Moving XFN as is, just renamed and added ci/scripts
Signed-off-by: Philippe Scorsolini <p.scorsolini@gmail.com>
This commit is contained in:
Philippe Scorsolini
parent
3e5580d2b5
commit
0895101d8e
|
|
@ -0,0 +1,102 @@
|
||||||
|
{
|
||||||
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||||
|
"extends": [
|
||||||
|
"config:base",
|
||||||
|
"helpers:pinGitHubActionDigests"
|
||||||
|
],
|
||||||
|
// We only want renovate to rebase PRs when they have conflicts,
|
||||||
|
// default "auto" mode is not required.
|
||||||
|
"rebaseWhen": "conflicted",
|
||||||
|
// The maximum number of PRs to be created in parallel
|
||||||
|
"prConcurrentLimit": 5,
|
||||||
|
// The branches renovate should target
|
||||||
|
// PLEASE UPDATE THIS WHEN RELEASING.
|
||||||
|
"baseBranches": ["main"],
|
||||||
|
"ignorePaths": ["design/**"],
|
||||||
|
"postUpdateOptions": ["gomodTidy"],
|
||||||
|
// By default renovate will auto detect whether semantic commits have been used
|
||||||
|
// in the recent history and comply with that, we explicitly disable it
|
||||||
|
"semanticCommits": "disabled",
|
||||||
|
// All PRs should have a label
|
||||||
|
"labels": ["automated"],
|
||||||
|
"regexManagers": [
|
||||||
|
{
|
||||||
|
"description": "Bump Go version used in workflows",
|
||||||
|
"fileMatch": ["^\\.github\\/workflows\\/[^/]+\\.ya?ml$"],
|
||||||
|
"matchStrings": [
|
||||||
|
"GO_VERSION: '(?<currentValue>.*?)'\\n"
|
||||||
|
],
|
||||||
|
"datasourceTemplate": "golang-version",
|
||||||
|
"depNameTemplate": "golang"
|
||||||
|
}, {
|
||||||
|
"description": "Bump golangci-lint version in workflows and the Makefile",
|
||||||
|
"fileMatch": ["^\\.github\\/workflows\\/[^/]+\\.ya?ml$","^Makefile$"],
|
||||||
|
"matchStrings": [
|
||||||
|
"GOLANGCI_VERSION: 'v(?<currentValue>.*?)'\\n",
|
||||||
|
"GOLANGCILINT_VERSION = (?<currentValue>.*?)\\n"
|
||||||
|
],
|
||||||
|
"datasourceTemplate": "github-tags",
|
||||||
|
"depNameTemplate": "golangci/golangci-lint",
|
||||||
|
"extractVersionTemplate": "^v(?<version>.*)$"
|
||||||
|
}, {
|
||||||
|
"description": "Bump helm version in the Makefile",
|
||||||
|
"fileMatch": ["^Makefile$"],
|
||||||
|
"matchStrings": [
|
||||||
|
"HELM3_VERSION = (?<currentValue>.*?)\\n"
|
||||||
|
],
|
||||||
|
"datasourceTemplate": "github-tags",
|
||||||
|
"depNameTemplate": "helm/helm",
|
||||||
|
}, {
|
||||||
|
"description": "Bump kind version in the Makefile",
|
||||||
|
"fileMatch": ["^Makefile$"],
|
||||||
|
"matchStrings": [
|
||||||
|
"KIND_VERSION = (?<currentValue>.*?)\\n"
|
||||||
|
],
|
||||||
|
"datasourceTemplate": "github-tags",
|
||||||
|
"depNameTemplate": "kubernetes-sigs/kind",
|
||||||
|
}
|
||||||
|
],
|
||||||
|
// PackageRules disabled below should be enabled in case of vulnerabilities
|
||||||
|
"vulnerabilityAlerts": {
|
||||||
|
"enabled": true
|
||||||
|
},
|
||||||
|
"osvVulnerabilityAlerts": true,
|
||||||
|
// Renovate evaluates all packageRules in order, so low priority rules should
|
||||||
|
// be at the beginning, high priority at the end
|
||||||
|
"packageRules": [
|
||||||
|
{
|
||||||
|
"description": "Only get Docker image updates every 2 weeks to reduce noise",
|
||||||
|
"matchDatasources": ["docker"],
|
||||||
|
"schedule": ["every 2 week on monday"],
|
||||||
|
enabled: true,
|
||||||
|
}, {
|
||||||
|
"description": "Ignore k8s.io/client-go older versions, they switched to semantic version and old tags are still available in the repo",
|
||||||
|
"matchDatasources": [
|
||||||
|
"go"
|
||||||
|
],
|
||||||
|
"matchDepNames": [
|
||||||
|
"k8s.io/client-go"
|
||||||
|
],
|
||||||
|
"allowedVersions": "<1.0",
|
||||||
|
}, {
|
||||||
|
"description": "Ignore k8s dependencies, should be updated on crossplane-runtime",
|
||||||
|
"matchDatasources": [
|
||||||
|
"go"
|
||||||
|
],
|
||||||
|
"matchPackagePrefixes": [
|
||||||
|
"k8s.io",
|
||||||
|
"sigs.k8s.io"
|
||||||
|
],
|
||||||
|
"enabled": false,
|
||||||
|
},{
|
||||||
|
"description": "Only get dependency digest updates every month to reduce noise",
|
||||||
|
"matchDatasources": [
|
||||||
|
"go"
|
||||||
|
],
|
||||||
|
"matchUpdateTypes": [
|
||||||
|
"digest",
|
||||||
|
],
|
||||||
|
"extends": ["schedule:monthly"],
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,34 @@
|
||||||
|
name: Backport
|
||||||
|
|
||||||
|
on:
|
||||||
|
# NOTE(negz): This is a risky target, but we run this action only when and if
|
||||||
|
# a PR is closed, then filter down to specifically merged PRs. We also don't
|
||||||
|
# invoke any scripts, etc from within the repo. I believe the fact that we'll
|
||||||
|
# be able to review PRs before this runs makes this fairly safe.
|
||||||
|
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
|
||||||
|
pull_request_target:
|
||||||
|
types: [closed]
|
||||||
|
# See also commands.yml for the /backport triggered variant of this workflow.
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
# NOTE(negz): I tested many backport GitHub actions before landing on this
|
||||||
|
# one. Many do not support merge commits, or do not support pull requests with
|
||||||
|
# more than one commit. This one does. It also handily links backport PRs with
|
||||||
|
# new PRs, and provides commentary and instructions when it can't backport.
|
||||||
|
# The main gotchas with this action are that it _only_ supports merge commits,
|
||||||
|
# and that PRs _must_ be labelled before they're merged to trigger a backport.
|
||||||
|
open-pr:
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
if: github.event.pull_request.merged
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
- name: Open Backport PR
|
||||||
|
uses: zeebe-io/backport-action@v0.0.4
|
||||||
|
with:
|
||||||
|
github_token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
github_workspace: ${{ github.workspace }}
|
||||||
|
version: v0.0.4
|
||||||
|
|
@ -0,0 +1,178 @@
|
||||||
|
name: CI
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
- release-*
|
||||||
|
pull_request: {}
|
||||||
|
workflow_dispatch: {}
|
||||||
|
|
||||||
|
env:
|
||||||
|
# Common versions
|
||||||
|
GO_VERSION: '1.20.6'
|
||||||
|
GOLANGCI_VERSION: 'v1.53.3'
|
||||||
|
DOCKER_BUILDX_VERSION: 'v0.10.0'
|
||||||
|
|
||||||
|
UPBOUND_MARKETPLACE_PUSH_ROBOT_USR: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR }}
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
detect-noop:
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
outputs:
|
||||||
|
noop: ${{ steps.noop.outputs.should_skip }}
|
||||||
|
steps:
|
||||||
|
- name: Detect No-op Changes
|
||||||
|
id: noop
|
||||||
|
uses: fkirc/skip-duplicate-actions@v2.1.0
|
||||||
|
with:
|
||||||
|
github_token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
paths_ignore: '["**.md", "**.png", "**.jpg"]'
|
||||||
|
do_not_skip: '["workflow_dispatch", "schedule", "push"]'
|
||||||
|
concurrent_skipping: false
|
||||||
|
|
||||||
|
lint:
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
needs: detect-noop
|
||||||
|
if: needs.detect-noop.outputs.noop != 'true'
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
submodules: true
|
||||||
|
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@v4
|
||||||
|
with:
