400 lines
13 KiB
Go
400 lines
13 KiB
Go
package kube
|
|
|
|
import (
|
|
"bytes"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"io/ioutil"
|
|
"net"
|
|
"net/http"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/containers/common/pkg/auth"
|
|
"github.com/containers/common/pkg/completion"
|
|
"github.com/containers/image/v5/types"
|
|
"github.com/containers/podman/v4/cmd/podman/common"
|
|
"github.com/containers/podman/v4/cmd/podman/parse"
|
|
"github.com/containers/podman/v4/cmd/podman/registry"
|
|
"github.com/containers/podman/v4/cmd/podman/utils"
|
|
"github.com/containers/podman/v4/libpod/define"
|
|
"github.com/containers/podman/v4/pkg/domain/entities"
|
|
"github.com/containers/podman/v4/pkg/errorhandling"
|
|
"github.com/containers/podman/v4/pkg/util"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
// playKubeOptionsWrapper allows for separating CLI-only fields from API-only
|
|
// fields.
|
|
type playKubeOptionsWrapper struct {
|
|
entities.PlayKubeOptions
|
|
|
|
TLSVerifyCLI bool
|
|
CredentialsCLI string
|
|
StartCLI bool
|
|
BuildCLI bool
|
|
annotations []string
|
|
macs []string
|
|
}
|
|
|
|
var (
|
|
// https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
|
|
defaultSeccompRoot = "/var/lib/kubelet/seccomp"
|
|
playOptions = playKubeOptionsWrapper{}
|
|
playDescription = `Reads in a structured file of Kubernetes YAML.
|
|
|
|
Creates pods or volumes based on the Kubernetes kind described in the YAML. Supported kinds are Pods, Deployments and PersistentVolumeClaims.`
|
|
|
|
playCmd = &cobra.Command{
|
|
Use: "play [options] KUBEFILE|-",
|
|
Short: "Play a pod or volume based on Kubernetes YAML.",
|
|
Long: playDescription,
|
|
RunE: play,
|
|
Args: cobra.ExactArgs(1),
|
|
ValidArgsFunction: common.AutocompleteDefaultOneArg,
|
|
Example: `podman kube play nginx.yml
|
|
cat nginx.yml | podman kube play -
|
|
podman kube play --creds user:password --seccomp-profile-root /custom/path apache.yml
|
|
podman kube play https://example.com/nginx.yml`,
|
|
}
|
|
)
|
|
|
|
var (
|
|
playKubeCmd = &cobra.Command{
|
|
Use: "kube [options] KUBEFILE|-",
|
|
Short: "Play a pod or volume based on Kubernetes YAML.",
|
|
Long: playDescription,
|
|
Hidden: true,
|
|
RunE: playKube,
|
|
Args: cobra.ExactArgs(1),
|
|
ValidArgsFunction: common.AutocompleteDefaultOneArg,
|
|
Example: `podman play kube nginx.yml
|
|
cat nginx.yml | podman play kube -
|
|
podman play kube --creds user:password --seccomp-profile-root /custom/path apache.yml
|
|
podman play kube https://example.com/nginx.yml`,
|
|
}
|
|
)
|
|
|
|
func init() {
|
|
registry.Commands = append(registry.Commands, registry.CliCommand{
|
|
Command: playCmd,
|
|
Parent: kubeCmd,
|
|
})
|
|
playFlags(playCmd)
|
|
|
|
registry.Commands = append(registry.Commands, registry.CliCommand{
|
|
Command: playKubeCmd,
|
|
Parent: playKubeParentCmd,
|
|
})
|
|
playFlags(playKubeCmd)
|
|
}
|
|
|
|
func playFlags(cmd *cobra.Command) {
|
|
flags := cmd.Flags()
|
|
flags.SetNormalizeFunc(utils.AliasFlags)
|
|
|
|
annotationFlagName := "annotation"
|
|
flags.StringSliceVar(
|
|
&playOptions.annotations,
|
|
annotationFlagName, []string{},
|
|
"Add annotations to pods (key=value)",
|
|
)
|
|
_ = cmd.RegisterFlagCompletionFunc(annotationFlagName, completion.AutocompleteNone)
|
|
credsFlagName := "creds"
|
|
flags.StringVar(&playOptions.CredentialsCLI, credsFlagName, "", "`Credentials` (USERNAME:PASSWORD) to use for authenticating to a registry")
|
|
_ = cmd.RegisterFlagCompletionFunc(credsFlagName, completion.AutocompleteNone)
|
|
|
|
staticMACFlagName := "mac-address"
|
|
flags.StringSliceVar(&playOptions.macs, staticMACFlagName, nil, "Static MAC addresses to assign to the pods")
|
|
