toComplete string) ([]string, cobra.ShellCompDirective) {
+ suggestions := []string{}
+
+ engine, err := setupContainerEngine(cmd)
+ if err != nil {
+ cobra.CompErrorln(err.Error())
+ return nil, cobra.ShellCompDirectiveNoFileComp
+ }
+ secrets, err := engine.SecretList(registry.GetContext())
+ if err != nil {
+ cobra.CompErrorln(err.Error())
+ return nil, cobra.ShellCompDirectiveNoFileComp
+ }
+
+ for _, s := range secrets {
+ if strings.HasPrefix(s.Spec.Name, toComplete) {
+ suggestions = append(suggestions, s.Spec.Name)
+ }
+ }
+ return suggestions, cobra.ShellCompDirectiveNoFileComp
+}
+
func getRegistries() ([]string, cobra.ShellCompDirective) {
regs, err := registries.GetRegistries()
if err != nil {
@@ -412,6 +434,21 @@ func AutocompleteVolumes(cmd *cobra.Command, args []string, toComplete string) (
return getVolumes(cmd, toComplete)
}
+// AutocompleteSecrets - Autocomplete secrets.
+func AutocompleteSecrets(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+ if !validCurrentCmdLine(cmd, args, toComplete) {
+ return nil, cobra.ShellCompDirectiveNoFileComp
+ }
+ return getSecrets(cmd, toComplete)
+}
+
+func AutocompleteSecretCreate(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+ if len(args) == 1 {
+ return nil, cobra.ShellCompDirectiveDefault
+ }
+ return nil, cobra.ShellCompDirectiveNoFileComp
+}
+
// AutocompleteImages - Autocomplete images.
func AutocompleteImages(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
if !validCurrentCmdLine(cmd, args, toComplete) {
@@ -426,6 +463,12 @@ func AutocompleteCreateRun(cmd *cobra.Command, args []string, toComplete string)
return nil, cobra.ShellCompDirectiveNoFileComp
}
if len(args) < 1 {
+ // check if the rootfs flag is set
+ // if it is set to true provide directory completion
+ rootfs, err := cmd.Flags().GetBool("rootfs")
+ if err == nil && rootfs {
+ return nil, cobra.ShellCompDirectiveFilterDirs
+ }
return getImages(cmd, toComplete)
}
// TODO: add path completion for files in the image
diff --git a/cmd/podman/common/create.go b/cmd/podman/common/create.go
index 915ff63b6..d8935628e 100644
--- a/cmd/podman/common/create.go
+++ b/cmd/podman/common/create.go
@@ -603,6 +603,14 @@ func DefineCreateFlags(cmd *cobra.Command, cf *ContainerCLIOpts) {
)
_ = cmd.RegisterFlagCompletionFunc(sdnotifyFlagName, AutocompleteSDNotify)
+ secretFlagName := "secret"
+ createFlags.StringArrayVar(
+ &cf.Secrets,
+ secretFlagName, []string{},
+ "Add secret to container",
+ )
+ _ = cmd.RegisterFlagCompletionFunc(secretFlagName, AutocompleteSecrets)
+
securityOptFlagName := "security-opt"
createFlags.StringArrayVar(
&cf.SecurityOpt,
diff --git a/cmd/podman/common/create_opts.go b/cmd/podman/common/create_opts.go
index d86a6d364..67d40ac43 100644
--- a/cmd/podman/common/create_opts.go
+++ b/cmd/podman/common/create_opts.go
@@ -93,6 +93,7 @@ type ContainerCLIOpts struct {
Replace bool
Rm bool
RootFS bool
+ Secrets []string
SecurityOpt []string
SdNotifyMode string
ShmSize string
diff --git a/cmd/podman/common/specgen.go b/cmd/podman/common/specgen.go
index 4cc53a630..975c76fd9 100644
--- a/cmd/podman/common/specgen.go
+++ b/cmd/podman/common/specgen.go
@@ -642,6 +642,7 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string
s.StopTimeout = &c.StopTimeout
s.Timezone = c.Timezone
s.Umask = c.Umask
+ s.Secrets = c.Secrets
return nil
}
diff --git a/cmd/podman/images/build.go b/cmd/podman/images/build.go
index 1f06dace9..895bdb631 100644
--- a/cmd/podman/images/build.go
+++ b/cmd/podman/images/build.go
@@ -1,9 +1,11 @@
package images
import (
+ "io"
"os"
"path/filepath"
"strings"
+ "time"
"github.com/containers/buildah"
"github.com/containers/buildah/imagebuildah"