|
||||||
|
go-version: ${{ env.GO_VERSION }}
|
||||||
|
|
||||||
|
# We could run 'make lint' to ensure our desired Go version, but we prefer
|
||||||
|
# this action because it leaves 'annotations' (i.e. it comments on PRs to
|
||||||
|
# point out linter violations).
|
||||||
|
- name: Lint
|
||||||
|
uses: golangci/golangci-lint-action@v3
|
||||||
|
with:
|
||||||
|
version: ${{ env.GOLANGCI_VERSION }}
|
||||||
|
skip-go-installation: true
|
||||||
|
args: --timeout 3m
|
||||||
|
|
||||||
|
check-diff:
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
needs: detect-noop
|
||||||
|
if: needs.detect-noop.outputs.noop != 'true'
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
submodules: true
|
||||||
|
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@v4
|
||||||
|
with:
|
||||||
|
go-version: ${{ env.GO_VERSION }}
|
||||||
|
|
||||||
|
- name: Check Diff
|
||||||
|
run: make check-diff
|
||||||
|
|
||||||
|
build:
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
needs: detect-noop
|
||||||
|
if: needs.detect-noop.outputs.noop != 'true'
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
submodules: true
|
||||||
|
|
||||||
|
- name: Fetch History
|
||||||
|
run: git fetch --prune --unshallow
|
||||||
|
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@v4
|
||||||
|
with:
|
||||||
|
go-version: ${{ env.GO_VERSION }}
|
||||||
|
|
||||||
|
- name: Build Go Artifacts
|
||||||
|
run: |
|
||||||
|
make build.code.platform PLATFORM=linux_amd64
|
||||||
|
make build.code.platform PLATFORM=linux_arm64
|
||||||
|
|
||||||
|
unit-tests:
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
needs: detect-noop
|
||||||
|
if: needs.detect-noop.outputs.noop != 'true'
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
submodules: true
|
||||||
|
|
||||||
|
- name: Fetch History
|
||||||
|
run: git fetch --prune --unshallow
|
||||||
|
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@v4
|
||||||
|
with:
|
||||||
|
go-version: ${{ env.GO_VERSION }}
|
||||||
|
|
||||||
|
- name: Run Unit Tests
|
||||||
|
run: make test
|
||||||
|
|
||||||
|
- name: Publish Unit Test Coverage
|
||||||
|
uses: codecov/codecov-action@v1
|
||||||
|
with:
|
||||||
|
flags: unittests
|
||||||
|
file: _output/tests/linux_amd64/coverage.txt
|
||||||
|
|
||||||
|
publish-artifacts:
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
needs: detect-noop
|
||||||
|
if: needs.detect-noop.outputs.noop != 'true'
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Setup QEMU
|
||||||
|
uses: docker/setup-qemu-action@v1
|
||||||
|
with:
|
||||||
|
platforms: all
|
||||||
|
|
||||||
|
- name: Setup Docker Buildx
|
||||||
|
uses: docker/setup-buildx-action@v1
|
||||||
|
with:
|
||||||
|
version: ${{ env.DOCKER_BUILDX_VERSION }}
|
||||||
|
install: true
|
||||||
|
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
with:
|
||||||
|
submodules: true
|
||||||
|
|
||||||
|
- name: Fetch History
|
||||||
|
run: git fetch --prune --unshallow
|
||||||
|
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@v4
|
||||||
|
with:
|
||||||
|
go-version: ${{ env.GO_VERSION }}
|
||||||
|
|
||||||
|
- name: Build Artifacts
|
||||||
|
run: make -j2 build.all
|
||||||
|
env:
|
||||||
|
# We're using docker buildx, which doesn't actually load the images it
|
||||||
|
# builds by default. Specifying --load does so.
|
||||||
|
BUILD_ARGS: "--load"
|
||||||
|
|
||||||
|
- name: Login to Upbound
|
||||||
|
uses: docker/login-action@v2
|
||||||
|
if: env.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR != ''
|
||||||
|
with:
|
||||||
|
registry: xpkg.upbound.io
|
||||||
|
username: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR }}
|
||||||
|
password: ${{ secrets.UPBOUND_MARKETPLACE_PUSH_ROBOT_PSW }}
|
||||||
|
|
||||||
|
- name: Publish Artifacts
|
||||||
|
if: env.UPBOUND_MARKETPLACE_PUSH_ROBOT_USR != ''
|
||||||
|
run: make publish BRANCH_NAME=${GITHUB_REF##*/}
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
name: Tag
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
inputs:
|
||||||
|
version:
|
||||||
|
description: 'Release version (e.g. v0.1.0)'
|
||||||
|
required: true
|
||||||
|
message:
|
||||||
|
description: 'Tag message'
|
||||||
|
required: true
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
create-tag:
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
|
||||||
|
- name: Create Tag
|
||||||
|
uses: negz/create-tag@v1
|
||||||
|
with:
|
||||||
|
version: ${{ github.event.inputs.version }}
|
||||||
|
message: ${{ github.event.inputs.message }}
|
||||||
|
token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
@ -15,7 +15,11 @@
|
||||||
*.out
|
*.out
|
||||||
|
|
||||||
# Dependency directories (remove the comment below to include it)
|
# Dependency directories (remove the comment below to include it)
|
||||||
# vendor/
|
vendor/
|
||||||
|
|
||||||
# Go workspace file
|
# Go workspace file
|
||||||
go.work
|
go.work
|
||||||
|
|
||||||
|
.cache/
|
||||||
|
.idea/
|
||||||
|
_output/
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,3 @@
|
||||||
|
[submodule "build"]
|
||||||
|
path = build
|
||||||
|
url = https://github.com/upbound/build
|
||||||
|
|
@ -0,0 +1,216 @@
|
||||||
|
run:
|
||||||
|
timeout: 10m
|
||||||
|
|
||||||
|
skip-files:
|
||||||
|
- "zz_generated\\..+\\.go$"
|
||||||
|
|
||||||
|
output:
|
||||||
|
# colored-line-number|line-number|json|tab|checkstyle|code-climate, default is "colored-line-number"
|
||||||
|
format: colored-line-number
|
||||||
|
|
||||||
|
linters-settings:
|
||||||
|
errcheck:
|
||||||
|
# report about not checking of errors in type assetions: `a := b.(MyStruct)`;
|
||||||
|
# default is false: such cases aren't reported by default.
|
||||||
|
check-type-assertions: false
|
||||||
|
|
||||||
|
# report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
|
||||||
|
# default is false: such cases aren't reported by default.
|
||||||
|
check-blank: false
|
||||||
|
|
||||||
|
# [deprecated] comma-separated list of pairs of the form pkg:regex
|
||||||
|
# the regex is used to ignore names within pkg. (default "fmt:.*").
|
||||||
|
# see https://github.com/kisielk/errcheck#the-deprecated-method for details
|
||||||
|
ignore: fmt:.*,io/ioutil:^Read.*
|
||||||
|
|
||||||
|
govet:
|
||||||
|
# report about shadowed variables
|
||||||
|
check-shadowing: false
|
||||||
|
|
||||||
|
gofmt:
|
||||||
|
# simplify code: gofmt with `-s` option, true by default
|
||||||
|
simplify: true
|
||||||
|
|
||||||
|
gci:
|
||||||
|
custom-order: true
|
||||||
|
sections:
|
||||||
|
- standard
|
||||||
|
- default
|
||||||
|
- prefix(github.com/crossplane/crossplane-runtime)
|
||||||
|
- prefix(github.com/crossplane/crossplane)
|
||||||
|
- prefix(github.com/crossplane/function-runtime-oci)
|
||||||
|
- blank
|
||||||
|
- dot
|
||||||
|
|
||||||
|
gocyclo:
|
||||||
|
# minimal code complexity to report, 30 by default (but we recommend 10-20)
|
||||||
|
min-complexity: 10
|
||||||
|
|
||||||
|
maligned:
|
||||||
|
# print struct with more effective memory layout or not, false by default
|
||||||
|
suggest-new: true
|
||||||
|
|
||||||
|
dupl:
|
||||||
|
# tokens count to trigger issue, 150 by default
|
||||||
|
threshold: 100
|
||||||
|
|
||||||
|
goconst:
|
||||||
|
# minimal length of string constant, 3 by default
|
||||||
|
min-len: 3
|
||||||
|
# minimal occurrences count to trigger, 3 by default
|
||||||
|
min-occurrences: 5
|
||||||
|
|
||||||
|
lll:
|
||||||
|
# tab width in spaces. Default to 1.
|
||||||
|
tab-width: 1
|
||||||
|
|
||||||
|
unused:
|
||||||
|
# treat code as a program (not a library) and report unused exported identifiers; default is false.
|
||||||
|
# XXX: if you enable this setting, unused will report a lot of false-positives in text editors:
|
||||||
|
# if it's called for subdir of a project it can't find funcs usages. All text editor integrations
|
||||||
|
# with golangci-lint call it on a directory with the changed file.
|
||||||
|
check-exported: false
|
||||||
|
|
||||||
|
unparam:
|
||||||
|
# Inspect exported functions, default is false. Set to true if no external program/library imports your code.
|
||||||
|
# XXX: if you enable this setting, unparam will report a lot of false-positives in text editors:
|
||||||
|
# if it's called for subdir of a project it can't find external interfaces. All text editor integrations
|
||||||
|
# with golangci-lint call it on a directory with the changed file.
|
||||||
|
check-exported: false
|
||||||
|
|
||||||
|
nakedret:
|
||||||
|
# make an issue if func has more lines of code than this setting and it has naked returns; default is 30
|
||||||
|
max-func-lines: 30
|
||||||
|
|
||||||
|
prealloc:
|
||||||
|
# XXX: we don't recommend using this linter before doing performance profiling.
|
||||||
|
# For most programs usage of prealloc will be a premature optimization.
|
||||||
|
|
||||||
|
# Report preallocation suggestions only on simple loops that have no returns/breaks/continues/gotos in them.
|
||||||
|
# True by default.
|
||||||
|
simple: true
|
||||||
|
range-loops: true # Report preallocation suggestions on range loops, true by default
|
||||||
|
for-loops: false # Report preallocation suggestions on for loops, false by default
|
||||||
|
|
||||||
|
gocritic:
|
||||||
|
# Enable multiple checks by tags, run `GL_DEBUG=gocritic golangci-lint` run to see all tags and checks.
|
||||||
|
# Empty list by default. See https://github.com/go-critic/go-critic#usage -> section "Tags".
|
||||||
|
enabled-tags:
|
||||||
|
- performance
|
||||||
|
|
||||||
|
settings: # settings passed to gocritic
|
||||||
|
captLocal: # must be valid enabled check name
|
||||||
|
paramsOnly: true
|
||||||
|
rangeValCopy:
|
||||||
|
sizeThreshold: 32
|
||||||
|
|
||||||
|
nolintlint:
|
||||||
|
require-explanation: true
|
||||||
|
require-specific: true
|
||||||
|
|
||||||
|
|
||||||
|
linters:
|
||||||
|
enable:
|
||||||
|
- megacheck
|
||||||
|
- govet
|
||||||
|
- gocyclo
|
||||||
|
- gocritic
|
||||||
|
- goconst
|
||||||
|
- gci
|
||||||
|
- gofmt # We enable this as well as goimports for its simplify mode.
