aboutsummaryrefslogtreecommitdiff
path: root/pkg
Commit message (Collapse)AuthorAge
* add `pkg/systemd/notifyproxy`Valentin Rothberg2022-08-10
| | | | | | | | | | Add a new package for proxying notify sockets and waiting for the READY=1 message to appear. May subject to further changes in future commits. Tests make sure that it behaves properly. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* Merge pull request #14926 from cdoern/generateSpecOpenShift Merge Robot2022-08-10
|\ | | | | podman generate spec
| * podman generate specCharlie Doern2022-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | implement a new command `podman generate spec` which can formulate a json specgen to be consumed by both the pod and container creation API. supported flags are --verbose (default true) print output to the terminal --compact print the json output in a single line format to be piped to the API --filename put the output in a file --clone rename the pod/ctr in the spec so it won't conflict w/ an existing entity Signed-off-by: Charlie Doern <cdoern@redhat.com>
* | Merge pull request #15094 from cdoern/sshOpenShift Merge Robot2022-08-10
|\ \ | | | | | | podman ssh work, using new c/common interface
| * | podman ssh work, using new c/common interfaceCharlie Doern2022-08-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implement new ssh interface into podman this completely redesigns the entire functionality of podman image scp, podman system connection add, and podman --remote. All references to golang.org/x/crypto/ssh have been moved to common as have native ssh/scp execs and the new usage of the sftp package. this PR adds a global flag, --ssh to podman which has two valid inputs `golang` and `native` where golang is the default. Users should not notice any difference in their everyday workflows if they continue using the golang option. UNLESS they have been using an improperly verified ssh key, this will now fail. This is because podman was incorrectly using the ssh callback method to IGNORE the ssh known hosts file which is very insecure and golang tells you not yo use this in production. The native paths allows for immense flexibility, with a new containers.conf field `SSH_CONFIG` that specifies a specific ssh config file to be used in all operations. Else the users ~/.ssh/config file will be used. podman --remote currently only uses the golang path, given its deep interconnection with dialing multiple clients and urls. My goal after this PR is to go back and abstract the idea of podman --remote from golang's dialed clients, as it should not be so intrinsically connected. Overall, this is a v1 of a long process of offering native ssh, and one that covers some good ground with podman system connection add and podman image scp. Signed-off-by: Charlie Doern <cdoern@redhat.com>
* | | Merge pull request #15244 from baude/machinememorytestsOpenShift Merge Robot2022-08-10
|\ \ \ | | | | | | | | check memory test based on range
| * | | check memory test based on rangeBrent Baude2022-08-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when verifying that the memory was set correctly for a podman machine instance, we check if the number is between a range because based on architecture, operating system, and memory itself this number can differ significantly. Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | | Merge pull request #15199 from baude/addapplehvOpenShift Merge Robot2022-08-09
|\ \ \ \ | | | | | | | | | | Add interface for apple hypervisor
| * | | | Add interface for apple hypervisorBrent Baude2022-08-08
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new apple silicon processesors (m1/m2) are capable of using a performent apple hypervisor (included in macos). Our "virtual providers" for podman machine are part of an interface design. This PR provides an implementation of the interface to begin the work for supporting the apple hypervisor. It is basically only a skeletal PR. The actual code for using the hypervisor and launching a machine will come as several new PRs following the inclusion of this one. There will likely be code reuse between the applehv and qemu code; but none of that code is being moved at this time. It will be moved "on demand" during development. [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* | | | Merge pull request #15230 from YoitoFes/Issue-15211OpenShift Merge Robot2022-08-09
|\ \ \ \ | |_|/ / |/| | | pkg/bindings: Support writing image push progress to specified io.Writer
| * | | pkg/bindings: Support writing image push progress to specified io.WriterNaoto Kobayashi2022-08-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently bindings writes image push progress to os.Stderr. Since os.Stderr is inconvenience for bindings caller to process the progress messages, Added this support. Signed-off-by: Naoto Kobayashi <naoto.kobayashi4c@gmail.com>
* | | | Merge pull request #15246 from TomSweeneyRedHat/dev/tsweeney/buildah1.27.0OpenShift Merge Robot2022-08-09
|\ \ \ \ | | | | | | | | | | Bump to Buildah v1.27.0
| * | | | build: implement --cache-to,--cache-from and --cache-ttlAditya R2022-08-09
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | [NO NEW TESTS NEEDED] [NO TESTS NEEDED] Signed-off-by: Aditya R <arajan@redhat.com>
* | | | Merge pull request #15134 from sstosh/improve-outputOpenShift Merge Robot2022-08-09
|\ \ \ \ | |/ / / |/| | | Output messages display rawInput