@@ -11,6 +13,8 @@ import (
"github.com/containers/buildah/pkg/parse"
"github.com/containers/common/pkg/completion"
"github.com/containers/common/pkg/config"
+ encconfig "github.com/containers/ocicrypt/config"
+ enchelpers "github.com/containers/ocicrypt/helpers"
"github.com/containers/podman/v2/cmd/podman/common"
"github.com/containers/podman/v2/cmd/podman/registry"
"github.com/containers/podman/v2/cmd/podman/utils"
@@ -78,7 +82,8 @@ func useLayers() string {
func init() {
registry.Commands = append(registry.Commands, registry.CliCommand{
- Mode: []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+ Mode: []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+
Command: buildCmd,
})
buildFlags(buildCmd)
@@ -151,8 +156,21 @@ func buildFlags(cmd *cobra.Command) {
// Add the completion functions
fromAndBudFlagsCompletions := buildahCLI.GetFromAndBudFlagsCompletions()
completion.CompleteCommandFlags(cmd, fromAndBudFlagsCompletions)
- _ = flags.MarkHidden("signature-policy")
flags.SetNormalizeFunc(buildahCLI.AliasFlags)
+ if registry.IsRemote() {
+ flag = flags.Lookup("isolation")
+ buildOpts.Isolation = buildah.OCI
+ if err := flag.Value.Set(buildah.OCI); err != nil {
+ logrus.Errorf("unable to set --isolation to %v: %v", buildah.OCI, err)
+ }
+ flag.DefValue = buildah.OCI
+ _ = flags.MarkHidden("disable-content-trust")
+ _ = flags.MarkHidden("cache-from")
+ _ = flags.MarkHidden("sign-by")
+ _ = flags.MarkHidden("signature-policy")
+ _ = flags.MarkHidden("tls-verify")
+ _ = flags.MarkHidden("compress")
+ }
}
// build executes the build command.
@@ -246,7 +264,18 @@ func build(cmd *cobra.Command, args []string) error {
return err
}
- _, err = registry.ImageEngine().Build(registry.GetContext(), containerFiles, *apiBuildOpts)
+ report, err := registry.ImageEngine().Build(registry.GetContext(), containerFiles, *apiBuildOpts)
+
+ if cmd.Flag("iidfile").Changed {
+ f, err := os.Create(buildOpts.Iidfile)
+ if err != nil {
+ return err
+ }
+ if _, err := f.WriteString("sha256:" + report.ID); err != nil {
+ return err
+ }
+ }
+
return err
}
@@ -308,6 +337,10 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *buil
flags.Layers = false
}
+ var stdin io.Reader
+ if flags.Stdin {
+ stdin = os.Stdin
+ }
var stdout, stderr, reporter *os.File
stdout = os.Stdout
stderr = os.Stderr
@@ -402,10 +435,21 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *buil
runtimeFlags = append(runtimeFlags, "--systemd-cgroup")
}
+ imageOS, arch, err := parse.PlatformFromOptions(c)
+ if err != nil {
+ return nil, err
+ }
+
+ decConfig, err := getDecryptConfig(flags.DecryptionKeys)
+ if err != nil {
+ return nil, errors.Wrapf(err, "unable to obtain decrypt config")
+ }
+
opts := imagebuildah.BuildOptions{
AddCapabilities: flags.CapAdd,
AdditionalTags: tags,
Annotations: flags.Annotation,
+ Architecture: arch,
Args: args,
BlobDirectory: flags.BlobCache,
CNIConfigDir: flags.CNIConfigDir,
@@ -433,17 +477,25 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *buil
DropCapabilities: flags.CapDrop,
Err: stderr,
ForceRmIntermediateCtrs: flags.ForceRm,
+ From: flags.From,
IDMappingOptions: idmappingOptions,
- IIDFile: flags.Iidfile,
+ In: stdin,
Isolation: isolation,
+ Jobs: &flags.Jobs,
Labels: flags.Label,
Layers: flags.Layers,
+ LogRusage: flags.LogRusage,
+ Manifest: flags.Manifest,
+ MaxPullPushRetries: 3,
NamespaceOptions: nsValues,
NoCache: flags.NoCache,
+ OS: imageOS,
+ OciDecryptConfig: decConfig,
Out: stdout,
Output: output,
OutputFormat: format,
PullPolicy: pullPolicy,
+ PullPushRetryDelay: 2 * time.Second,
Quiet: flags.Quiet,
RemoveIntermediateCtrs: flags.Rm,
ReportWriter: reporter,