_ = cmd.RegisterFlagCompletionFunc(staticMACFlagName, completion.AutocompleteNone)
|
|
|
|
networkFlagName := "network"
|
|
flags.StringArrayVar(&playOptions.Networks, networkFlagName, nil, "Connect pod to network(s) or network mode")
|
|
_ = cmd.RegisterFlagCompletionFunc(networkFlagName, common.AutocompleteNetworkFlag)
|
|
|
|
staticIPFlagName := "ip"
|
|
flags.IPSliceVar(&playOptions.StaticIPs, staticIPFlagName, nil, "Static IP addresses to assign to the pods")
|
|
_ = cmd.RegisterFlagCompletionFunc(staticIPFlagName, completion.AutocompleteNone)
|
|
|
|
logDriverFlagName := "log-driver"
|
|
flags.StringVar(&playOptions.LogDriver, logDriverFlagName, common.LogDriver(), "Logging driver for the container")
|
|
_ = cmd.RegisterFlagCompletionFunc(logDriverFlagName, common.AutocompleteLogDriver)
|
|
|
|
logOptFlagName := "log-opt"
|
|
flags.StringSliceVar(
|
|
&playOptions.LogOptions,
|
|
logOptFlagName, []string{},
|
|
"Logging driver options",
|
|
)
|
|
_ = cmd.RegisterFlagCompletionFunc(logOptFlagName, common.AutocompleteLogOpt)
|
|
|
|
usernsFlagName := "userns"
|
|
flags.StringVar(&playOptions.Userns, usernsFlagName, os.Getenv("PODMAN_USERNS"),
|
|
"User namespace to use",
|
|
)
|
|
_ = cmd.RegisterFlagCompletionFunc(usernsFlagName, common.AutocompleteUserNamespace)
|
|
|
|
flags.BoolVar(&playOptions.NoHosts, "no-hosts", false, "Do not create /etc/hosts within the pod's containers, instead use the version from the image")
|
|
flags.BoolVarP(&playOptions.Quiet, "quiet", "q", false, "Suppress output information when pulling images")
|
|
flags.BoolVar(&playOptions.TLSVerifyCLI, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
|
|
flags.BoolVar(&playOptions.StartCLI, "start", true, "Start the pod after creating it")
|
|
|
|
authfileFlagName := "authfile"
|
|
flags.StringVar(&playOptions.Authfile, authfileFlagName, auth.GetDefaultAuthFile(), "Path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to override")
|
|
_ = cmd.RegisterFlagCompletionFunc(authfileFlagName, completion.AutocompleteDefault)
|
|
|
|
downFlagName := "down"
|
|
flags.BoolVar(&playOptions.Down, downFlagName, false, "Stop pods defined in the YAML file")
|
|
_ = flags.MarkHidden("down")
|
|
|
|
replaceFlagName := "replace"
|
|
flags.BoolVar(&playOptions.Replace, replaceFlagName, false, "Delete and recreate pods defined in the YAML file")
|
|
|
|
if !registry.IsRemote() {
|
|
certDirFlagName := "cert-dir"
|
|
flags.StringVar(&playOptions.CertDir, certDirFlagName, "", "`Pathname` of a directory containing TLS certificates and keys")
|
|
_ = cmd.RegisterFlagCompletionFunc(certDirFlagName, completion.AutocompleteDefault)
|
|
|
|
seccompProfileRootFlagName := "seccomp-profile-root"
|
|
flags.StringVar(&playOptions.SeccompProfileRoot, seccompProfileRootFlagName, defaultSeccompRoot, "Directory path for seccomp profiles")
|
|
_ = cmd.RegisterFlagCompletionFunc(seccompProfileRootFlagName, completion.AutocompleteDefault)
|
|
|
|
configmapFlagName := "configmap"
|
|
flags.StringSliceVar(&playOptions.ConfigMaps, configmapFlagName, []string{}, "`Pathname` of a YAML file containing a kubernetes configmap")
|
|
_ = cmd.RegisterFlagCompletionFunc(configmapFlagName, completion.AutocompleteDefault)
|
|
|
|
buildFlagName := "build"
|
|
flags.BoolVar(&playOptions.BuildCLI, buildFlagName, false, "Build all images in a YAML (given Containerfiles exist)")
|
|
|
|
contextDirFlagName := "context-dir"
|
|
flags.StringVar(&playOptions.ContextDir, contextDirFlagName, "", "Path to top level of context directory")
|
|
_ = cmd.RegisterFlagCompletionFunc(contextDirFlagName, completion.AutocompleteDefault)
|
|
|
|
// NOTE: The service-container flag is marked as hidden as it
|
|
// is purely designed for running kube-play or play-kube in systemd units.
