From dc80267b594e41cf7e223821dc1446683f0cae36 Mon Sep 17 00:00:00 2001 From: Valentin Rothberg Date: Wed, 13 May 2020 13:44:29 +0200 Subject: compat handlers: add X-Registry-Auth header support * Support the `X-Registry-Auth` http-request header. * The content of the header is a base64 encoded JSON payload which can either be a single auth config or a map of auth configs (user+pw or token) with the corresponding registries being the keys. Vanilla Docker, projectatomic Docker and the bindings are transparantly supported. * Add a hidden `--registries-conf` flag. Buildah exposes the same flag, mostly for testing purposes. * Do all credential parsing in the client (i.e., `cmd/podman`) pass the username and password in the backend instead of unparsed credentials. * Add a `pkg/auth` which handles most of the heavy lifting. * Go through the authentication-handling code of most commands, bindings and endpoints. Migrate them to the new code and fix issues as seen. A final evaluation and more tests is still required *after* this change. * The manifest-push endpoint is missing certain parameters and should use the ABI function instead. Adding auth-support isn't really possible without these parts working. * The container commands and endpoints (i.e., create and run) have not been changed yet. The APIs don't yet account for the authfile. * Add authentication tests to `pkg/bindings`. Fixes: #6384 Signed-off-by: Valentin Rothberg --- cmd/podman/images/pull.go | 14 ++++++++++++-- cmd/podman/images/push.go | 15 +++++++++++++-- cmd/podman/manifest/push.go | 38 ++++++++++++++++++++++++++++++++------ cmd/podman/play/kube.go | 14 ++++++++++++-- cmd/podman/root.go | 2 ++ 5 files changed, 71 insertions(+), 12 deletions(-) (limited to 'cmd/podman') diff --git a/cmd/podman/images/pull.go b/cmd/podman/images/pull.go index 7bb4f6d37..9e137b5d6 100644 --- a/cmd/podman/images/pull.go +++ b/cmd/podman/images/pull.go @@ -8,6 +8,7 @@ import ( "github.com/containers/image/v5/types" "github.com/containers/libpod/cmd/podman/registry" "github.com/containers/libpod/pkg/domain/entities" + "github.com/containers/libpod/pkg/util" "github.com/pkg/errors" "github.com/spf13/cobra" "github.com/spf13/pflag" @@ -17,7 +18,8 @@ import ( // CLI-only fields into the API types. type pullOptionsWrapper struct { entities.ImagePullOptions - TLSVerifyCLI bool // CLI only + TLSVerifyCLI bool // CLI only + CredentialsCLI string } var ( @@ -77,7 +79,7 @@ func pullFlags(flags *pflag.FlagSet) { flags.BoolVar(&pullOptions.AllTags, "all-tags", false, "All tagged images in the repository will be pulled") flags.StringVar(&pullOptions.Authfile, "authfile", auth.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override") flags.StringVar(&pullOptions.CertDir, "cert-dir", "", "`Pathname` of a directory containing TLS certificates and keys") - flags.StringVar(&pullOptions.Credentials, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry") + flags.StringVar(&pullOptions.CredentialsCLI, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry") flags.StringVar(&pullOptions.OverrideArch, "override-arch", "", "Use `ARCH` instead of the architecture of the machine for choosing images") flags.StringVar(&pullOptions.OverrideOS, "override-os", "", "Use `OS` instead of the running OS for choosing images") flags.BoolVarP(&pullOptions.Quiet, "quiet", "q", false, "Suppress output information when pulling images") @@ -107,6 +109,14 @@ func imagePull(cmd *cobra.Command, args []string) error { } } + if pullOptions.CredentialsCLI != "" { + creds, err := util.ParseRegistryCreds(pullOptions.CredentialsCLI) + if err != nil { + return err + } + pullOptions.Username = creds.Username + pullOptions.Password = creds.Password + } // Let's do all the remaining Yoga in the API to prevent us from // scattering logic across (too) many parts of the code. pullReport, err := registry.ImageEngine().Pull(registry.GetContext(), args[0], pullOptions.ImagePullOptions) diff --git a/cmd/podman/images/push.go b/cmd/podman/images/push.go index 35a6254de..a1614dc7a 100644 --- a/cmd/podman/images/push.go +++ b/cmd/podman/images/push.go @@ -7,6 +7,7 @@ import ( "github.com/containers/image/v5/types" "github.com/containers/libpod/cmd/podman/registry" "github.com/containers/libpod/pkg/domain/entities" + "github.com/containers/libpod/pkg/util" "github.com/pkg/errors" "github.com/spf13/cobra" "github.com/spf13/pflag" @@ -16,7 +17,8 @@ import ( // CLI-only fields into the API types. type pushOptionsWrapper struct { entities.ImagePushOptions - TLSVerifyCLI bool // CLI only + TLSVerifyCLI bool // CLI only + CredentialsCLI string } var ( @@ -73,7 +75,7 @@ func pushFlags(flags *pflag.FlagSet) { flags.StringVar(&pushOptions.Authfile, "authfile", auth.