| * | | Output messages display rawInputToshiki Sonoda2022-08-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `init`, `checkpint/restore` and `cleanup` command now display output messages which is rawInput instead of a container ID. Example: ``` $ podman init <container name> <container name> $ podman init <short container ID> <short container ID> ``` Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* | | | specgen: use sandbox id instead of name for annotationGiuseppe Scrivano2022-08-08
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | use the sandbox id instead of the name for the io.kubernetes.cri-o.SandboxID annotation used by gVisor. Closes: https://github.com/containers/podman/issues/15223 [NO NEW TESTS NEEDED] it is specific to gVisor Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | | Merge pull request #15093 from karthikelango137/rmiNoPrune1openshift-ci[bot]2022-08-05
|\ \ \ | | | | | | | | remove image podman no prune
| * | | remove image podman no pruneKarthik Elango2022-08-04
| | |/ | |/| | | | | | | Signed-off-by: Karthik Elango <kelango@redhat.com>
* | | Merge pull request #15184 from gbraad/change-config-orderopenshift-ci[bot]2022-08-05
|\ \ \ | | | | | | | | Fixes #15154 Change order when config and connections are written
| * | | Fixes #15154 Change order when config and connections are writtenGerard Braad2022-08-05
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | When the break out or the WSL environment fails to start, the config and connections should not be written. Placing them at the end of the provisioning step will mitigate the issue. [NO NEW TESTS NEEDED] Signed-off-by: Gerard Braad <me@gbraad.nl>
* | | Merge pull request #15092 from karthikelango137/startFilteropenshift-ci[bot]2022-08-05
|\ \ \ | |/ / |/| | start --filter flag changes
| * | start filter flag changesKarthik Elango2022-08-04
| |/ | | | | | | | | | | Tying filtering logic for podman stop and start to same place in getContainersAndInputByContext() to reduce code redundancy Signed-off-by: Karthik Elango <kelango@redhat.com>
* | pkg/autoupdate: "image" policy: add deprecation commentValentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | The "image" policy has been deprecated in favor of the more precise "registry" policy. Add a code comment to leave some breadcrumbs for future generations. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: decompose the update logicValentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | Decompose the update logic into smaller steps (update check, update, rollback, etc.) and move the implementation into the `task` API. This allows to transition a task from state to state, independent of its underlying auto-update policy. Supporting more than one container per unit is now really close. [NO NEW TESTS NEEDED] - should not change behavior. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: move status into `task`Valentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | | | | | As state should be kept in a single `task`. This will allow for separating updates from rollbacks which will be needed to support multiple containers/tasks in a single unit. [NO NEW TESTS NEEDED] - should not change behavior. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: document fields of `updater`Valentin Rothberg2022-08-04
| | | | | | | | Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: remove image map from updaterValentin Rothberg2022-08-04
| | | | | | | | | | | | | | It is not state needed after assembling the tasks, so remove it to keep the task struct simpler. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: use policy consts were possibleValentin Rothberg2022-08-04
| | | | | | | | Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: introduce status constantsValentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | To replace redundant string scattered across the code with proper constants. The "status" will further be useful in a future change as it can be moved into a `task`. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: move authfile into `tasks`Valentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | | | Will simplify the code and speed up things as we do not consult a container's labels multiple times. [NO NEW TESTS NEEDED] - should not change behavior. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: move more logic under `task`Valentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | | | | | | | This will simplify the logic and pave the way for abstracting the auto-update policies to a certain degree that allows us to better control _when_ the updates and rollbacks happen and will ultimately reduce redundant code. [NO NEW TESTS NEEDED] - should not change behavior. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: s/updateImage/pullImage/Valentin Rothberg2022-08-04