@@ -459,3 +511,18 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *buil
return &entities.BuildOptions{BuildOptions: opts}, nil
}
+
+func getDecryptConfig(decryptionKeys []string) (*encconfig.DecryptConfig, error) {
+ decConfig := &encconfig.DecryptConfig{}
+ if len(decryptionKeys) > 0 {
+ // decryption
+ dcc, err := enchelpers.CreateCryptoConfig([]string{}, decryptionKeys)
+ if err != nil {
+ return nil, errors.Wrapf(err, "invalid decryption keys")
+ }
+ cc := encconfig.CombineCryptoConfigs([]encconfig.CryptoConfig{dcc})
+ decConfig = cc.DecryptConfig
+ }
+
+ return decConfig, nil
+}
diff --git a/cmd/podman/main.go b/cmd/podman/main.go
index f076d13f3..05b36295b 100644
--- a/cmd/podman/main.go
+++ b/cmd/podman/main.go
@@ -14,6 +14,7 @@ import (
_ "github.com/containers/podman/v2/cmd/podman/play"
_ "github.com/containers/podman/v2/cmd/podman/pods"
"github.com/containers/podman/v2/cmd/podman/registry"
+ _ "github.com/containers/podman/v2/cmd/podman/secrets"
_ "github.com/containers/podman/v2/cmd/podman/system"
_ "github.com/containers/podman/v2/cmd/podman/system/connection"
_ "github.com/containers/podman/v2/cmd/podman/volumes"
diff --git a/cmd/podman/secrets/create.go b/cmd/podman/secrets/create.go
new file mode 100644
index 000000000..e58ab57cd
--- /dev/null
+++ b/cmd/podman/secrets/create.go
@@ -0,0 +1,80 @@
+package secrets
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "io"
+ "os"
+
+ "github.com/containers/common/pkg/completion"
+ "github.com/containers/podman/v2/cmd/podman/common"
+ "github.com/containers/podman/v2/cmd/podman/registry"
+ "github.com/containers/podman/v2/pkg/domain/entities"
+ "github.com/spf13/cobra"
+)
+
+var (
+ createCmd = &cobra.Command{
+ Use: "create [options] SECRET FILE|-",
+ Short: "Create a new secret",
+ Long: "Create a secret. Input can be a path to a file or \"-\" (read from stdin). Default driver is file (unencrypted).",
+ RunE: create,
+ Args: cobra.ExactArgs(2),
+ Example: `podman secret create mysecret /path/to/secret
+ printf "secretdata" | podman secret create mysecret -`,
+ ValidArgsFunction: common.AutocompleteSecretCreate,
+ }
+)
+
+var (
+ createOpts = entities.SecretCreateOptions{}
+)
+
+func init() {
+ registry.Commands = append(registry.Commands, registry.CliCommand{
+ Mode: []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+ Command: createCmd,
+ Parent: secretCmd,
+ })
+
+ flags := createCmd.Flags()
+
+ driverFlagName := "driver"
+ flags.StringVar(&createOpts.Driver, driverFlagName, "file", "Specify secret driver")
+ _ = createCmd.RegisterFlagCompletionFunc(driverFlagName, completion.AutocompleteNone)
+}
+
+func create(cmd *cobra.Command, args []string) error {
+ name := args[0]
+
+ var err error
+ path := args[1]
+
+ var reader io.Reader
+ if path == "-" || path == "/dev/stdin" {
+ stat, err := os.Stdin.Stat()
+ if err != nil {
+ return err
+ }
+ if (stat.Mode() & os.ModeNamedPipe) == 0 {
+ return errors.New("if `-` is used, data must be passed into stdin")
+
+ }
+ reader = os.Stdin
+ } else {
+ file, err := os.Open(path)
+ if err != nil {
+ return err
+ }
+ defer file.Close()
+ reader = file
+ }
+
+ report, err := registry.ContainerEngine().SecretCreate(context.Background(), name, reader, createOpts)
+ if err != nil {
+ return err
+ }
+ fmt.Println(report.ID)
+ return nil
+}
diff --git a/cmd/podman/secrets/inspect.go b/cmd/podman/secrets/inspect.go
new file mode 100644
index 000000000..f38ba7f65
--- /dev/null
+++ b/cmd/podman/secrets/inspect.go
@@ -0,0 +1,82 @@
+package secrets
+
+import (
+ "context"
+ "encoding/json"
+ "fmt"
+ "html/template"
+ "os"
+ "text/tabwriter"
+
+ "github.com/containers/common/pkg/report"
+ "github.com/containers/podman/v2/cmd/podman/common"