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override") flags.StringVar(&pushOptions.CertDir, "cert-dir", "", "Path to a directory containing TLS certificates and keys") flags.BoolVar(&pushOptions.Compress, "compress", false, "Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type as source)") - flags.StringVar(&pushOptions.Credentials, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry") + flags.StringVar(&pushOptions.CredentialsCLI, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry") flags.StringVar(&pushOptions.DigestFile, "digestfile", "", "Write the digest of the pushed image to the specified file") flags.StringVarP(&pushOptions.Format, "format", "f", "", "Manifest type (oci, v2s1, or v2s2) to use when pushing an image using the 'dir' transport (default is manifest type of source)") flags.BoolVarP(&pushOptions.Quiet, "quiet", "q", false, "Suppress output information when pushing images") @@ -122,6 +124,15 @@ func imagePush(cmd *cobra.Command, args []string) error { } } + if pushOptions.CredentialsCLI != "" { + creds, err := util.ParseRegistryCreds(pushOptions.CredentialsCLI) + if err != nil { + return err + } + pushOptions.Username = creds.Username + pushOptions.Password = creds.Password + } + // Let's do all the remaining Yoga in the API to prevent us from scattering // logic across (too) many parts of the code. return registry.ImageEngine().Push(registry.GetContext(), source, destination, pushOptions.ImagePushOptions) diff --git a/cmd/podman/manifest/push.go b/cmd/podman/manifest/push.go index 49c76f40b..a2e68aff1 100644 --- a/cmd/podman/manifest/push.go +++ b/cmd/podman/manifest/push.go @@ -1,17 +1,26 @@ package manifest import ( - "context" - "github.com/containers/common/pkg/auth" + "github.com/containers/image/v5/types" "github.com/containers/libpod/cmd/podman/registry" "github.com/containers/libpod/pkg/domain/entities" + "github.com/containers/libpod/pkg/util" "github.com/pkg/errors" "github.com/spf13/cobra" ) +// manifestPushOptsWrapper wraps entities.ManifestPushOptions and prevents leaking +// CLI-only fields into the API types. +type manifestPushOptsWrapper struct { + entities.ManifestPushOptions + + TLSVerifyCLI bool // CLI only + CredentialsCLI string +} + var ( - manifestPushOpts = entities.ManifestPushOptions{} + manifestPushOpts = manifestPushOptsWrapper{} pushCmd = &cobra.Command{ Use: "push [flags] SOURCE DESTINATION", Short: "Push a manifest list or image index to a registry", @@ -33,12 +42,12 @@ func init() { flags.BoolVar(&manifestPushOpts.All, "all", false, "also push the images in the list") flags.StringVar(&manifestPushOpts.Authfile, "authfile", auth.GetDefaultAuthFile(), "path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override") flags.StringVar(&manifestPushOpts.CertDir, "cert-dir", "", "use certificates at the specified path to access the registry") - flags.StringVar(&manifestPushOpts.Creds, "creds", "", "use `[username[:password]]` for accessing the registry") + flags.StringVar(&manifestPushOpts.CredentialsCLI, "creds", "", "use `[username[:password]]` for accessing the registry") flags.StringVar(&manifestPushOpts.DigestFile, "digestfile", "", "after copying the image, write the digest of the resulting digest to the file") flags.StringVarP(&manifestPushOpts.Format, "format", "f", "", "manifest type (oci or v2s2) to attempt to use when pushing the manifest list (default is manifest type of source)") flags.BoolVarP(&manifestPushOpts.RemoveSignatures, "remove-signatures", "", false, "don't copy signatures when pushing images") flags.StringVar(&manifestPushOpts.SignBy, "sign-by", "", "sign the image using a GPG key with the specified `FINGERPRINT`") - flags.BoolVar(&manifestPushOpts.TlsVerify, "tls-verify", true, "require HTTPS and verify certificates when accessing the registry") + flags.BoolVar(&manifestPushOpts.TLSVerifyCLI, "tls-verify", true, "require