aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
...
| * | Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)Miloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | All callers hard-code a header value, so this is actually shorter. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Turn headerAuth into MakeXRegistryAuthHeaderMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ... which can be called independently. For now, there are no new callers, to test that the behavior has not changed. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)Miloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | All callers hard-code a header value, so this is actually shorter. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Turn headerConfig into MakeXRegistryConfigHeaderMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ... which can be called independently. For now, there are no new callers, to test that the behavior has not changed. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Move the auth file creation to GetCredentialsMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | This shares the code, and makes getConfigCredentials and getAuthCredentials side-effect free and possibly easier to test. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Consolidate the error handling path in GetCredentialsMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | We'll share even more code here in the future. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Only look up HTTP header values once in GetCredentialsMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | ... and have GetCredentials pass the values down to getConfigCredentials and getAuthCredentials. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Use Header.Values in GetCredentials.hasMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | It's possibly a bit more expensive, but semantically safer because it does header normalization. And we'll regain the cost by not looking up the value repeatedly. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Beautify GetCredentials.has a bitMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | Use separate lines, and use the provided .String() API. Should not change behaivor. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeaderMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Both have a single caller, so there's no point in looking up the header value twice. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Simplify parseSingleAuthHeaderMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | In the "no input" case, return a constant instead of continuing with the decode/convert path, converting empty data. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Simplify the interface of parseSingleAuthHeaderMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't create a single-element map only for the only caller to laboriously extract an element of that map; just return a single entry. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Don't return a header name from auth.GetCredentialsMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Almost every caller is using it only to wrap an error in exactly the same way, so move that error context into GetCredentials and simplify the users. (The one other caller, build, was even wrapping the error incorrectly talking about query parameters; so let it use the same text as the others.) Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Fix normalizeAuthFileKey to use the correct semanticsMiloslav Trmač2021-12-10
| | | | | | | | | | | | Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Rename normalize and a few variablesMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | ... to refer to auth file keys instead of servers and the like. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Add TestHeaderGetCredentialsRoundtripMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ... as an end-to-end unit test of the header creation/parsing code. Leave the docker.io and docker.io/vendor test cases commented out, because they are currently failing. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Add tests for auth.HeaderMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | Just a single function that handles all of Header, headerConfig and headerAuth; we will split that later. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Improve TestAuthConfigsToAuthFileMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | Remove the created temporary file. Use more appropriate assertion calls. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Add unit tests for singleAuthHeaderMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | Also rename it to parseSingleAuthHeader Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | Add unit tests for multiAuthHeaderMiloslav Trmač2021-12-10
| | | | | | | | | | | | | | | | | | | | | | | | Also rename it to parseMultiAuthHeader. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* | | Merge pull request #12759 from rhatdan/ciOpenShift Merge Robot2022-01-06
|\ \ \ | | | | | | | | Fix CI
| * | | Fix CIDaniel J Walsh2022-01-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | crun should be available in f35. [ NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #12687 from rhatdan/volumeOpenShift Merge Robot2022-01-06
|\ \ \ \ | |/ / / |/| | | Support volume bind mounts for rootless containers
| * | | Support all volume mounts for rootless containersDaniel J Walsh2022-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix handling of "bind" and "tmpfs" olumes to actually work. Allow bind, tmpfs local volumes to work in rootless mode. Also removed the string "error" from all error messages that begine with it. All Podman commands are printed with Error:, so this causes an ugly stutter. Fixes: https://github.com/containers/podman/issues/12013 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | Merge pull request #12754 from dwmarshall/fix-typosOpenShift Merge Robot2022-01-06
|\ \ \ \ | | | | | | | | | | [CI:DOCS] correct typo words in docs
| * | | | correct typo words in docsDavid Marshall2022-01-05
|/ / / / | | | | | | | | | | | | | | | | | | | | "for creating a container" appears for networks and volumes Signed-off-by: David Marshall <dmarshall@gmail.com>
* | | | Merge pull request #12750 from rhatdan/errorOpenShift Merge Robot2022-01-05
|\ \ \ \ | | | | | | | | | | Change Tests to ignore missing containers when removing --all
| * | | | Change Tests to ignore missing containers when removing --allDaniel J Walsh2022-01-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/12740 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | | Merge pull request #12208 from cdoern/podSecurityOptOpenShift Merge Robot2022-01-05
|\ \ \ \ \ | | | | | | | | | | | | Pod Security Option support and Infra Inheritance changes
| * | | | | Pod Security Option supportcdoern2021-12-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added support for pod security options. These are applied to infra and passed down to the containers as added (unless overridden). Modified the inheritance process from infra, creating a new function Inherit() which reads the config, and marshals the compatible options into an intermediate struct `InfraInherit` This is then unmarshaled into a container config and all of this is added to the CtrCreateOptions. Removes the need (mostly) for special additons which complicate the Container_create code and pod creation. resolves #12173 Signed-off-by: cdoern <cdoern@redhat.com>