+ "github.com/containers/podman/v2/cmd/podman/parse"
+ "github.com/containers/podman/v2/cmd/podman/registry"
+ "github.com/containers/podman/v2/pkg/domain/entities"
+ "github.com/pkg/errors"
+ "github.com/spf13/cobra"
+)
+
+var (
+ inspectCmd = &cobra.Command{
+ Use: "inspect [options] SECRET [SECRET...]",
+ Short: "Inspect a secret",
+ Long: "Display detail information on one or more secrets",
+ RunE: inspect,
+ Example: "podman secret inspect MYSECRET",
+ Args: cobra.MinimumNArgs(1),
+ ValidArgsFunction: common.AutocompleteSecrets,
+ }
+)
+
+var format string
+
+func init() {
+ registry.Commands = append(registry.Commands, registry.CliCommand{
+ Mode: []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+ Command: inspectCmd,
+ Parent: secretCmd,
+ })
+ flags := inspectCmd.Flags()
+ formatFlagName := "format"
+ flags.StringVar(&format, formatFlagName, "", "Format volume output using Go template")
+ _ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat)
+}
+
+func inspect(cmd *cobra.Command, args []string) error {
+ inspected, errs, _ := registry.ContainerEngine().SecretInspect(context.Background(), args)
+
+ // always print valid list
+ if len(inspected) == 0 {
+ inspected = []*entities.SecretInfoReport{}
+ }
+
+ if cmd.Flags().Changed("format") {
+ row := report.NormalizeFormat(format)
+ formatted := parse.EnforceRange(row)
+
+ tmpl, err := template.New("inspect secret").Parse(formatted)
+ if err != nil {
+ return err
+ }
+ w := tabwriter.NewWriter(os.Stdout, 12, 2, 2, ' ', 0)
+ defer w.Flush()
+ tmpl.Execute(w, inspected)
+ } else {
+ buf, err := json.MarshalIndent(inspected, "", " ")
+ if err != nil {
+ return err
+ }
+ fmt.Println(string(buf))
+ }
+
+ if len(errs) > 0 {
+ if len(errs) > 1 {
+ for _, err := range errs[1:] {
+ fmt.Fprintf(os.Stderr, "error inspecting secret: %v\n", err)
+ }
+ }
+ return errors.Errorf("error inspecting secret: %v", errs[0])
+ }
+ return nil
+}
diff --git a/cmd/podman/secrets/list.go b/cmd/podman/secrets/list.go
new file mode 100644
index 000000000..dff4bfdca
--- /dev/null
+++ b/cmd/podman/secrets/list.go
@@ -0,0 +1,99 @@
+package secrets
+
+import (
+ "context"
+ "html/template"
+ "os"
+ "text/tabwriter"
+ "time"
+
+ "github.com/containers/common/pkg/completion"
+ "github.com/containers/common/pkg/report"
+ "github.com/containers/podman/v2/cmd/podman/common"
+ "github.com/containers/podman/v2/cmd/podman/parse"
+ "github.com/containers/podman/v2/cmd/podman/registry"
+ "github.com/containers/podman/v2/cmd/podman/validate"
+ "github.com/containers/podman/v2/pkg/domain/entities"
+ "github.com/docker/go-units"
+ "github.com/pkg/errors"
+ "github.com/spf13/cobra"
+)
+
+var (
+ lsCmd = &cobra.Command{
+ Use: "ls [options]",
+ Aliases: []string{"list"},
+ Short: "List secrets",
+ RunE: ls,
+ Example: "podman secret ls",
+ Args: validate.NoArgs,
+ ValidArgsFunction: completion.AutocompleteNone,
+ }
+ listFlag = listFlagType{}
+)
+
+type listFlagType struct {
+ format string
+ noHeading bool
+}
+
+func init() {
+ registry.Commands = append(registry.Commands, registry.CliCommand{
+ Mode: []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+ Command: lsCmd,
+ Parent: secretCmd,
+ })
+
+ flags := lsCmd.Flags()
+ formatFlagName := "format"
+ flags.StringVar(&listFlag.format, formatFlagName, "{{.ID}}\t{{.Name}}\t{{.Driver}}\t{{.CreatedAt}}\t{{.UpdatedAt}}\t\n", "Format volume output using Go template")
+ _ = lsCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat)
+
+}
+
+func ls(cmd *cobra.Command, args []string) error {
+ responses, err := registry.ContainerEngine().SecretList(context.Background())
+ if err != nil {
+ return err
+ }