|
||||||
|
- prealloc
|
||||||
|
- revive
|
||||||
|
- unconvert
|
||||||
|
- misspell
|
||||||
|
- nakedret
|
||||||
|
- nolintlint
|
||||||
|
|
||||||
|
disable:
|
||||||
|
# These linters are all deprecated as of golangci-lint v1.49.0. We disable
|
||||||
|
# them explicitly to avoid the linter logging deprecation warnings.
|
||||||
|
- deadcode
|
||||||
|
- varcheck
|
||||||
|
- scopelint
|
||||||
|
- structcheck
|
||||||
|
- interfacer
|
||||||
|
|
||||||
|
presets:
|
||||||
|
- bugs
|
||||||
|
- unused
|
||||||
|
fast: false
|
||||||
|
|
||||||
|
|
||||||
|
issues:
|
||||||
|
# Excluding configuration per-path and per-linter
|
||||||
|
exclude-rules:
|
||||||
|
# Exclude some linters from running on tests files.
|
||||||
|
- path: _test(ing)?\.go
|
||||||
|
linters:
|
||||||
|
- gocyclo
|
||||||
|
- errcheck
|
||||||
|
- dupl
|
||||||
|
- gosec
|
||||||
|
- scopelint
|
||||||
|
- unparam
|
||||||
|
|
||||||
|
# Ease some gocritic warnings on test files.
|
||||||
|
- path: _test\.go
|
||||||
|
text: "(unnamedResult|exitAfterDefer)"
|
||||||
|
linters:
|
||||||
|
- gocritic
|
||||||
|
|
||||||
|
# These are performance optimisations rather than style issues per se.
|
||||||
|
# They warn when function arguments or range values copy a lot of memory
|
||||||
|
# rather than using a pointer.
|
||||||
|
- text: "(hugeParam|rangeValCopy):"
|
||||||
|
linters:
|
||||||
|
- gocritic
|
||||||
|
|
||||||
|
# This "TestMain should call os.Exit to set exit code" warning is not clever
|
||||||
|
# enough to notice that we call a helper method that calls os.Exit.
|
||||||
|
- text: "SA3000:"
|
||||||
|
linters:
|
||||||
|
- staticcheck
|
||||||
|
|
||||||
|
- text: "k8s.io/api/core/v1"
|
||||||
|
linters:
|
||||||
|
- goimports
|
||||||
|
|
||||||
|
# This is a "potential hardcoded credentials" warning. It's triggered by
|
||||||
|
# any variable with 'secret' in the same, and thus hits a lot of false
|
||||||
|
# positives in Kubernetes land where a Secret is an object type.
|
||||||
|
- text: "G101:"
|
||||||
|
linters:
|
||||||
|
- gosec
|
||||||
|
- gas
|
||||||
|
|
||||||
|
# This is an 'errors unhandled' warning that duplicates errcheck.
|
||||||
|
- text: "G104:"
|
||||||
|
linters:
|
||||||
|
- gosec
|
||||||
|
- gas
|
||||||
|
|
||||||
|
# Some k8s dependencies do not have JSON tags on all fields in structs.
|
||||||
|
- path: k8s.io/
|
||||||
|
linters:
|
||||||
|
- musttag
|
||||||
|
|
||||||
|
# Independently from option `exclude` we use default exclude patterns,
|
||||||
|
# it can be disabled by this option. To list all
|
||||||
|
# excluded by default patterns execute `golangci-lint run --help`.
|
||||||
|
# Default value for this option is true.
|
||||||
|
exclude-use-default: false
|
||||||
|
|
||||||
|
# Show only new issues: if there are unstaged changes or untracked files,
|
||||||
|
# only those changes are analyzed, else only changes in HEAD~ are analyzed.
|
||||||
|
# It's a super-useful option for integration of golangci-lint into existing
|
||||||
|
# large codebase. It's not practical to fix all existing issues at the moment
|
||||||
|
# of integration: much better don't allow issues in new code.
|
||||||
|
# Default is false.
|
||||||
|
new: false
|
||||||
|
|
||||||
|
# Maximum issues count per one linter. Set to 0 to disable. Default is 50.
|
||||||
|
max-per-linter: 0
|
||||||
|
|
||||||
|
# Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
|
||||||
|
max-same-issues: 0
|
||||||
|
|
@ -0,0 +1,85 @@
|
||||||
|
# ====================================================================================
|
||||||
|
# Setup Project
|
||||||
|
|
||||||
|
PROJECT_NAME := function-runtime-oci
|
||||||
|
PROJECT_REPO := github.com/crossplane/$(PROJECT_NAME)
|
||||||
|
|
||||||
|
PLATFORMS ?= linux_amd64 linux_arm64 linux_arm linux_ppc64le darwin_amd64 darwin_arm64 windows_amd64
|
||||||
|
# -include will silently skip missing files, which allows us
|
||||||
|
# to load those files with a target in the Makefile. If only
|
||||||
|
# "include" was used, the make command would fail and refuse
|
||||||
|
# to run a target until the include commands succeeded.
|
||||||
|
-include build/makelib/common.mk
|
||||||
|
|
||||||
|
# ====================================================================================
|
||||||
|
# Setup Go
|
||||||
|
|
||||||
|
# Set a sane default so that the nprocs calculation below is less noisy on the initial
|
||||||
|
# loading of this file
|
||||||
|
NPROCS ?= 1
|
||||||
|
|
||||||
|
# each of our test suites starts a kube-apiserver and running many test suites in
|
||||||
|
# parallel can lead to high CPU utilization. by default we reduce the parallelism
|
||||||
|
# to half the number of CPU cores.
|
||||||
|
GO_TEST_PARALLEL := $(shell echo $$(( $(NPROCS) / 2 )))
|
||||||
|
|
||||||
|
GO_STATIC_PACKAGES = $(GO_PROJECT)/cmd/function-runtime-oci
|
||||||
|
# GO_TEST_PACKAGES = $(GO_PROJECT)/test
|
||||||
|
GO_LDFLAGS += -X $(GO_PROJECT)/internal/version.version=$(VERSION)
|
||||||
|
GO_SUBDIRS += cmd internal
|
||||||
|
GO111MODULE = on
|
||||||
|
GOLANGCILINT_VERSION = 1.53.3
|
||||||
|
-include build/makelib/golang.mk
|
||||||
|
|
||||||
|
# ====================================================================================
|
||||||
|
# Setup Images
|
||||||
|
# Due to the way that the shared build logic works, images should
|
||||||
|
# all be in folders at the same level (no additional levels of nesting).
|
||||||
|
|
||||||
|
REGISTRY_ORGS = docker.io/crossplane xpkg.upbound.io/crossplane
|
||||||
|
IMAGES = function-runtime-oci
|
||||||
|
-include build/makelib/imagelight.mk
|
||||||
|
|
||||||
|
# ====================================================================================
|
||||||
|
# Targets
|
||||||
|
|
||||||
|
# run `make help` to see the targets and options
|
||||||
|
|
||||||
|
# We want submodules to be set up the first time `make` is run.
|
||||||
|
# We manage the build/ folder and its Makefiles as a submodule.
|
||||||
|
# The first time `make` is run, the includes of build/*.mk files will
|
||||||
|
# all fail, and this target will be run. The next time, the default as defined
|
||||||
|
# by the includes will be run instead.
|
||||||
|
fallthrough: submodules
|
||||||
|
@echo Initial setup complete. Running make again . . .
|
||||||
|
@make
|
||||||
|
|
||||||
|
# Generate a coverage report for cobertura applying exclusions on
|
||||||
|
# - generated file
|
||||||
|
cobertura:
|
||||||
|
@cat $(GO_TEST_OUTPUT)/coverage.txt | \
|
||||||
|
grep -v zz_generated.deepcopy | \
|
||||||
|
$(GOCOVER_COBERTURA) > $(GO_TEST_OUTPUT)/cobertura-coverage.xml
|
||||||
|
|
||||||
|
# Update the submodules, such as the common build scripts.
|
||||||
|
submodules:
|
||||||
|
@git submodule sync
|
||||||
|
@git submodule update --init --recursive
|
||||||
|
|
||||||
|
# NOTE(hasheddan): the build submodule currently overrides XDG_CACHE_HOME in
|
||||||
|
# order to force the Helm 3 to use the .work/helm directory. This causes Go on
|
||||||
|
# Linux machines to use that directory as the build cache as well. We should
|
||||||
|
# adjust this behavior in the build submodule because it is also causing Linux
|
||||||
|
# users to duplicate their build cache, but for now we just make it easier to
|
||||||
|
# identify its location in CI so that we cache between builds.
|
||||||
|
go.cachedir:
|
||||||
|
@go env GOCACHE
|
||||||
|
|
||||||
|
# This is for running out-of-cluster locally, and is for convenience. Running
|
||||||
|
# this make target will print out the command which was used. For more control,
|
||||||
|
# try running the binary directly with different arguments.
|
||||||
|
run: go.build
|
||||||
|
@$(INFO) running crossplane locally
|
||||||
|
$(GO_OUT_DIR) start --debug
|
||||||
|
|
||||||
|
.PHONY: cobertura submodules fallthrough run
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
Subproject commit bd5297bd16c113cbc5ed1905b1d96aa1cb3078ec
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
# This is debian:bookworm-slim (i.e. Debian 12, testing)
|
||||||
|
FROM debian:bookworm-slim@sha256:9bd077d2f77c754f4f7f5ee9e6ded9ff1dff92c6dce877754da21b917c122c77
|
||||||
|
|
||||||
|
ARG TARGETOS
|
||||||
|
ARG TARGETARCH
|
||||||
|
|
||||||
|
# TODO(negz): Find a better way to get an OCI runtime? Ideally we'd grab a
|
||||||
|
# static build of crun (or runc) that we could drop into a distroless image. We
|
||||||
|
# slightly prefer crun for its nascent WASM and KVM capabilities, but they only
|
||||||
|
# offer static builds for amd64 and arm64 and building our own takes a long
|
||||||
|
# time.
|
||||||
|
RUN apt-get update && apt-get install -y ca-certificates crun && rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
