2019-01-12 04:58:27 +00:00
|
|
|
/*
|
|
|
|
Copyright 2014 The Kubernetes Authors.
|
|
|
|
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
you may not use this file except in compliance with the License.
|
|
|
|
You may obtain a copy of the License at
|
|
|
|
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
See the License for the specific language governing permissions and
|
|
|
|
limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
package credentialprovider
|
|
|
|
|
|
|
|
import (
|
|
|
|
"net"
|
|
|
|
"net/url"
|
|
|
|
"path/filepath"
|
|
|
|
"sort"
|
|
|
|
"strings"
|
|
|
|
|
2020-08-10 17:43:49 +00:00
|
|
|
"k8s.io/klog/v2"
|
2019-01-12 04:58:27 +00:00
|
|
|
|
|
|
|
"k8s.io/apimachinery/pkg/util/sets"
|
|
|
|
)
|
|
|
|
|
|
|
|
// DockerKeyring tracks a set of docker registry credentials, maintaining a
|
|
|
|
// reverse index across the registry endpoints. A registry endpoint is made
|
|
|
|
// up of a host (e.g. registry.example.com), but it may also contain a path
|
|
|
|
// (e.g. registry.example.com/foo) This index is important for two reasons:
|
|
|
|
// - registry endpoints may overlap, and when this happens we must find the
|
|
|
|
// most specific match for a given image
|
|
|
|
// - iterating a map does not yield predictable results
|
|
|
|
type DockerKeyring interface {
|
2019-09-27 21:51:53 +00:00
|
|
|
Lookup(image string) ([]AuthConfig, bool)
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// BasicDockerKeyring is a trivial map-backed implementation of DockerKeyring
|
|
|
|
type BasicDockerKeyring struct {
|
|
|
|
index []string
|
2019-09-27 21:51:53 +00:00
|
|
|
creds map[string][]AuthConfig
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
|
2019-09-27 21:51:53 +00:00
|
|
|
// providersDockerKeyring is an implementation of DockerKeyring that
|
2019-01-12 04:58:27 +00:00
|
|
|
// materializes its dockercfg based on a set of dockerConfigProviders.
|
2019-09-27 21:51:53 +00:00
|
|
|
type providersDockerKeyring struct {
|
2019-01-12 04:58:27 +00:00
|
|
|
Providers []DockerConfigProvider
|
|
|
|
}
|
|
|
|
|
|
|
|
// AuthConfig contains authorization information for connecting to a Registry
|
|
|
|
// This type mirrors "github.com/docker/docker/api/types.AuthConfig"
|
|
|
|
type AuthConfig struct {
|
|
|
|
Username string `json:"username,omitempty"`
|
|
|
|
Password string `json:"password,omitempty"`
|
|
|
|
Auth string `json:"auth,omitempty"`
|
|
|
|
|
|
|
|
// Email is an optional value associated with the username.
|
|
|
|
// This field is deprecated and will be removed in a later
|
|
|
|
// version of docker.
|
|
|
|
Email string `json:"email,omitempty"`
|
|
|
|
|
|
|
|
ServerAddress string `json:"serveraddress,omitempty"`
|
|
|
|
|
|
|
|
// IdentityToken is used to authenticate the user and get
|
|
|
|
// an access token for the registry.
|
|
|
|
IdentityToken string `json:"identitytoken,omitempty"`
|
|
|
|
|
|
|
|
// RegistryToken is a bearer token to be sent to a registry
|
|
|
|
RegistryToken string `json:"registrytoken,omitempty"`
|
|
|
|
}
|
|
|
|
|
2020-08-10 17:43:49 +00:00
|
|
|
// Add add some docker config in basic docker keyring
|
2019-01-12 04:58:27 +00:00
|
|
|
func (dk *BasicDockerKeyring) Add(cfg DockerConfig) {
|
|
|
|
if dk.index == nil {
|
|
|
|
dk.index = make([]string, 0)
|
2019-09-27 21:51:53 +00:00
|
|
|
dk.creds = make(map[string][]AuthConfig)
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
for loc, ident := range cfg {
|
2019-09-27 21:51:53 +00:00
|
|
|
creds := AuthConfig{
|
|
|
|
Username: ident.Username,
|
|
|
|
Password: ident.Password,
|
|
|
|
Email: ident.Email,
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
value := loc
|
|
|
|
if !strings.HasPrefix(value, "https://") && !strings.HasPrefix(value, "http://") {
|
|
|
|
value = "https://" + value
|
|
|
|
}
|
|
|
|
parsed, err := url.Parse(value)
|
|
|
|
if err != nil {
|
|
|
|
klog.Errorf("Entry %q in dockercfg invalid (%v), ignoring", loc, err)
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// The docker client allows exact matches:
|
|
|
|
// foo.bar.com/namespace
|
|
|
|
// Or hostname matches:
|
|
|
|
// foo.bar.com
|
|
|
|
// It also considers /v2/ and /v1/ equivalent to the hostname
|
|
|
|
// See ResolveAuthConfig in docker/registry/auth.go.