* | | | | | Merge pull request #12168 from mtrmac/socket-collisionOpenShift Merge Robot2022-01-05
|\ \ \ \ \ \ | | | | | | | | | | | | | | Avoid RemoteSocket collisions in e2e tests
| * | | | | | Don't initialize the global RNG with GinkgoRandomSeed() in e2e testsMiloslav Trmač2022-01-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - It probably doesn't actually make a difference: in experiments, the github.com/containers/storage/pkg/stringid RNG initialization has been happening later - This makes the RNG caller-controlled (which we don't benefit from), but also the same on all nodes of multi-process Ginkgo execution. So, if it works at all, it may make collisions of random ID values more likely, and our tests are not robust against that. So don't go out of our way to make collisions more likely. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | | | | | Avoid collisions on RemoteSocket pathsMiloslav Trmač2022-01-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add lock files and re-generate the UUID if we are not a known-unique user of the socket path. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
| * | | | | | Refactor remote socket path determination in testsMiloslav Trmač2022-01-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Separate the code that determines the directory and file prefix from the code that chooses and applies a UUID; we will make the second part more complex in a bit. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
* | | | | | | Merge pull request #12429 from cdoern/scpOpenShift Merge Robot2022-01-05
|\ \ \ \ \ \ \ | |_|_|/ / / / |/| | | | | | podman image scp never enter podman user NS
| * | | | | | podman image scp never enter podman user NScdoern2021-12-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Podman image scp should never enter the Podman UserNS unless it needs to. This allows for a sudo exec.Command to transfer images to and from rootful storage. If this command is run using sudo, the simple sudo podman save/load does not work, machinectl/su is necessary here. This modification allows for both rootful and rootless transfers, and an overall change of scp to be more of a wrapper function for different load and save calls as well as the ssh component Signed-off-by: cdoern <cdoern@redhat.com>
* | | | | | | Merge pull request #12744 from kolyshkin/fix-flakeOpenShift Merge Robot2022-01-05
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | Fix test flake in test/e2e/pod_initcontainers
| * | | | | | | test/e2e/pod_initcontainers: fix a flakeKir Kolyshkin2022-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 3c3fa6fac4d0f8e8 added a few test cases for the init containers. The "podman ensure always init containers always run" implicitly assumes that restarting a pod will take more than 1 second. When this assumption is not met (because computers are fast!), we get a flake. The fix (without using sleep) is to print nanoseconds in date output. This format option (%N) is not supported by date in Alpine Linux, so switch to Fedora. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
| * | | | | | | test/e2e/run: don't use date +%N on AlpineKir Kolyshkin2022-01-04
|/ / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit e1443fe05d146def6 added a test case that ran "date +%N" inside a Fedora container (without actually using its output). Commit ccc5bc167fa2c140 changed that test case to use Alpine. Problem is, %N is not supported by date in Alpine (it only prints a newline). To eliminate the ambiguity, replace date with touch. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* | | | | | | Merge pull request #12735 from rhatdan/mountOpenShift Merge Robot2022-01-04
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | Fix Container List API call to return mount info
| * | | | | | | Fix Container List API call to return mount infoDaniel J Walsh2022-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We are hard coding mounts to return nil in compat API, since we have the data, we should return it. Fixes: https://github.com/containers/podman/issues/12734 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | | | | | | Merge pull request #12643 from leahneukirchen/events-compatOpenShift Merge Robot2022-01-04
|\ \ \ \ \ \ \ \ | |_|_|_|_|/ / / |/| | | | | | | legacy events: also set Action="die"
| * | | | | | | legacy events: also set exitCodeLeah Neukirchen2022-01-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For Status = "die", Docker sets the exit code of the container to a field "exitCode". Podman uses "containerExitCode". Copy the value into "exitCode" as well, for compatibility. Signed-off-by: Leah Neukirchen <leah@vuxu.org>
| * | | | | | | legacy events: also set Action="die"Leah Neukirchen2021-12-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since #10168, on the event "died", the Status is set to "die" for compatibility with the Docker API. Docker also sets the field Action to "died", so do the same here. Signed-off-by: Leah Neukirchen <leah@vuxu.org>
* | | | | | | | Merge pull request #12709 from flouthoc/ign_add_certsOpenShift Merge Robot2022-01-04
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | ignition: add `certs` from current user into the machine while `init`
| * | | | | | | | ignition: add certs from current user into the machine while initAditya Rajan2021-12-27
| | |_|_|_|/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Following PR ensures that certs from `~/.config/containers/certs.d` or `~/.config/docker/certs.d` are copied into the remote machine at `/etc/containers/certs.d/` As a result on platforms like `macOS` where podman works with a remote machine setup. User's local certs must be transferd to VM without any plumbing needed by user. [NO-NEW-TESTS-NEEDED] Signed-off-by: Aditya Rajan <arajan@redhat.com>
* | | | | | | | Merge pull request #12738 from pdostal/podman_searchOpenShift Merge Robot2022-01-04
|\ \ \ \ \ \ \ \ | |_|_|/ / / / / |/| | | | | | | [CI:DOCS] Fix wrong 'podman search --format' placeholder
| * | | | | | | Fix wrong 'podman search --format' placeholderPavel Dostál2022-01-04
|/ / / / / / / | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Pavel Dostál <pdostal@suse.cz>
* | | | | | | Merge pull request #12611 from Luap99/ipv6OpenShift Merge Robot2022-01-03
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | add --ip6 flag to podman create/run
| * | | | | | | add --ip6 flag to podman create/runPaul Holzinger2022-01-03
| | |_|_|/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the --ipv6 flag to podman create/run and pod create. We support the --network name:ip6=<ip> syntax now but for docker compat we should also support the --ip6 flag. Note that there is no validation if the ip is actually a v6 or v4 address because the backend does not care either. Fixes #7511 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-06 22:51:15 +0000