+ listed := make([]*entities.SecretListReport, 0, len(responses))
+ for _, response := range responses {
+ listed = append(listed, &entities.SecretListReport{
+ ID: response.ID,
+ Name: response.Spec.Name,
+ CreatedAt: units.HumanDuration(time.Since(response.CreatedAt)) + " ago",
+ UpdatedAt: units.HumanDuration(time.Since(response.UpdatedAt)) + " ago",
+ Driver: response.Spec.Driver.Name,
+ })
+
+ }
+ return outputTemplate(cmd, listed)
+}
+
+func outputTemplate(cmd *cobra.Command, responses []*entities.SecretListReport) error {
+ headers := report.Headers(entities.SecretListReport{}, map[string]string{
+ "CreatedAt": "CREATED",
+ "UpdatedAt": "UPDATED",
+ })
+
+ row := report.NormalizeFormat(listFlag.format)
+ format := parse.EnforceRange(row)
+
+ tmpl, err := template.New("list secret").Parse(format)
+ if err != nil {
+ return err
+ }
+ w := tabwriter.NewWriter(os.Stdout, 12, 2, 2, ' ', 0)
+ defer w.Flush()
+
+ if cmd.Flags().Changed("format") && !parse.HasTable(listFlag.format) {
+ listFlag.noHeading = true
+ }
+
+ if !listFlag.noHeading {
+ if err := tmpl.Execute(w, headers); err != nil {
+ return errors.Wrapf(err, "failed to write report column headers")
+ }
+ }
+ return tmpl.Execute(w, responses)
+}
diff --git a/cmd/podman/secrets/rm.go b/cmd/podman/secrets/rm.go
new file mode 100644
index 000000000..c72a3c171
--- /dev/null
+++ b/cmd/podman/secrets/rm.go
@@ -0,0 +1,58 @@
+package secrets
+
+import (
+ "context"
+ "errors"
+ "fmt"
+
+ "github.com/containers/podman/v2/cmd/podman/common"
+ "github.com/containers/podman/v2/cmd/podman/registry"
+ "github.com/containers/podman/v2/cmd/podman/utils"
+ "github.com/containers/podman/v2/pkg/domain/entities"
+ "github.com/spf13/cobra"
+)
+
+var (
+ rmCmd = &cobra.Command{
+ Use: "rm [options] SECRET [SECRET...]",
+ Short: "Remove one or more secrets",
+ RunE: rm,
+ ValidArgsFunction: common.AutocompleteSecrets,
+ Example: "podman secret rm mysecret1 mysecret2",
+ }
+)
+
+func init() {
+ registry.Commands = append(registry.Commands, registry.CliCommand{
+ Mode: []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+ Command: rmCmd,
+ Parent: secretCmd,
+ })
+ flags := rmCmd.Flags()
+ flags.BoolVarP(&rmOptions.All, "all", "a", false, "Remove all secrets")
+}
+
+var (
+ rmOptions = entities.SecretRmOptions{}
+)
+
+func rm(cmd *cobra.Command, args []string) error {
+ var (
+ errs utils.OutputErrors
+ )
+ if (len(args) > 0 && rmOptions.All) || (len(args) < 1 && !rmOptions.All) {
+ return errors.New("`podman secret rm` requires one argument, or the --all flag")
+ }
+ responses, err := registry.ContainerEngine().SecretRm(context.Background(), args, rmOptions)
+ if err != nil {
+ return err
+ }
+ for _, r := range responses {
+ if r.Err == nil {
+ fmt.Println(r.ID)
+ } else {
+ errs = append(errs, r.Err)
+ }
+ }
+ return errs.PrintErrors()
+}
diff --git a/cmd/podman/secrets/secret.go b/cmd/podman/secrets/secret.go
new file mode 100644
index 000000000..4e6b6ec7b
--- /dev/null
+++ b/cmd/podman/secrets/secret.go
@@ -0,0 +1,25 @@
+package secrets
+
+import (
+ "github.com/containers/podman/v2/cmd/podman/registry"
+ "github.com/containers/podman/v2/cmd/podman/validate"
+ "github.com/containers/podman/v2/pkg/domain/entities"
+ "github.com/spf13/cobra"
+)
+
+var (
+ // Command: podman _secret_
+ secretCmd = &cobra.Command{
+ Use: "secret",
+ Short: "Manage secrets",
+ Long: "Manage secrets",
+ RunE: validate.SubCommandExists,
+ }
+)
+
+func init() {
+ registry.Commands = append(registry.Commands, registry.CliCommand{
+ Mode: []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+ Command: secretCmd,
+ })
+}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-28 17:58:48 +0000