COPY bin/${TARGETOS}\_${TARGETARCH}/function-runtime-oci /usr/local/bin/
|
||||||
|
|
||||||
|
# We run xfn as root in order to grant it CAP_SETUID and CAP_SETGID, which are
|
||||||
|
# required in order to create a user namespace with more than one available UID
|
||||||
|
# and GID. xfn invokes all of the logic that actually fetches, caches, and runs
|
||||||
|
# a container as an unprivileged user (relative to the root/initial user
|
||||||
|
# namespace - the user is privileged inside the user namespace xfn creates).
|
||||||
|
#
|
||||||
|
# It's possible to run xfn without any root privileges at all - uncomment the
|
||||||
|
# following line to do so. Note that in this mode xfn will only be able to
|
||||||
|
# create containers with a single UID and GID (0), so Containerized Functions
|
||||||
|
# that don't run as root may not work.
|
||||||
|
# USER 65532
|
||||||
|
|
||||||
|
ENTRYPOINT ["function-runtime-oci"]
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
# ====================================================================================
|
||||||
|
# Setup Project
|
||||||
|
|
||||||
|
include ../../../build/makelib/common.mk
|
||||||
|
|
||||||
|
# ====================================================================================
|
||||||
|
# Options
|
||||||
|
|
||||||
|
include ../../../build/makelib/imagelight.mk
|
||||||
|
|
||||||
|
# ====================================================================================
|
||||||
|
# Targets
|
||||||
|
|
||||||
|
img.build:
|
||||||
|
@$(INFO) docker build $(IMAGE)
|
||||||
|
@$(MAKE) BUILD_ARGS="--load" img.build.shared
|
||||||
|
@$(OK) docker build $(IMAGE)
|
||||||
|
|
||||||
|
img.publish:
|
||||||
|
@$(INFO) docker publish $(IMAGE)
|
||||||
|
@$(MAKE) BUILD_ARGS="--push" img.build.shared
|
||||||
|
@$(OK) docker publish $(IMAGE)
|
||||||
|
|
||||||
|
img.build.shared:
|
||||||
|
@cp Dockerfile $(IMAGE_TEMP_DIR) || $(FAIL)
|
||||||
|
@cp -r $(OUTPUT_DIR)/bin/ $(IMAGE_TEMP_DIR)/bin || $(FAIL)
|
||||||
|
@docker buildx build $(BUILD_ARGS) \
|
||||||
|
--platform $(IMAGE_PLATFORMS) \
|
||||||
|
-t $(IMAGE) \
|
||||||
|
$(IMAGE_TEMP_DIR) || $(FAIL)
|
||||||
|
|
||||||
|
img.promote:
|
||||||
|
@$(INFO) docker promote $(FROM_IMAGE) to $(TO_IMAGE)
|
||||||
|
@docker buildx imagetools create -t $(TO_IMAGE) $(FROM_IMAGE)
|
||||||
|
@$(OK) docker promote $(FROM_IMAGE) to $(TO_IMAGE)
|
||||||
|
|
@ -0,0 +1,83 @@
|
||||||
|
/*
|
||||||
|
Copyright 2019 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package main is the reference implementation of Composition Functions.
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"github.com/alecthomas/kong"
|
||||||
|
"github.com/google/go-containerregistry/pkg/name"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/log/zap"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/logging"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/cmd/function-runtime-oci/run"
|
||||||
|
"github.com/crossplane/function-runtime-oci/cmd/function-runtime-oci/spark"
|
||||||
|
"github.com/crossplane/function-runtime-oci/cmd/function-runtime-oci/start"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/version"
|
||||||
|
)
|
||||||
|
|
||||||
|
type debugFlag bool
|
||||||
|
type versionFlag bool
|
||||||
|
|
||||||
|
// KongVars represent the kong variables associated with the CLI parser
|
||||||
|
// required for the Registry default variable interpolation.
|
||||||
|
var KongVars = kong.Vars{
|
||||||
|
"default_registry": name.DefaultRegistry,
|
||||||
|
}
|
||||||
|
|
||||||
|
var cli struct {
|
||||||
|
Debug debugFlag `short:"d" help:"Print verbose logging statements."`
|
||||||
|
|
||||||
|
Version versionFlag `short:"v" help:"Print version and quit."`
|
||||||
|
Registry string `short:"r" help:"Default registry used to fetch containers when not specified in tag." default:"${default_registry}" env:"REGISTRY"`
|
||||||
|
|
||||||
|
Start start.Command `cmd:"" help:"Start listening for Composition Function runs over gRPC." default:"1"`
|
||||||
|
Run run.Command `cmd:"" help:"Run a Composition Function."`
|
||||||
|
Spark spark.Command `cmd:"" help:"function-runtime-oci executes Spark inside a user namespace to run a Composition Function. You shouldn't run it directly." hidden:""`
|
||||||
|
}
|
||||||
|
|
||||||
|
// BeforeApply binds the dev mode logger to the kong context when debugFlag is
|
||||||
|
// passed.
|
||||||
|
func (d debugFlag) BeforeApply(ctx *kong.Context) error { //nolint:unparam // BeforeApply requires this signature.
|
||||||
|
zl := zap.New(zap.UseDevMode(true)).WithName("function-runtime-oci")
|
||||||
|
// BindTo uses reflect.TypeOf to get reflection type of used interface
|
||||||
|
// A *logging.Logger value here is used to find the reflection type here.
|
||||||
|
// Please refer: https://golang.org/pkg/reflect/#TypeOf
|
||||||
|
ctx.BindTo(logging.NewLogrLogger(zl), (*logging.Logger)(nil))
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (v versionFlag) BeforeApply(app *kong.Kong) error { //nolint:unparam // BeforeApply requires this signature.
|
||||||
|
fmt.Fprintln(app.Stdout, version.New().GetVersionString())
|
||||||
|
app.Exit(0)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
zl := zap.New().WithName("function-runtime-oci")
|
||||||
|
|
||||||
|
ctx := kong.Parse(&cli,
|
||||||
|
kong.Name("function-runtime-oci"),
|
||||||
|
kong.Description("Crossplane Composition Functions."),
|
||||||
|
kong.BindTo(logging.NewLogrLogger(zl), (*logging.Logger)(nil)),
|
||||||
|
kong.UsageOnError(),
|
||||||
|
KongVars,
|
||||||
|
)
|
||||||
|
ctx.FatalIfErrorf(ctx.Run(&start.Args{Registry: cli.Registry}))
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,145 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package run implements a convenience CLI to run and test Composition Functions.
|
||||||
|
package run
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/google/go-containerregistry/pkg/authn"
|
||||||
|
"github.com/google/go-containerregistry/pkg/name"
|
||||||
|
"google.golang.org/protobuf/types/known/durationpb"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/cmd/function-runtime-oci/start"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/function-runtime-oci"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/proto/v1alpha1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings
|
||||||
|
const (
|
||||||
|
errWriteFIO = "cannot write FunctionIO YAML to stdout"
|
||||||
|
errRunFunction = "cannot run function"
|
||||||
|
errParseImage = "cannot parse image reference"
|
||||||
|
errResolveKeychain = "cannot resolve default registry authentication keychain"
|
||||||
|
errAuthCfg = "cannot get default registry authentication credentials"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Command runs a Composition function.
|
||||||
|
type Command struct {
|
||||||
|
CacheDir string `short:"c" help:"Directory used for caching function images and containers." default:"/function-runtime-oci"`
|
||||||
|
Timeout time.Duration `help:"Maximum time for which the function may run before being killed." default:"30s"`
|
||||||
|
ImagePullPolicy string `help:"Whether the image may be pulled from a remote registry." enum:"Always,Never,IfNotPresent" default:"IfNotPresent"`
|
||||||
|
NetworkPolicy string `help:"Whether the function may access the network." enum:"Runner,Isolated" default:"Isolated"`
|
||||||
|
MapRootUID int `help:"UID that will map to 0 in the function's user namespace. The following 65336 UIDs must be available. Ignored if function-runtime-oci does not have CAP_SETUID and CAP_SETGID." default:"100000"`
|
||||||
|
MapRootGID int `help:"GID that will map to 0 in the function's user namespace. The following 65336 GIDs must be available. Ignored if function-runtime-oci does not have CAP_SETUID and CAP_SETGID." default:"100000"`
|
||||||
|
|
||||||
|
// TODO(negz): filecontent appears to take multiple args when it does not.
|
||||||
|
// Bump kong once https://github.com/alecthomas/kong/issues/346 is fixed.
|
||||||
|
|
||||||
|
Image string `arg:"" help:"OCI image to run."`
|
||||||
|
FunctionIO []byte `arg:"" help:"YAML encoded FunctionIO to pass to the function." type:"filecontent"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Run a Composition container function.
|
||||||
|
func (c *Command) Run(args *start.Args) error {
|
||||||
|
// If we don't have CAP_SETUID or CAP_SETGID, we'll only be able to map our
|
||||||
|
// own UID and GID to root inside the user namespace.
|
||||||
|
rootUID := os.Getuid()
|
||||||
|
rootGID := os.Getgid()
|
||||||
|
setuid := function_runtime_oci.HasCapSetUID() && function_runtime_oci.HasCapSetGID() // We're using 'setuid' as shorthand for both here.
|
||||||
|
if setuid {
|
||||||
|
rootUID = c.MapRootUID
|
||||||
|
rootGID = c.MapRootGID
|
||||||
|
}
|
||||||
|
|
||||||
|
ref, err := name.ParseReference(c.Image, name.WithDefaultRegistry(args.Registry))
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errParseImage)
|
||||||
|
}
|
||||||
|
|
||||||
|
// We want to resolve authentication credentials here, using the caller's
|
||||||
|
// environment rather than inside the user namespace that spark will create.
|
||||||
|
// DefaultKeychain uses credentials from ~/.docker/config.json to pull
|
||||||
|
// private images. Despite being 'the default' it must be explicitly
|
||||||
|
// provided, or go-containerregistry will use anonymous authentication.
