Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mount all ServiceAccount imagePullSecrets to allow builds to read the run image #865

Merged
merged 5 commits into from
Oct 22, 2021
+786 −533
Merged

Mount all ServiceAccount imagePullSecrets to allow builds to read the run image #865

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
726d569
Consolidate arguments to BuildPod into singular BuildContext
matthewmcnew Oct 20, 2021
56f3e9b
Mount all ServiceAccount imagePullSecrets to allow builds to read the…
matthewmcnew Oct 21, 2021
f13cc2d
Use descriptive name for secrets used to pull registry source images
matthewmcnew Oct 21, 2021
4aba25f
Simplify the construction of the completion container
matthewmcnew Oct 22, 2021
d2816c9
Deduplicate builder imagePullSecrets from serviceAccountImagePullSecrets
matthewmcnew Oct 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 27 additions & 22 deletions cmd/build-init/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ var (
dockerCredentials flaghelpers.CredentialsFlags
dockerCfgCredentials flaghelpers.CredentialsFlags
dockerConfigCredentials flaghelpers.CredentialsFlags
imagePullSecrets flaghelpers.CredentialsFlags
)

func init() {
Expand All @@ -51,18 +52,18 @@ func init() {
flag.Var(&dockerCredentials, "basic-docker", "Basic authentication for docker of the form 'secretname=git.domain.com'")
flag.Var(&dockerCfgCredentials, "dockercfg", "Docker Cfg credentials in the form of the path to the credential")
flag.Var(&dockerConfigCredentials, "dockerconfig", "Docker Config JSON credentials in the form of the path to the credential")
flag.Var(&imagePullSecrets, "imagepull", "Builder Image pull credentials in the form of the path to the credential")
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this appears to be a filename instead of the full path to the credential

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is equivalent to the other path to credentials like dockercfg or dockerconfig and will attempt to read either a .dockerconfigjson or a .dockercfg file.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe we should add to each then that it is the path inside the build-secrets dir

Copy link
Collaborator

@tomkennedy513 tomkennedy513 Oct 21, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not a big deal it just tripped me up for a second when i was looking at build_pod.go and saw we only passed in the name

Copy link
Collaborator Author

@matthewmcnew matthewmcnew Oct 21, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe we should add to each then that it is the path inside the build-secrets dir

Add what to each?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

update each description to be something like "..in the form of the path to the credential in the /var/build-secrets directory"

}

const (
secretsHome = "/builder/home"
appDir = "/workspace"
platformDir = "/platform"
buildSecretsDir = "/var/build-secrets"
imagePullSecretsDir = "/imagePullSecrets"
builderPullSecretsDir = "/builderPullSecrets"
projectMetadataDir = "/projectMetadata"
networkWaitLauncherDir = "/networkWait"
networkWaitLauncherBinary = "network-wait-launcher.exe"
secretsHome = "/builder/home"
appDir = "/workspace"
platformDir = "/platform"
buildSecretsDir = "/var/build-secrets"
registrySourcePullSecretsDir = "/registrySourcePullSecrets"
projectMetadataDir = "/projectMetadata"
networkWaitLauncherDir = "/networkWait"
networkWaitLauncherBinary = "network-wait-launcher.exe"
)

func main() {
Expand Down Expand Up @@ -108,6 +109,20 @@ func main() {
logger.Fatal(errors.Wrapf(err, "Error verifying write access to %q", *imageTag))
}

for _, c := range imagePullSecrets {
credPath := filepath.Join(buildSecretsDir, c)

imagePullCreds, err := dockercreds.ParseDockerPullSecrets(credPath)
if err != nil {
logger.Fatal(err)
}

creds, err = creds.Append(imagePullCreds)
if err != nil {
logger.Fatalf("error appending image pull creds %s", err)
}
}

err = dockercreds.VerifyReadAccess(creds, *runImage)
if err != nil {
logger.Fatal(errors.Wrapf(err, "Error verifying read access to run image %q", *runImage))
Expand All @@ -128,17 +143,7 @@ func main() {
logger.Fatalf("error setting up platform env vars %s", err)
}

builderCreds, err := dockercreds.ParseDockerPullSecrets(builderPullSecretsDir)
if err != nil {
logger.Fatal(err)
}

dockerCreds, err := creds.Append(builderCreds)
if err != nil {
logger.Fatalf("error appending builder creds %s", err)
}