|
|
// It is not something users should need to know or care about.
|
|
//
|
|
// Having a flag rather than an env variable is cleaner.
|
|
serviceFlagName := "service-container"
|
|
flags.BoolVar(&playOptions.ServiceContainer, serviceFlagName, false, "Starts a service container before all pods")
|
|
_ = flags.MarkHidden("service-container")
|
|
|
|
flags.StringVar(&playOptions.SignaturePolicy, "signature-policy", "", "`Pathname` of signature policy file (not usually used)")
|
|
|
|
_ = flags.MarkHidden("signature-policy")
|
|
}
|
|
}
|
|
|
|
func play(cmd *cobra.Command, args []string) error {
|
|
if playOptions.ServiceContainer && !playOptions.StartCLI { // Sanity check to be future proof
|
|
return fmt.Errorf("--service-container does not work with --start=stop")
|
|
}
|
|
// TLS verification in c/image is controlled via a `types.OptionalBool`
|
|
// which allows for distinguishing among set-true, set-false, unspecified
|
|
// which is important to implement a sane way of dealing with defaults of
|
|
// boolean CLI flags.
|
|
if cmd.Flags().Changed("tls-verify") {
|
|
playOptions.SkipTLSVerify = types.NewOptionalBool(!playOptions.TLSVerifyCLI)
|
|
}
|
|
if cmd.Flags().Changed("start") {
|
|
playOptions.Start = types.NewOptionalBool(playOptions.StartCLI)
|
|
}
|
|
if cmd.Flags().Changed("build") {
|
|
playOptions.Build = types.NewOptionalBool(playOptions.BuildCLI)
|
|
}
|
|
if playOptions.Authfile != "" {
|
|
if _, err := os.Stat(playOptions.Authfile); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if playOptions.ContextDir != "" && playOptions.Build != types.OptionalBoolTrue {
|
|
return errors.New("--build must be specified when using --context-dir option")
|
|
}
|
|
if playOptions.CredentialsCLI != "" {
|
|
creds, err := util.ParseRegistryCreds(playOptions.CredentialsCLI)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
playOptions.Username = creds.Username
|
|
playOptions.Password = creds.Password
|
|
}
|
|
|
|
for _, annotation := range playOptions.annotations {
|
|
splitN := strings.SplitN(annotation, "=", 2)
|
|
if len(splitN) > 2 {
|
|
return fmt.Errorf("annotation %q must include an '=' sign", annotation)
|
|
}
|
|
if playOptions.Annotations == nil {
|
|
playOptions.Annotations = make(map[string]string)
|
|
}
|
|
annotation := splitN[1]
|
|
if len(annotation) > define.MaxKubeAnnotation {
|
|
return fmt.Errorf("annotation exceeds maximum size, %d, of kubernetes annotation: %s", define.MaxKubeAnnotation, annotation)
|
|
}
|
|
playOptions.Annotations[splitN[0]] = annotation
|
|
}
|
|
|
|
for _, mac := range playOptions.macs {
|
|
m, err := net.ParseMAC(mac)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
playOptions.StaticMACs = append(playOptions.StaticMACs, m)
|
|
}
|
|
|
|
reader, err := readerFromArg(args[0])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if playOptions.Down {
|
|
return teardown(reader)
|
|
}
|
|
|
|
if playOptions.Replace {
|
|
if err := teardown(reader); err != nil && !errorhandling.Contains(err, define.ErrNoSuchPod) {
|
|
return err
|
|
}
|
|
if _, err := reader.Seek(0, 0); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
return kubeplay(reader)
|
|
}
|
|
|
|