|
||||||
|
auth, err := authn.DefaultKeychain.Resolve(ref.Context())
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errResolveKeychain)
|
||||||
|
}
|
||||||
|
|
||||||
|
a, err := auth.Authorization()
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errAuthCfg)
|
||||||
|
}
|
||||||
|
|
||||||
|
f := function_runtime_oci.NewContainerRunner(function_runtime_oci.SetUID(setuid), function_runtime_oci.MapToRoot(rootUID, rootGID), function_runtime_oci.WithCacheDir(filepath.Clean(c.CacheDir)), function_runtime_oci.WithRegistry(args.Registry))
|
||||||
|
rsp, err := f.RunFunction(context.Background(), &v1alpha1.RunFunctionRequest{
|
||||||
|
Image: c.Image,
|
||||||
|
Input: c.FunctionIO,
|
||||||
|
ImagePullConfig: &v1alpha1.ImagePullConfig{
|
||||||
|
PullPolicy: pullPolicy(c.ImagePullPolicy),
|
||||||
|
Auth: &v1alpha1.ImagePullAuth{
|
||||||
|
Username: a.Username,
|
||||||
|
Password: a.Password,
|
||||||
|
Auth: a.Auth,
|
||||||
|
IdentityToken: a.IdentityToken,
|
||||||
|
RegistryToken: a.RegistryToken,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
RunFunctionConfig: &v1alpha1.RunFunctionConfig{
|
||||||
|
Timeout: durationpb.New(c.Timeout),
|
||||||
|
Network: &v1alpha1.NetworkConfig{
|
||||||
|
Policy: networkPolicy(c.NetworkPolicy),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errRunFunction)
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err = os.Stdout.Write(rsp.GetOutput())
|
||||||
|
return errors.Wrap(err, errWriteFIO)
|
||||||
|
}
|
||||||
|
|
||||||
|
func pullPolicy(p string) v1alpha1.ImagePullPolicy {
|
||||||
|
switch p {
|
||||||
|
case "Always":
|
||||||
|
return v1alpha1.ImagePullPolicy_IMAGE_PULL_POLICY_ALWAYS
|
||||||
|
case "Never":
|
||||||
|
return v1alpha1.ImagePullPolicy_IMAGE_PULL_POLICY_NEVER
|
||||||
|
case "IfNotPresent":
|
||||||
|
fallthrough
|
||||||
|
default:
|
||||||
|
return v1alpha1.ImagePullPolicy_IMAGE_PULL_POLICY_IF_NOT_PRESENT
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func networkPolicy(p string) v1alpha1.NetworkPolicy {
|
||||||
|
switch p {
|
||||||
|
case "Runner":
|
||||||
|
return v1alpha1.NetworkPolicy_NETWORK_POLICY_RUNNER
|
||||||
|
case "Isolated":
|
||||||
|
fallthrough
|
||||||
|
default:
|
||||||
|
return v1alpha1.NetworkPolicy_NETWORK_POLICY_ISOLATED
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,275 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package spark runs a Composition Function. It is designed to be run as root
|
||||||
|
// inside an unprivileged user namespace.
|
||||||
|
package spark
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"context"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"os/exec"
|
||||||
|
"path/filepath"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/google/go-containerregistry/pkg/name"
|
||||||
|
"github.com/google/uuid"
|
||||||
|
runtime "github.com/opencontainers/runtime-spec/specs-go"
|
||||||
|
"google.golang.org/protobuf/proto"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/cmd/function-runtime-oci/start"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/spec"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/store"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/store/overlay"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/store/uncompressed"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/proto/v1alpha1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings.
|
||||||
|
const (
|
||||||
|
errReadRequest = "cannot read request from stdin"
|
||||||
|
errUnmarshalRequest = "cannot unmarshal request data from stdin"
|
||||||
|
errNewBundleStore = "cannot create OCI runtime bundle store"
|
||||||
|
errNewDigestStore = "cannot create OCI image digest store"
|
||||||
|
errParseRef = "cannot parse OCI image reference"
|
||||||
|
errPull = "cannot pull OCI image"
|
||||||
|
errBundleFn = "cannot create OCI runtime bundle"
|
||||||
|
errMkRuntimeRootdir = "cannot make OCI runtime cache"
|
||||||
|
errRuntime = "OCI runtime error"
|
||||||
|
errCleanupBundle = "cannot cleanup OCI runtime bundle"
|
||||||
|
errMarshalResponse = "cannot marshal response data to stdout"
|
||||||
|
errWriteResponse = "cannot write response data to stdout"
|
||||||
|
errCPULimit = "cannot limit container CPU"
|
||||||
|
errMemoryLimit = "cannot limit container memory"
|
||||||
|
errHostNetwork = "cannot configure container to run in host network namespace"
|
||||||
|
)
|
||||||
|
|
||||||
|
// The path within the cache dir that the OCI runtime should use for its
|
||||||
|
// '--root' cache.
|
||||||
|
const ociRuntimeRoot = "runtime"
|
||||||
|
|
||||||
|
// The time after which the OCI runtime will be killed if none is specified in
|
||||||
|
// the RunFunctionRequest.
|
||||||
|
const defaultTimeout = 25 * time.Second
|
||||||
|
|
||||||
|
// Command runs a containerized Composition Function.
|
||||||
|
type Command struct {
|
||||||
|
CacheDir string `short:"c" help:"Directory used for caching function images and containers." default:"/function-runtime-oci"`
|
||||||
|
Runtime string `help:"OCI runtime binary to invoke." default:"crun"`
|
||||||
|
MaxStdioBytes int64 `help:"Maximum size of stdout and stderr for functions." default:"0"`
|
||||||
|
CABundlePath string `help:"Additional CA bundle to use when fetching function images from registry." env:"CA_BUNDLE_PATH"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Run a Composition Function inside an unprivileged user namespace. Reads a
|
||||||
|
// protocol buffer serialized RunFunctionRequest from stdin, and writes a
|
||||||
|
// protocol buffer serialized RunFunctionResponse to stdout.
|
||||||
|
func (c *Command) Run(args *start.Args) error { //nolint:gocyclo // TODO(negz): Refactor some of this out into functions, add tests.
|
||||||
|
pb, err := io.ReadAll(os.Stdin)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errReadRequest)
|
||||||
|
}
|
||||||
|
|
||||||
|
req := &v1alpha1.RunFunctionRequest{}
|
||||||
|
if err := proto.Unmarshal(pb, req); err != nil {
|
||||||
|
return errors.Wrap(err, errUnmarshalRequest)
|
||||||
|
}
|
||||||
|
|
||||||
|
t := req.GetRunFunctionConfig().GetTimeout().AsDuration()
|
||||||
|
if t == 0 {
|
||||||
|
t = defaultTimeout
|
||||||
|
}
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), t)
|
||||||
|
defer cancel()
|
||||||
|
|
||||||
|
runID := uuid.NewString()
|
||||||
|
|
||||||
|
// We prefer to use an overlayfs bundler where possible. It roughly doubles
|
||||||
|
// the disk space per image because it caches layers as overlay compatible
|
||||||
|
// directories in addition to the CachingImagePuller's cache of uncompressed
|
||||||
|
// layer tarballs. The advantage is faster start times for containers with
|
||||||
|
// cached image, because it creates an overlay rootfs. The uncompressed
|
||||||
|
// bundler on the other hand must untar all of a containers layers to create
|
||||||
|
// a new rootfs each time it runs a container.
|
||||||
|
var s store.Bundler = uncompressed.NewBundler(c.CacheDir)
|
||||||
|
if overlay.Supported(c.CacheDir) {
|
||||||
|
s, err = overlay.NewCachingBundler(c.CacheDir)
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errNewBundleStore)
|
||||||
|
}
|
||||||
|
|
||||||
|
// This store maps OCI references to their last known digests. We use it to
|
||||||
|
// resolve references when the imagePullPolicy is Never or IfNotPresent.
|
||||||
|
h, err := store.NewDigest(c.CacheDir)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errNewDigestStore)
|
||||||
|
}
|
||||||
|
|
||||||
|
r, err := name.ParseReference(req.GetImage(), name.WithDefaultRegistry(args.Registry))
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errParseRef)
|
||||||
|
}
|
||||||
|
|
||||||
|
opts := []oci.ImageClientOption{FromImagePullConfig(req.GetImagePullConfig())}
|
||||||
|
if c.CABundlePath != "" {
|
||||||
|
rootCA, err := oci.ParseCertificatesFromPath(c.CABundlePath)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, "Cannot parse CA bundle")
|
||||||
|
}
|
||||||
|
opts = append(opts, oci.WithCustomCA(rootCA))
|
||||||
|
}
|
||||||
|
// We cache every image we pull to the filesystem. Layers are cached as
|
||||||
|
// uncompressed tarballs. This allows them to be extracted quickly when
|
||||||
|
// using the uncompressed.Bundler, which extracts a new root filesystem for
|
||||||
|
// every container run.
|
||||||
|
p := oci.NewCachingPuller(h, store.NewImage(c.CacheDir), &oci.RemoteClient{})
|
||||||
|
img, err := p.Image(ctx, r, opts...)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errPull)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Create an OCI runtime bundle for this container run.
|
||||||
|
b, err := s.Bundle(ctx, img, runID, FromRunFunctionConfig(req.GetRunFunctionConfig()))
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errBundleFn)
|
||||||
|
}
|
||||||
|
|
||||||
|
root := filepath.Join(c.CacheDir, ociRuntimeRoot)
|
||||||
|
if err := os.MkdirAll(root, 0700); err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return errors.Wrap(err, errMkRuntimeRootdir)
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO(negz): Consider using the OCI runtime's lifecycle management commands
|
||||||
|
// (i.e create, start, and delete) rather than run. This would allow spark
|
||||||
|
// to return without sitting in-between function-runtime-oci and crun. It's also generally
|
||||||
|
// recommended; 'run' is more for testing. In practice though run seems to
|
||||||
|
// work just fine for our use case.
|
||||||
|
|
||||||
|
//nolint:gosec // Executing with user-supplied input is intentional.