| | | | | | | | | | | | "pull" is more expressive. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: repull image if other containers failedValentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | | | | | | | | | If two containers use the same image and one rolled back (i.e., tagged the old image again), make sure to repull the image for the other container. Once an image has caused a rollback, it may be worth marking this image as broken and not update any other container using it but that is outside of the scope. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: update unit-by-unitValentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | | | | | | | Change the auto-update logic to update unit-by-unit rather by policy. This allows for, in theory now and in practice later, to have mutliple containers run in a single systemd unit and update them in sequence before restarting the unit. [NO NEW TESTS NEEDED] - should not change behavior. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: introduce the notion of a `task`Valentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | | | | | A `task` includes data and state for updating a given container image. It will come in handy in future changes, but we are going there in baby steps to have smaller incremental changes. [NO NEW TESTS NEEDED] - should not change behaviour. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: remove redundant branchValentin Rothberg2022-08-04
| | | | | | | | | | | | [NO NEW TESTS NEEDED] - should not change behavior. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: move policy map into updaterValentin Rothberg2022-08-04
| | | | | | | | | | | | [NO NEW TESTS NEEDED] - should not change behavior. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | pkg/autoupdate: introduce `updater` for shared stateValentin Rothberg2022-08-04
| | | | | | | | | | | | | | | | | | Introduce an `updater` type to allow for sharing state. This will be more useful for future changes. [NO NEW TESTS NEEDED] as it does not change behavior. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | Merge pull request #15158 from cdoern/secretsDaniel J Walsh2022-08-04
|\ \ | | | | | | add omitempty to Secret in k8s VolumeSource
| * | add omitempty to Secret in k8s VolumeSourceCharlie Doern2022-08-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | Secret was populating a generated kube as `null`. Add omitempty so that when the volume source is not a secret, we do not print unnecessary info resolves #15156 Signed-off-by: Charlie Doern <cdoern@redhat.com>
* | | Merge pull request #15068 from n1hility/wsl-as-useropenshift-ci[bot]2022-08-04
|\ \ \ | |/ / |/| | Default to rootless via Windows WSL prompt / Lock to WSL2
| * | Add support, and default to rootless w/WSL promptJason T. Greene2022-08-02
| | | | | | | | | | | | | | | | | | Also force installation to use WSL2 to prevent accidental usage of WSL1 Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
| * | Disable F36 service that is incompat with WSL kernJason T. Greene2022-08-02
| |/ | | | | | | | | | | (requires psi) Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* | Merge pull request #15084 from sstosh/rm-filteropenshift-ci[bot]2022-08-03
|\ \ | | | | | | Add rm --filter option
| * | Add rm --filter optionToshiki Sonoda2022-07-30
| | | | | | | | | | | | | | | | | | --filter : remove the filtered container. Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* | | Merge pull request #15119 from nicrowe00/15071OpenShift Merge Robot2022-08-02
|\ \ \ | | | | | | | | switch from "kube/play" endpoint to "play/kube" endpoint.
| * | | switch from "kube/play" endpoint to "play/kube" endpoint.Niall Crowe2022-08-02
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | When podman kube play was added the endpoint for the kube play/play kube commands was switched from the "play kube" endpoint to the new "kube play" endpoint. This caused issues with the remote client, requiring the need to use the "play kube" endpoint again in order to avoid these issues. Signed-off-by: Niall Crowe <nicrowe@redhat.com>
* / | podman generate systemd --new: allow -h hostnamePaul Holzinger2022-08-02
|/ / | | | | | | | | | | | | | | | | | | podman run/create can accept `-h <hostname>` as argument. When parsing flags -h throws an help requested error from pflag. To prevent this error we have to define the help flag. Fixes #15124 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #15108 from mtrmac/sigstore-signOpenShift Merge Robot2022-08-01
|\ \ | | | | | | Sigstore sign
| * | Add support for creating sigstore signatures, and providing passphrasesMiloslav Trmač2022-07-30
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Allow creating sigstore signatures via --sign-by-sigstore-private-key . Like existing --sign-by, it does not work remote (in this case because we would have to copy the private key to the server). - Allow passing a passphrase (which is mandatory for sigstore private keys) via --sign-passphrase-file; if it is not provided, prompt interactively. - Also, use that passphrase for --sign-by as well, allowing non-interactive GPG use. (But --sign-passphrase-file can only be used with _one of_ --sign-by and --sign-by-sigstore-private-key.) Note that unlike the existing code, (podman build) does not yet implement sigstore (I'm not sure why it needs to, it seems not to push images?) because Buildah does not expose the feature yet. Also, (podman image sign) was not extended to support sigstore. The test for this follows existing (podman image sign) tests and doesn't work rootless; that could be improved by exposing a registries.d override option. The test for push is getting large; I didn't want to start yet another registry container, but that would be an alternative. In the future, Ginkgo's Ordered/BeforeAll would allow starting a registry once and using it for two tests. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-10-06 14:29:49 +0000