err = dockerCreds.Save(path.Join(secretsHome, ".docker", "config.json"))
err = creds.Save(path.Join(secretsHome, ".docker", "config.json"))
if err != nil {
logger.Fatalf("error writing docker creds %s", err)
}
Expand Down Expand Up @@ -185,15 +190,15 @@ func fetchSource(logger *log.Logger, serviceAccountCreds dockercreds.DockerCreds
}
return fetcher.Fetch(appDir, *blobURL)
case *registryImage != "":
imagePullSecrets, err := dockercreds.ParseDockerPullSecrets(imagePullSecretsDir)
registrySourcePullSecrets, err := dockercreds.ParseDockerPullSecrets(registrySourcePullSecretsDir)
if err != nil {
return err
}

fetcher := registry.Fetcher{
Logger: logger,
Client: &registry.Client{},
Keychain: authn.NewMultiKeychain(imagePullSecrets, serviceAccountCreds),
Keychain: authn.NewMultiKeychain(registrySourcePullSecrets, serviceAccountCreds),
}
return fetcher.Fetch(appDir, *registryImage)
default:
Expand Down
5 changes: 5 additions & 0 deletions cmd/completion/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ var (
cosignAnnotations flaghelpers.CredentialsFlags
cosignRepositories flaghelpers.CredentialsFlags
cosignDockerMediaTypes flaghelpers.CredentialsFlags
basicGitCredentials flaghelpers.CredentialsFlags
sshGitCredentials flaghelpers.CredentialsFlags
logger *log.Logger
)

Expand All @@ -42,6 +44,9 @@ func init() {
flag.Var(&dockerCredentials, "basic-docker", "Basic authentication for docker of the form 'secretname=git.domain.com'")
flag.Var(&dockerCfgCredentials, "dockercfg", "Docker Cfg credentials in the form of the path to the credential")
flag.Var(&dockerConfigCredentials, "dockerconfig", "Docker Config JSON credentials in the form of the path to the credential")
flag.Var(&basicGitCredentials, "basic-git", "Basic authentication for git of the form 'secretname=git.domain.com'")
flag.Var(&sshGitCredentials, "ssh-git", "SSH authentication for git of the form 'secretname=git.domain.com'")

flag.Var(&cosignAnnotations, "cosign-annotations", "Cosign custom signing annotations")
flag.Var(&cosignRepositories, "cosign-repositories", "Cosign signing repository of the form 'secretname=registry.example.com/project'")
flag.Var(&cosignDockerMediaTypes, "cosign-docker-media-types", "Cosign signing with legacy docker media types of the form 'secretname=1'")
Expand Down
12 changes: 11 additions & 1 deletion cmd/rebase/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,14 @@ var (
dockerCredentials flaghelpers.CredentialsFlags
dockerCfgCredentials flaghelpers.CredentialsFlags
dockerConfigCredentials flaghelpers.CredentialsFlags
imagePullSecrets flaghelpers.CredentialsFlags
)

func init() {
flag.Var(&dockerCredentials, "basic-docker", "Basic authentication for docker of the form 'secretname=git.domain.com'")
flag.Var(&dockerCfgCredentials, "dockercfg", "Docker Cfg credentials in the form of the path to the credential")
flag.Var(&dockerConfigCredentials, "dockerconfig", "Docker Config JSON credentials in the form of the path to the credential")
flag.Var(&imagePullSecrets, "imagepull", "Builder Image pull credentials in the form of the path to the credential")
}

func main() {
Expand All @@ -62,7 +64,7 @@ func rebase(tags []string, logger *log.Logger) error {
return cmd.FailErrCode(err, cmd.CodeInvalidArgs)
}

for _, c := range append(dockerCfgCredentials, dockerConfigCredentials...) {
for _, c := range combine(dockerCfgCredentials, dockerConfigCredentials, imagePullSecrets) {
credPath := filepath.Join(buildSecretsDir, c)

dockerCfgCreds, err := dockercreds.ParseDockerPullSecrets(credPath)
Expand Down Expand Up @@ -118,3 +120,11 @@ func rebase(tags []string, logger *log.Logger) error {

return ioutil.WriteFile(*reportFilePath, buf.Bytes(), 0777)
}

func combine(credentials ...[]string) []string {
var combinded []string
for _, creds := range credentials {
combinded = append(combinded, creds...)
}
return combinded
}
Loading