|
||||||
|
cmd := exec.CommandContext(ctx, c.Runtime, "--root="+root, "run", "--bundle="+b.Path(), runID)
|
||||||
|
cmd.Stdin = bytes.NewReader(req.GetInput())
|
||||||
|
|
||||||
|
stdoutPipe, err := cmd.StdoutPipe()
|
||||||
|
if err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return errors.Wrap(err, errRuntime)
|
||||||
|
}
|
||||||
|
stderrPipe, err := cmd.StderrPipe()
|
||||||
|
if err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return errors.Wrap(err, errRuntime)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := cmd.Start(); err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return errors.Wrap(err, errRuntime)
|
||||||
|
}
|
||||||
|
|
||||||
|
stdout, err := io.ReadAll(limitReaderIfNonZero(stdoutPipe, c.MaxStdioBytes))
|
||||||
|
if err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return errors.Wrap(err, errRuntime)
|
||||||
|
}
|
||||||
|
stderr, err := io.ReadAll(limitReaderIfNonZero(stderrPipe, c.MaxStdioBytes))
|
||||||
|
if err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return errors.Wrap(err, errRuntime)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := cmd.Wait(); err != nil {
|
||||||
|
var exitErr *exec.ExitError
|
||||||
|
if errors.As(err, &exitErr) {
|
||||||
|
exitErr.Stderr = stderr
|
||||||
|
}
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return errors.Wrap(err, errRuntime)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := b.Cleanup(); err != nil {
|
||||||
|
return errors.Wrap(err, errCleanupBundle)
|
||||||
|
}
|
||||||
|
|
||||||
|
rsp := &v1alpha1.RunFunctionResponse{Output: stdout}
|
||||||
|
pb, err = proto.Marshal(rsp)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errMarshalResponse)
|
||||||
|
}
|
||||||
|
_, err = os.Stdout.Write(pb)
|
||||||
|
return errors.Wrap(err, errWriteResponse)
|
||||||
|
}
|
||||||
|
|
||||||
|
func limitReaderIfNonZero(r io.Reader, limit int64) io.Reader {
|
||||||
|
if limit == 0 {
|
||||||
|
return r
|
||||||
|
}
|
||||||
|
return io.LimitReader(r, limit)
|
||||||
|
}
|
||||||
|
|
||||||
|
// FromImagePullConfig configures an image client with options derived from the
|
||||||
|
// supplied ImagePullConfig.
|
||||||
|
func FromImagePullConfig(cfg *v1alpha1.ImagePullConfig) oci.ImageClientOption {
|
||||||
|
return func(o *oci.ImageClientOptions) {
|
||||||
|
switch cfg.GetPullPolicy() {
|
||||||
|
case v1alpha1.ImagePullPolicy_IMAGE_PULL_POLICY_ALWAYS:
|
||||||
|
oci.WithPullPolicy(oci.ImagePullPolicyAlways)(o)
|
||||||
|
case v1alpha1.ImagePullPolicy_IMAGE_PULL_POLICY_NEVER:
|
||||||
|
oci.WithPullPolicy(oci.ImagePullPolicyNever)(o)
|
||||||
|
case v1alpha1.ImagePullPolicy_IMAGE_PULL_POLICY_IF_NOT_PRESENT, v1alpha1.ImagePullPolicy_IMAGE_PULL_POLICY_UNSPECIFIED:
|
||||||
|
oci.WithPullPolicy(oci.ImagePullPolicyIfNotPresent)(o)
|
||||||
|
}
|
||||||
|
if a := cfg.GetAuth(); a != nil {
|
||||||
|
oci.WithPullAuth(&oci.ImagePullAuth{
|
||||||
|
Username: a.GetUsername(),
|
||||||
|
Password: a.GetPassword(),
|
||||||
|
Auth: a.GetAuth(),
|
||||||
|
IdentityToken: a.GetIdentityToken(),
|
||||||
|
RegistryToken: a.GetRegistryToken(),
|
||||||
|
})(o)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// FromRunFunctionConfig extends a runtime spec with configuration derived from
|
||||||
|
// the supplied RunFunctionConfig.
|
||||||
|
func FromRunFunctionConfig(cfg *v1alpha1.RunFunctionConfig) spec.Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
if l := cfg.GetResources().GetLimits().GetCpu(); l != "" {
|
||||||
|
if err := spec.WithCPULimit(l)(s); err != nil {
|
||||||
|
return errors.Wrap(err, errCPULimit)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if l := cfg.GetResources().GetLimits().GetMemory(); l != "" {
|
||||||
|
if err := spec.WithMemoryLimit(l)(s); err != nil {
|
||||||
|
return errors.Wrap(err, errMemoryLimit)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if cfg.GetNetwork().GetPolicy() == v1alpha1.NetworkPolicy_NETWORK_POLICY_RUNNER {
|
||||||
|
if err := spec.WithHostNetwork()(s); err != nil {
|
||||||
|
return errors.Wrap(err, errHostNetwork)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,71 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package start implements the reference Composition Function runner.
|
||||||
|
// It exposes a gRPC API that may be used to run Composition Functions.
|
||||||
|
package start
|
||||||
|
|
||||||
|
import (
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/logging"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/function-runtime-oci"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings
|
||||||
|
const (
|
||||||
|
errListenAndServe = "cannot listen for and serve gRPC API"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Args contains the default registry used to pull function-runtime-oci
|
||||||
|
// containers.
|
||||||
|
type Args struct {
|
||||||
|
Registry string
|
||||||
|
}
|
||||||
|
|
||||||
|
// Command starts a gRPC API to run Composition Functions.
|
||||||
|
type Command struct {
|
||||||
|
CacheDir string `short:"c" help:"Directory used for caching function images and containers." default:"/function-runtime-oci"`
|
||||||
|
MapRootUID int `help:"UID that will map to 0 in the function's user namespace. The following 65336 UIDs must be available. Ignored if function-runtime-oci does not have CAP_SETUID and CAP_SETGID." default:"100000"`
|
||||||
|
MapRootGID int `help:"GID that will map to 0 in the function's user namespace. The following 65336 GIDs must be available. Ignored if function-runtime-oci does not have CAP_SETUID and CAP_SETGID." default:"100000"`
|
||||||
|
Network string `help:"Network on which to listen for gRPC connections." default:"unix"`
|
||||||
|
Address string `help:"Address at which to listen for gRPC connections." default:"@crossplane/fn/default.sock"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Run a Composition Function gRPC API.
|
||||||
|
func (c *Command) Run(args *Args, log logging.Logger) error {
|
||||||
|
// If we don't have CAP_SETUID or CAP_SETGID, we'll only be able to map our
|
||||||
|
// own UID and GID to root inside the user namespace.
|
||||||
|
rootUID := os.Getuid()
|
||||||
|
rootGID := os.Getgid()
|
||||||
|
setuid := function_runtime_oci.HasCapSetUID() && function_runtime_oci.HasCapSetGID() // We're using 'setuid' as shorthand for both here.
|
||||||
|
if setuid {
|
||||||
|
rootUID = c.MapRootUID
|
||||||
|
rootGID = c.MapRootGID
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO(negz): Expose a healthz endpoint and otel metrics.
|
||||||
|
f := function_runtime_oci.NewContainerRunner(
|
||||||
|
function_runtime_oci.SetUID(setuid),
|
||||||
|
function_runtime_oci.MapToRoot(rootUID, rootGID),
|
||||||
|
function_runtime_oci.WithCacheDir(filepath.Clean(c.CacheDir)),
|
||||||
|
function_runtime_oci.WithLogger(log),
|
||||||
|
function_runtime_oci.WithRegistry(args.Registry))
|
||||||
|
return errors.Wrap(f.ListenAndServe(c.Network, c.Address), errListenAndServe)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,119 @@
|
||||||
|
module github.com/crossplane/function-runtime-oci
|
||||||
|
|
||||||
|
go 1.20
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/Masterminds/semver v1.5.0
|
||||||
|
github.com/alecthomas/kong v0.8.0
|
||||||
|
github.com/bufbuild/buf v1.24.0
|
||||||
|
github.com/crossplane/crossplane-runtime v1.13.0
|
||||||
|
github.com/cyphar/filepath-securejoin v0.2.3
|
||||||
|
github.com/google/go-cmp v0.5.9
|
||||||
|
github.com/google/go-containerregistry v0.16.1
|
||||||
|
github.com/google/uuid v1.3.0
|
||||||
|
github.com/opencontainers/runtime-spec v1.1.0-rc.3.0.20230610073135-48415de180cf
|
||||||
|
golang.org/x/sync v0.3.0
|
||||||
|
golang.org/x/sys v0.11.0
|
||||||
|
google.golang.org/grpc v1.57.0
|
||||||
|
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0
|
||||||
|
google.golang.org/protobuf v1.31.0
|
||||||
|
k8s.io/apimachinery v0.27.3
|
||||||
|
k8s.io/code-generator v0.28.0
|
||||||
|
kernel.org/pub/linux/libs/security/libcap/cap v1.2.69
|
||||||
|
sigs.k8s.io/controller-runtime v0.15.0
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
dario.cat/mergo v1.0.0 // indirect
|
||||||
|
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
|
||||||
|
github.com/Microsoft/go-winio v0.6.1 // indirect
|
||||||
|
github.com/bufbuild/connect-go v1.9.0 // indirect
|
||||||
|
github.com/bufbuild/connect-opentelemetry-go v0.4.0 // indirect
|
||||||
|
github.com/bufbuild/protocompile v0.5.1 // indirect
|
||||||
|
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
|
||||||
|
github.com/docker/go-connections v0.4.0 // indirect
|
||||||
|
github.com/docker/go-units v0.5.0 // indirect
|
||||||
|
github.com/felixge/fgprof v0.9.3 // indirect
|
||||||
|
github.com/go-chi/chi/v5 v5.0.8 // indirect
|
||||||
|
github.com/go-logr/stdr v1.2.2 // indirect
|
||||||
|
github.com/gofrs/uuid/v5 v5.0.0 // indirect
|
||||||
|
github.com/google/gnostic-models v0.6.8 // indirect
|
||||||
|
github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8 // indirect
|
||||||
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
||||||
|
github.com/jdxcode/netrc v0.0.0-20221124155335-4616370d1a84 // indirect
|
||||||
|
github.com/klauspost/pgzip v1.2.6 // indirect
|
||||||
|
github.com/moby/term v0.5.0 // indirect
|
||||||
|
github.com/morikuni/aec v1.0.0 // indirect
|
||||||
|
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
|
||||||
|
github.com/pkg/errors v0.9.1 // indirect
|
||||||
|
github.com/pkg/profile v1.7.0 // indirect
|
||||||
|
github.com/rs/cors v1.9.0 // indirect
|
||||||
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
||||||
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
||||||
|
github.com/spf13/afero v1.9.5 // indirect
|
||||||
|
github.com/spf13/cobra v1.7.0 // indirect
|
||||||
|
github.com/spf13/pflag v1.0.5 // indirect
|
||||||
|
github.com/tetratelabs/wazero v1.2.1 // indirect
|
||||||
|
go.opentelemetry.io/otel v1.16.0 // indirect
|
||||||
|
go.opentelemetry.io/otel/metric v1.16.0 // indirect
|
||||||
|
go.opentelemetry.io/otel/sdk v1.16.0 // indirect
|
||||||
|
go.opentelemetry.io/otel/trace v1.16.0 // indirect
|
||||||
|
golang.org/x/crypto v0.11.0 // indirect
|
||||||
|
golang.org/x/mod v0.12.0 // indirect
|
||||||
|
golang.org/x/tools v0.11.0 // indirect
|
||||||
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 // indirect
|
||||||
|
gotest.tools/v3 v3.1.0 // indirect
|
||||||
|
k8s.io/api v0.27.3 // indirect
|
||||||
|
k8s.io/client-go v0.27.3 // indirect
|
||||||
|
k8s.io/gengo v0.0.0-20220902162205-c0856e24416d // indirect
|
||||||
|
k8s.io/utils v0.0.0-20230505201702-9f6742963106 // indirect
|
||||||
|
sigs.k8s.io/yaml v1.3.0 // indirect
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
|
||||||
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||||
|
github.com/docker/cli v24.0.4+incompatible // indirect
|
||||||
|
github.com/docker/distribution v2.8.2+incompatible // indirect
|
||||||
|
github.com/docker/docker v24.0.4+incompatible // indirect
|
||||||
|
github.com/docker/docker-credential-helpers v0.8.0 // indirect
|
||||||
|
github.com/emicklei/go-restful/v3 v3.10.2 // indirect
|
||||||
|
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
|
||||||
|
github.com/go-logr/logr v1.2.4 // indirect
|
||||||
|
github.com/go-logr/zapr v1.2.4 // indirect
|
||||||
|
github.com/go-openapi/jsonpointer v0.19.6 // indirect
|
||||||
|
github.com/go-openapi/jsonreference v0.20.2 // indirect
|
||||||
|
github.com/go-openapi/swag v0.22.3 // indirect
|
||||||
|
github.com/gogo/protobuf v1.3.2 // indirect
|
||||||
|
github.com/golang/protobuf v1.5.3 // indirect
|
||||||
|
github.com/google/gnostic v0.6.9 // indirect
|
||||||
|
github.com/google/gofuzz v1.2.0 // indirect
|
||||||
|
github.com/josharian/intern v1.0.0 // indirect
|
||||||
|
github.com/json-iterator/go v1.1.12 // indirect
|
||||||
|
github.com/klauspost/compress v1.16.7 // indirect
|
||||||
|
github.com/mailru/easyjson v0.7.7 // indirect
|
||||||
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||||
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||||
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
||||||
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
||||||
|
github.com/opencontainers/image-spec v1.1.0-rc4 // indirect
|
||||||
|
github.com/vbatts/tar-split v0.11.3 // indirect
|
||||||
|
go.uber.org/atomic v1.11.0 // indirect
|
||||||
|
go.uber.org/multierr v1.11.0 // indirect
|
||||||
|
go.uber.org/zap v1.24.0 // indirect
|
||||||
|