func playKube(cmd *cobra.Command, args []string) error {
|
|
return play(cmd, args)
|
|
}
|
|
|
|
func readerFromArg(fileName string) (*bytes.Reader, error) {
|
|
errURL := parse.ValidURL(fileName)
|
|
if fileName == "-" { // Read from stdin
|
|
data, err := io.ReadAll(os.Stdin)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return bytes.NewReader(data), nil
|
|
}
|
|
if errURL == nil {
|
|
response, err := http.Get(fileName)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer response.Body.Close()
|
|
|
|
data, err := ioutil.ReadAll(response.Body)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return bytes.NewReader(data), nil
|
|
}
|
|
f, err := os.Open(fileName)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer f.Close()
|
|
|
|
data, err := io.ReadAll(f)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return bytes.NewReader(data), nil
|
|
}
|
|
|
|
func teardown(body io.Reader) error {
|
|
var (
|
|
podStopErrors utils.OutputErrors
|
|
podRmErrors utils.OutputErrors
|
|
)
|
|
options := new(entities.PlayKubeDownOptions)
|
|
reports, err := registry.ContainerEngine().PlayKubeDown(registry.GetContext(), body, *options)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Output stopped pods
|
|
fmt.Println("Pods stopped:")
|
|
for _, stopped := range reports.StopReport {
|
|
if len(stopped.Errs) == 0 {
|
|
fmt.Println(stopped.Id)
|
|
} else {
|
|
podStopErrors = append(podStopErrors, stopped.Errs...)
|
|
}
|
|
}
|
|
// Dump any stop errors
|
|
lastStopError := podStopErrors.PrintErrors()
|
|
if lastStopError != nil {
|
|
fmt.Fprintf(os.Stderr, "Error: %s\n", lastStopError)
|
|
}
|
|
|
|
// Output rm'd pods
|
|
fmt.Println("Pods removed:")
|
|
for _, removed := range reports.RmReport {
|
|
if removed.Err == nil {
|
|
fmt.Println(removed.Id)
|
|
} else {
|
|
podRmErrors = append(podRmErrors, removed.Err)
|
|
}
|
|
}
|
|
|
|
return podRmErrors.PrintErrors()
|
|
}
|
|
|
|
func kubeplay(body io.Reader) error {
|
|
report, err := registry.ContainerEngine().PlayKube(registry.GetContext(), body, playOptions.PlayKubeOptions)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// Print volumes report
|
|
for i, volume := range report.Volumes {
|
|
if i == 0 {
|
|
fmt.Println("Volumes:")
|
|
}
|
|
fmt.Println(volume.Name)
|
|
}
|
|
|
|
// Print pods report
|
|
for _, pod := range report.Pods {
|
|
for _, l := range pod.Logs {
|
|
fmt.Fprint(os.Stderr, l)
|
|
}
|
|
}
|
|
|
|
ctrsFailed := 0
|
|
|
|
for _, pod := range report.Pods {
|
|
fmt.Println("Pod:")
|
|
fmt.Println(pod.ID)
|
|
|
|
switch len(pod.Containers) {
|
|
case 0:
|
|
continue
|
|
case 1:
|
|
fmt.Println("Container:")
|
|
default:
|
|
fmt.Println("Containers:")
|
|
}
|
|
for _, ctr := range pod.Containers {
|
|
fmt.Println(ctr)
|
|
}
|
|
ctrsFailed += len(pod.ContainerErrors)
|
|
// If We have errors, add a newline
|
|
if len(pod.ContainerErrors) > 0 {
|
|
fmt.Println()
|
|
}
|
|
for _, err := range pod.ContainerErrors {
|
|
fmt.Fprintln(os.Stderr, err)
|
|
}
|
|
// Empty line for space for next block
|
|
fmt.Println()
|
|
}
|
|
|
|
if ctrsFailed > 0 {
|
|
return fmt.Errorf("failed to start %d containers", ctrsFailed)
|
|
}
|
|
|
|
return nil
|
|
}
|