HTTPS and verify certificates when accessing the registry") flags.BoolVarP(&manifestPushOpts.Quiet, "quiet", "q", false, "don't output progress information when pushing lists") if registry.IsRemote() { _ = flags.MarkHidden("authfile") @@ -59,7 +68,24 @@ func push(cmd *cobra.Command, args []string) error { if destSpec == "" { return errors.Errorf(`invalid destination "%s"`, destSpec) } - if err := registry.ImageEngine().ManifestPush(context.Background(), args, manifestPushOpts); err != nil { + + if manifestPushOpts.CredentialsCLI != "" { + creds, err := util.ParseRegistryCreds(manifestPushOpts.CredentialsCLI) + if err != nil { + return err + } + manifestPushOpts.Username = creds.Username + manifestPushOpts.Password = creds.Password + } + + // TLS verification in c/image is controlled via a `types.OptionalBool` + // which allows for distinguishing among set-true, set-false, unspecified + // which is important to implement a sane way of dealing with defaults of + // boolean CLI flags. + if cmd.Flags().Changed("tls-verify") { + manifestPushOpts.SkipTLSVerify = types.NewOptionalBool(!manifestPushOpts.TLSVerifyCLI) + } + if err := registry.ImageEngine().ManifestPush(registry.Context(), args, manifestPushOpts.ManifestPushOptions); err != nil { return errors.Wrapf(err, "error pushing manifest %s to %s", listImageSpec, destSpec) } return nil diff --git a/cmd/podman/play/kube.go b/cmd/podman/play/kube.go index 5703cd314..1fbf24d5e 100644 --- a/cmd/podman/play/kube.go +++ b/cmd/podman/play/kube.go @@ -9,6 +9,7 @@ import ( "github.com/containers/libpod/cmd/podman/registry" "github.com/containers/libpod/cmd/podman/utils" "github.com/containers/libpod/pkg/domain/entities" + "github.com/containers/libpod/pkg/util" "github.com/pkg/errors" "github.com/spf13/cobra" ) @@ -18,7 +19,8 @@ import ( type playKubeOptionsWrapper struct { entities.PlayKubeOptions - TLSVerifyCLI bool + TLSVerifyCLI bool + CredentialsCLI string } var ( @@ -49,7 +51,7 @@ func init() { flags := kubeCmd.Flags() flags.SetNormalizeFunc(utils.AliasFlags) - flags.StringVar(&kubeOptions.Credentials, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry") + flags.StringVar(&kubeOptions.CredentialsCLI, "creds", "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry") flags.StringVar(&kubeOptions.Network, "network", "", "Connect pod to CNI network(s)") flags.BoolVarP(&kubeOptions.Quiet, "quiet", "q", false, "Suppress output information when pulling images") if !registry.IsRemote() { @@ -76,6 +78,14 @@ func kube(cmd *cobra.Command, args []string) error { return errors.Wrapf(err, "error getting authfile %s", kubeOptions.Authfile) } } + if kubeOptions.CredentialsCLI != "" { + creds, err := util.ParseRegistryCreds(kubeOptions.CredentialsCLI) + if err != nil { + return err + } + kubeOptions.Username = creds.Username + kubeOptions.Password = creds.Password + } report, err := registry.ContainerEngine().PlayKube(registry.GetContext(), args[0], kubeOptions.PlayKubeOptions) if err != nil { diff --git a/cmd/podman/root.go b/cmd/podman/root.go index dffd9b534..3796b8e27 100644 --- a/cmd/podman/root.go +++ b/cmd/podman/root.go @@ -206,6 +206,7 @@ func rootFlags(opts *entities.PodmanConfig, flags *pflag.FlagSet) { flags.IntVar(&opts.MaxWorks, "max-workers", 0, "The maximum number of workers for parallel operations") flags.StringVar(&cfg.Engine.Namespace, "namespace", cfg.Engine.Namespace, "Set the libpod namespace, used to create separate views of the containers and pods on the system") flags.StringVar(&cfg.Engine.StaticDir, "root", "", "Path to the root directory in which data, including images, is stored") + flags.StringVar(&opts.RegistriesConf, "registries-conf", "", "Path to a registries.conf to use for image processing") flags.StringVar(&opts.Runroot, "runroot", "", "Path to the 'run directory' where all state information is stored") flags.StringVar(&opts.RuntimePath, "runtime", "", "Path to the OCI-compatible binary used to run containers, default is /usr/bin/runc") // -s is deprecated due to conflict with -s on subcommands @@ -225,6 +226,7 @@ func rootFlags(opts *entities.PodmanConfig, flags *pflag.FlagSet) { "cpu-profile", "default-mounts-file", "max-workers", + "registries-conf", "trace", } { if err := flags.MarkHidden(f); err != nil { -- cgit v1.2.3-54-g00ecf