golang.org/x/net v0.13.0 // indirect; indirect // indirect
|
||||||
|
golang.org/x/oauth2 v0.8.0 // indirect
|
||||||
|
golang.org/x/term v0.10.0 // indirect
|
||||||
|
golang.org/x/text v0.11.0 // indirect
|
||||||
|
golang.org/x/time v0.3.0 // indirect
|
||||||
|
google.golang.org/appengine v1.6.7 // indirect
|
||||||
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||||
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||||
|
k8s.io/klog/v2 v2.100.1 // indirect
|
||||||
|
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
|
||||||
|
kernel.org/pub/linux/libs/security/libcap/psx v1.2.69 // indirect
|
||||||
|
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
|
||||||
|
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
|
||||||
|
)
|
||||||
|
|
@ -0,0 +1,761 @@
|
||||||
|
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||||
|
cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||||
|
cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
|
||||||
|
cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
|
||||||
|
cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
|
||||||
|
cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
|
||||||
|
cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
|
||||||
|
cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
|
||||||
|
cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
|
||||||
|
cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
|
||||||
|
cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
|
||||||
|
cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
|
||||||
|
cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
|
||||||
|
cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
|
||||||
|
cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
|
||||||
|
cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
|
||||||
|
cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
|
||||||
|
cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
|
||||||
|
cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
|
||||||
|
cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
|
||||||
|
cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
|
||||||
|
cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
|
||||||
|
cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
|
||||||
|
cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
|
||||||
|
cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
|
||||||
|
cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
|
||||||
|
cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
|
||||||
|
cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
|
||||||
|
cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
|
||||||
|
cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
|
||||||
|
cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
|
||||||
|
cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
|
||||||
|
cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
|
||||||
|
cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
|
||||||
|
cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
|
||||||
|
cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
|
||||||
|
cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
|
||||||
|
dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
|
||||||
|
dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
|
||||||
|
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
|
||||||
|
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
|
||||||
|
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
|
||||||
|
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
|
||||||
|
github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
|
||||||
|
github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
|
||||||
|
github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
|
||||||
|
github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
|
||||||
|
github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
|
||||||
|
github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
|
||||||
|
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
|
||||||
|
github.com/alecthomas/assert/v2 v2.1.0 h1:tbredtNcQnoSd3QBhQWI7QZ3XHOVkw1Moklp2ojoH/0=
|
||||||
|
github.com/alecthomas/kong v0.8.0 h1:ryDCzutfIqJPnNn0omnrgHLbAggDQM2VWHikE1xqK7s=
|
||||||
|
github.com/alecthomas/kong v0.8.0/go.mod h1:n1iCIO2xS46oE8ZfYCNDqdR0b0wZNrXAIAqro/2132U=
|
||||||
|
github.com/alecthomas/repr v0.1.0 h1:ENn2e1+J3k09gyj2shc0dHr/yjaWSHRlrJ4DPMevDqE=
|
||||||
|
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
|
||||||
|
github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
|
||||||
|
github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
|
||||||
|
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||||
|
github.com/bufbuild/buf v1.24.0 h1:36rVJMJX7BI9Z6nUPpirF+TUO9tVZ45u5VAfj5E7Bgw=
|
||||||
|
github.com/bufbuild/buf v1.24.0/go.mod h1:cacBvncWbYnUcNX580lqllR3qlEetMX/KVm27pUc4Kc=
|
||||||
|
github.com/bufbuild/connect-go v1.9.0 h1:JIgAeNuFpo+SUPfU19Yt5TcWlznsN5Bv10/gI/6Pjoc=
|
||||||
|
github.com/bufbuild/connect-go v1.9.0/go.mod h1:CAIePUgkDR5pAFaylSMtNK45ANQjp9JvpluG20rhpV8=
|
||||||
|
github.com/bufbuild/connect-opentelemetry-go v0.4.0 h1:6JAn10SNqlQ/URhvRNGrIlczKw1wEXknBUUtmWqOiak=
|
||||||
|
github.com/bufbuild/connect-opentelemetry-go v0.4.0/go.mod h1:nwPXYoDOoc2DGyKE/6pT1Q9MPSi2Et2e6BieMD0l6WU=
|
||||||
|
github.com/bufbuild/protocompile v0.5.1 h1:mixz5lJX4Hiz4FpqFREJHIXLfaLBntfaJv1h+/jS+Qg=
|
||||||
|
github.com/bufbuild/protocompile v0.5.1/go.mod h1:G5iLmavmF4NsYtpZFvE3B/zFch2GIY8+wjsYLR/lc40=
|
||||||
|
github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
|
||||||
|
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
|
||||||
|
github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
|
||||||
|
github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
|
||||||
|
github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
|
||||||
|
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
|
||||||
|
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
|
||||||
|
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
|
||||||
|
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
|
||||||
|
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
|
||||||
|
github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
|
||||||
|
github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
|
||||||
|
github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
|
||||||
|
github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSkDwbkEETK84kQgEeFwDC+62k=
|
||||||
|
github.com/containerd/stargz-snapshotter/estargz v0.14.3/go.mod h1:KY//uOCIkSuNAHhJogcZtrNHdKrA99/FCCRjE3HD36o=
|
||||||
|
github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
|
||||||
|
github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
|
||||||
|
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
|
||||||
|
github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
|
||||||
|
github.com/crossplane/crossplane-runtime v1.13.0 h1:EumInUbS8mXV7otwoI3xa0rPczexJOky4XLVlHxxjO0=
|
||||||
|
github.com/crossplane/crossplane-runtime v1.13.0/go.mod h1:FuKIC8Mg8hE2gIAMyf2wCPkxkFPz+VnMQiYWBq1/p5A=
|
||||||
|
github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI=
|
||||||
|
github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
|
||||||
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||||
|
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/docker/cli v24.0.4+incompatible h1:Y3bYF9ekNTm2VFz5U/0BlMdJy73D+Y1iAAZ8l63Ydzw=
|
||||||
|
github.com/docker/cli v24.0.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
|
||||||
|
github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
|
||||||
|
github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
|
||||||
|
github.com/docker/docker v24.0.4+incompatible h1:s/LVDftw9hjblvqIeTiGYXBCD95nOEEl7qRsRrIOuQI=
|
||||||
|
github.com/docker/docker v24.0.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
||||||
|
github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
|
||||||
|
github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
|
||||||
|
github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
|
||||||
|
github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
|
||||||
|
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
|
||||||
|
github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
|
||||||
|
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
|
||||||
|
github.com/emicklei/go-restful/v3 v3.10.2 h1:hIovbnmBTLjHXkqEBUz3HGpXZdM7ZrE9fJIZIqlJLqE=
|
||||||
|
github.com/emicklei/go-restful/v3 v3.10.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
|
||||||
|
github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
|
||||||
|
github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
|
||||||
|
github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
|
||||||
|
github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
|
||||||
|
github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
|
||||||
|
github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
|
||||||
|
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
|
||||||
|
github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
|
||||||
|
github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
|
||||||
|
github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
|
||||||
|
github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
|
||||||
|
github.com/flowstack/go-jsonschema v0.1.1/go.mod h1:yL7fNggx1o8rm9RlgXv7hTBWxdBM0rVwpMwimd3F3N0=
|
||||||
|
github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
|
||||||
|
github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
|
||||||
|
github.com/go-chi/chi/v5 v5.0.8 h1:lD+NLqFcAi1ovnVZpsnObHGW4xb4J8lNmoYVfECH1Y0=
|
||||||
|
github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
|
||||||
|
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
|
||||||
|
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
|
||||||
|
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
|
||||||
|
github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
|
||||||
|
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||||
|
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||||
|
github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
|
||||||
|
github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||||
|
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
|
||||||
|
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||||
|
github.com/go-logr/zapr v1.2.4 h1:QHVo+6stLbfJmYGkQ7uGHUCu5hnAFAj6mDe6Ea0SeOo=
|
||||||
|
github.com/go-logr/zapr v1.2.4/go.mod h1:FyHWQIzQORZ0QVE1BtVHv3cKtNLuXsbNLtpuhNapBOA=
|
||||||
|
github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
|
||||||
|
github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
|
||||||
|
github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
|
||||||
|
github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
|
||||||
|
github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
|
||||||
|
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
|
||||||
|
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
|
||||||
|
github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
|
||||||
|
github.com/gofrs/uuid/v5 v5.0.0 h1:p544++a97kEL+svbcFbCQVM9KFu0Yo25UoISXGNNH9M=
|
||||||
|
github.com/gofrs/uuid/v5 v5.0.0/go.mod h1:CDOjlDMVAtN56jqyRUZh58JT31Tiw7/oQyEXZV+9bD8=
|
||||||
|
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
|
||||||
|
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
|
||||||
|
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
|
||||||
|
github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||||
|
github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||||
|
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||||
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
|
||||||
|
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
|
||||||
|
github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
|
||||||
|
github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
|
||||||
|
github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
|
||||||
|
github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
|
||||||
|
github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
|
||||||
|
github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
|
||||||
|
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||||
|
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||||
|
github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||||