|
|
|
|
effectivePath := parsed.Path
|
|
|
|
if strings.HasPrefix(effectivePath, "/v2/") || strings.HasPrefix(effectivePath, "/v1/") {
|
|
|
|
effectivePath = effectivePath[3:]
|
|
|
|
}
|
|
|
|
var key string
|
|
|
|
if (len(effectivePath) > 0) && (effectivePath != "/") {
|
|
|
|
key = parsed.Host + effectivePath
|
|
|
|
} else {
|
|
|
|
key = parsed.Host
|
|
|
|
}
|
|
|
|
dk.creds[key] = append(dk.creds[key], creds)
|
|
|
|
dk.index = append(dk.index, key)
|
|
|
|
}
|
|
|
|
|
|
|
|
eliminateDupes := sets.NewString(dk.index...)
|
|
|
|
dk.index = eliminateDupes.List()
|
|
|
|
|
|
|
|
// Update the index used to identify which credentials to use for a given
|
|
|
|
// image. The index is reverse-sorted so more specific paths are matched
|
|
|
|
// first. For example, if for the given image "quay.io/coreos/etcd",
|
|
|
|
// credentials for "quay.io/coreos" should match before "quay.io".
|
|
|
|
sort.Sort(sort.Reverse(sort.StringSlice(dk.index)))
|
|
|
|
}
|
|
|
|
|
|
|
|
const (
|
|
|
|
defaultRegistryHost = "index.docker.io"
|
|
|
|
defaultRegistryKey = defaultRegistryHost + "/v1/"
|
|
|
|
)
|
|
|
|
|
|
|
|
// isDefaultRegistryMatch determines whether the given image will
|
|
|
|
// pull from the default registry (DockerHub) based on the
|
|
|
|
// characteristics of its name.
|
|
|
|
func isDefaultRegistryMatch(image string) bool {
|
|
|
|
parts := strings.SplitN(image, "/", 2)
|
|
|
|
|
|
|
|
if len(parts[0]) == 0 {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(parts) == 1 {
|
|
|
|
// e.g. library/ubuntu
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
if parts[0] == "docker.io" || parts[0] == "index.docker.io" {
|
|
|
|
// resolve docker.io/image and index.docker.io/image as default registry
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
// From: http://blog.docker.com/2013/07/how-to-use-your-own-registry/
|
|
|
|
// Docker looks for either a “.” (domain separator) or “:” (port separator)
|
|
|
|
// to learn that the first part of the repository name is a location and not
|
|
|
|
// a user name.
|
|
|
|
return !strings.ContainsAny(parts[0], ".:")
|
|
|
|
}
|
|
|
|
|
|
|
|
// url.Parse require a scheme, but ours don't have schemes. Adding a
|
|
|
|
// scheme to make url.Parse happy, then clear out the resulting scheme.
|
2020-08-10 17:43:49 +00:00
|
|
|
func parseSchemelessURL(schemelessURL string) (*url.URL, error) {
|
|
|
|
parsed, err := url.Parse("https://" + schemelessURL)
|
2019-01-12 04:58:27 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
// clear out the resulting scheme
|
|
|
|
parsed.Scheme = ""
|
|
|
|
return parsed, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// split the host name into parts, as well as the port
|
2020-08-10 17:43:49 +00:00
|
|
|
func splitURL(url *url.URL) (parts []string, port string) {
|
2019-01-12 04:58:27 +00:00
|
|
|
host, port, err := net.SplitHostPort(url.Host)
|
|
|
|
if err != nil {
|
|
|
|
// could not parse port
|
|
|
|
host, port = url.Host, ""
|
|
|
|
}
|
|
|
|
return strings.Split(host, "."), port
|
|
|
|
}
|
|
|
|
|
|
|
|
// overloaded version of urlsMatch, operating on strings instead of URLs.
|
|
|
|
func urlsMatchStr(glob string, target string) (bool, error) {
|
2020-08-10 17:43:49 +00:00
|
|
|
globURL, err := parseSchemelessURL(glob)
|
2019-01-12 04:58:27 +00:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
2020-08-10 17:43:49 +00:00
|
|
|
targetURL, err := parseSchemelessURL(target)
|
2019-01-12 04:58:27 +00:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
2020-08-10 17:43:49 +00:00
|
|
|
return urlsMatch(globURL, targetURL)
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// check whether the given target url matches the glob url, which may have
|
|
|
|
// glob wild cards in the host name.
|
|
|
|
//
|
|
|
|
// Examples:
|
2020-08-10 17:43:49 +00:00
|
|
|
// globURL=*.docker.io, targetURL=blah.docker.io => match
|
|
|
|
// globURL=*.docker.io, targetURL=not.right.io => no match
|
2019-01-12 04:58:27 +00:00
|
|
|
//
|
|
|
|
// Note that we don't support wildcards in ports and paths yet.
|
2020-08-10 17:43:49 +00:00
|
|
|
func urlsMatch(globURL *url.URL, targetURL *url.URL) (bool, error) {
|
|
|
|
globURLParts, globPort := splitURL(globURL)
|
|
|
|
targetURLParts, targetPort := splitURL(targetURL)
|
2019-01-12 04:58:27 +00:00
|
|
|
if globPort != targetPort {
|
|
|
|
// port doesn't match
|
|
|
|
return false, nil
|
|
|
|
}
|
2020-08-10 17:43:49 +00:00
|
|
|
if len(globURLParts) != len(targetURLParts) {
|
2019-01-12 04:58:27 +00:00
|
|
|
// host name does not have the same number of parts
|
|
|
|
return false, nil
|
|
|
|
}
|
2020-08-10 17:43:49 +00:00
|
|
|
if !strings.HasPrefix(targetURL.Path, globURL.Path) {
|
2019-01-12 04:58:27 +00:00
|
|
|
// the path of the credential must be a prefix
|
|
|
|
return false, nil
|
|
|
|
}
|
2020-08-10 17:43:49 +00:00
|
|
|
for k, globURLPart := range globURLParts {
|
|
|
|
targetURLPart := targetURLParts[k]
|
|
|
|
matched, err := filepath.Match(globURLPart, targetURLPart)
|
2019-01-12 04:58:27 +00:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
if !matched {
|
|
|
|
// glob mismatch for some part
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// everything matches
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Lookup implements the DockerKeyring method for fetching credentials based on image name.
|
|
|
|
// Multiple credentials may be returned if there are multiple potentially valid credentials
|
|
|
|
// available. This allows for rotation.
|
2019-09-27 21:51:53 +00:00
|
|
|
func (dk *BasicDockerKeyring) Lookup(image string) ([]AuthConfig, bool) {
|
2019-01-12 04:58:27 +00:00
|
|
|
// range over the index as iterating over a map does not provide a predictable ordering
|
2019-09-27 21:51:53 +00:00
|
|
|
ret := []AuthConfig{}
|
2019-01-12 04:58:27 +00:00
|
|
|
for _, k := range dk.index {
|
|
|
|
// both k and image are schemeless URLs because even though schemes are allowed
|
|
|
|
// in the credential configurations, we remove them in Add.
|
2019-08-19 16:30:36 +00:00
|
|
|
if matched, _ := urlsMatchStr(k, image); matched {
|
|
|
|
ret = append(ret, dk.creds[k]...)
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(ret) > 0 {
|
|
|
|
return ret, true
|
|
|
|
}
|
|
|
|
|
|
|
|
// Use credentials for the default registry if provided, and appropriate
|
|
|
|
if isDefaultRegistryMatch(image) {
|
|
|
|
if auth, ok := dk.creds[defaultRegistryHost]; ok {
|
|
|
|
return auth, true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-09-27 21:51:53 +00:00
|
|
|
return []AuthConfig{}, false
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Lookup implements the DockerKeyring method for fetching credentials
|
|
|
|
// based on image name.
|
2019-09-27 21:51:53 +00:00
|
|
|
func (dk *providersDockerKeyring) Lookup(image string) ([]AuthConfig, bool) {
|
2019-01-12 04:58:27 +00:00
|
|
|
keyring := &BasicDockerKeyring{}
|
|
|
|
|
|
|
|
for _, p := range dk.Providers {
|
2019-08-19 16:30:36 +00:00
|
|
|
keyring.Add(p.Provide(image))
|
2019-01-12 04:58:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return keyring.Lookup(image)
|
|
|
|
}
|
|
|
|
|
2020-08-10 17:43:49 +00:00
|
|
|
// FakeKeyring a fake config credentials
|
2019-01-12 04:58:27 +00:00
|
|
|
type FakeKeyring struct {
|
2019-09-27 21:51:53 +00:00
|
|
|
auth []AuthConfig
|
2019-01-12 04:58:27 +00:00
|
|
|
ok bool
|
|
|
|
}
|
|
|
|
|
2020-08-10 17:43:49 +00:00
|
|
|
// Lookup implements the DockerKeyring method for fetching credentials based on image name
|
|
|
|
// return fake auth and ok
|
2019-09-27 21:51:53 +00:00
|
|
|
func (f *FakeKeyring) Lookup(image string) ([]AuthConfig, bool) {
|
2019-01-12 04:58:27 +00:00
|
|
|
return f.auth, f.ok
|
|
|
|
}
|
|
|
|
|
|
|
|
// UnionDockerKeyring delegates to a set of keyrings.
|
|
|
|
type UnionDockerKeyring []DockerKeyring
|
|
|
|
|
2020-08-10 17:43:49 +00:00
|
|
|
// Lookup implements the DockerKeyring method for fetching credentials based on image name.
|
|
|
|
// return each credentials
|
2019-09-27 21:51:53 +00:00
|
|
|
func (k UnionDockerKeyring) Lookup(image string) ([]AuthConfig, bool) {
|
|
|
|
authConfigs := []AuthConfig{}
|
2019-01-12 04:58:27 +00:00
|
|
|
for _, subKeyring := range k {
|
|
|
|
if subKeyring == nil {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
currAuthResults, _ := subKeyring.Lookup(image)
|
|
|
|
authConfigs = append(authConfigs, currAuthResults...)
|
|
|
|
}
|
|
|
|
|
|
|
|
return authConfigs, (len(authConfigs) > 0)
|
|
|
|
}
|