|
github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
|
||||||
|
github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
|
||||||
|
github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
|
||||||
|
github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
|
||||||
|
github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
|
||||||
|
github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
|
||||||
|
github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
|
||||||
|
github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
|
||||||
|
github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
|
||||||
|
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
|
||||||
|
github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
|
||||||
|
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
|
||||||
|
github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||||
|
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
|
||||||
|
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||||
|
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
|
||||||
|
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
|
||||||
|
github.com/google/gnostic v0.6.9 h1:ZK/5VhkoX835RikCHpSUJV9a+S3e1zLh59YnyWeBW+0=
|
||||||
|
github.com/google/gnostic v0.6.9/go.mod h1:Nm8234We1lq6iB9OmlgNv3nH91XLLVZHCDayfA3xq+E=
|
||||||
|
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
|
||||||
|
github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
|
||||||
|
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
|
||||||
|
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||||
|
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||||
|
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
|
||||||
|
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||||
|
github.com/google/go-containerregistry v0.16.1 h1:rUEt426sR6nyrL3gt+18ibRcvYpKYdpsa5ZW7MA08dQ=
|
||||||
|
github.com/google/go-containerregistry v0.16.1/go.mod h1:u0qB2l7mvtWVR5kNcbFIhFY1hLbf8eeGapA+vbFDCtQ=
|
||||||
|
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||||
|
github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||||
|
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||||
|
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||||
|
github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
|
||||||
|
github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
|
||||||
|
github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
|
||||||
|
github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
|
||||||
|
github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
|
||||||
|
github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
|
||||||
|
github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
|
||||||
|
github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
|
||||||
|
github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
|
||||||
|
github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
|
||||||
|
github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||||
|
github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||||
|
github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||||
|
github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
|
||||||
|
github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8 h1:n6vlPhxsA+BW/XsS5+uqi7GyzaLa5MH7qlSLBZtRdiA=
|
||||||
|
github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8/go.mod h1:Jh3hGz2jkYak8qXPD19ryItVnUgpgeqzdkY/D0EaeuA=
|
||||||
|
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
|
||||||
|
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
|
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
|
||||||
|
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
|
github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
|
||||||
|
github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
|
||||||
|
github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
|
||||||
|
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
|
||||||
|
github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
|
||||||
|
github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
|
||||||
|
github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
|
||||||
|
github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
|
||||||
|
github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
|
||||||
|
github.com/ianlancetaylor/demangle v0.0.0-20210905161508-09a460cdf81d/go.mod h1:aYm2/VgdVmcIU8iMfdMvDMsRAQjcfZSKFby6HOFvi/w=
|
||||||
|
github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
|
||||||
|
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
|
||||||
|
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
|
||||||
|
github.com/jdxcode/netrc v0.0.0-20221124155335-4616370d1a84 h1:2uT3aivO7NVpUPGcQX7RbHijHMyWix/yCnIrCWc+5co=
|
||||||
|
github.com/jdxcode/netrc v0.0.0-20221124155335-4616370d1a84/go.mod h1:Zi/ZFkEqFHTm7qkjyNJjaWH4LQA9LQhGJyF0lTYGpxw=
|
||||||
|
github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
|
||||||
|
github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
|
||||||
|
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
|
||||||
|
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
|
||||||
|
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
|
||||||
|
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||||
|
github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
|
||||||
|
github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
|
||||||
|
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||||
|
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||||
|
github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
|
||||||
|
github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
|
||||||
|
github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
|
||||||
|
github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
|
||||||
|
github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
|
||||||
|
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
|
||||||
|
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||||
|
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||||
|
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
|
||||||
|
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
||||||
|
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
||||||
|
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||||
|
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
|
||||||
|
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
|
||||||
|
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
|
||||||
|
github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
|
||||||
|
github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
|
||||||
|
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
|
||||||
|
github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
|
||||||
|
github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||||
|
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
|
||||||
|
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||||
|
github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
|
||||||
|
github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
|
||||||
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
|
||||||
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||||
|
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
|
||||||
|
github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=
|
||||||
|
github.com/onsi/gomega v1.27.7 h1:fVih9JD6ogIiHUN6ePK7HJidyEDpWGVB5mzM7cWNXoU=
|
||||||
|
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
|
||||||
|
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
|
||||||
|
github.com/opencontainers/image-spec v1.1.0-rc4 h1:oOxKUJWnFC4YGHCCMNql1x4YaDfYBTS5Y4x/Cgeo1E0=
|
||||||
|
github.com/opencontainers/image-spec v1.1.0-rc4/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
|
||||||
|
github.com/opencontainers/runtime-spec v1.1.0-rc.3.0.20230610073135-48415de180cf h1:AGnwZS8lmjGxN2/XlzORiYESAk7HOlE3XI37uhIP9Vw=
|
||||||
|
github.com/opencontainers/runtime-spec v1.1.0-rc.3.0.20230610073135-48415de180cf/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
|
||||||
|
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
|
||||||
|
github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
|
||||||
|
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||||
|
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||||
|
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||||
|
github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
|
||||||
|
github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
|
||||||
|
github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
|
||||||
|
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||||
|
github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
|
||||||
|
github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY=
|
||||||
|
github.com/prometheus/procfs v0.10.0 h1:UkG7GPYkO4UZyLnyXjaWYcgOSONqwdBqFUT95ugmt6I=
|
||||||
|
github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
|
||||||
|
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
|
||||||
|
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
|
||||||
|
github.com/rs/cors v1.9.0 h1:l9HGsTsHJcvW14Nk7J9KFz8bzeAWXn3CG6bgt7LsrAE=
|
||||||
|
github.com/rs/cors v1.9.0/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
|
||||||
|
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
|
||||||
|
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||||
|
github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
|
||||||
|
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
|
||||||
|
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
|
||||||
|
github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
|
||||||
|
github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
|
||||||
|
github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
|
||||||
|
github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
|
||||||
|
github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
|
||||||
|
github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
|
||||||
|
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||||
|
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||||
|
github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
|
||||||
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||||
|
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
||||||
|
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||||
|
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||||
|
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||||
|
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
|
||||||
|
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||||
|
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||||
|
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
|
||||||
|
github.com/tetratelabs/wazero v1.2.1 h1:J4X2hrGzJvt+wqltuvcSjHQ7ujQxA9gb6PeMs4qlUWs=
|
||||||
|
github.com/tetratelabs/wazero v1.2.1/go.mod h1:wYx2gNRg8/WihJfSDxA1TIL8H+GkfLYm+bIfbblu9VQ=
|
||||||
|
github.com/urfave/cli v1.22.12/go.mod h1:sSBEIC79qR6OvcmsD4U3KABeOTxDqQtdDnaFuUN30b8=
|
||||||
|
github.com/vbatts/tar-split v0.11.3 h1:hLFqsOLQ1SsppQNTMpkpPXClLDfC2A3Zgy9OUU+RVck=
|
||||||
|
github.com/vbatts/tar-split v0.11.3/go.mod h1:9QlHN18E+fEH7RdG+QAJJcuya3rqT7eXSTY7wGrAokY=
|
||||||
|
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
|
||||||
|
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
|
||||||
|
github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
|
||||||
|
github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||||
|
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||||
|
github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||||
|
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||||
|
github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
|
||||||
|
go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
|
||||||
|
go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
|
||||||
|
go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
|
||||||
|
go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
|
||||||
|
go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
|
||||||
|
go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
|
||||||
|
go.opentelemetry.io/otel v1.16.0 h1:Z7GVAX/UkAXPKsy94IU+i6thsQS4nb7LviLpnaNeW8s=
|
||||||
|
go.opentelemetry.io/otel v1.16.0/go.mod h1:vl0h9NUa1D5s1nv3A5vZOYWn8av4K8Ml6JDeHrT/bx4=
|
||||||
|
go.opentelemetry.io/otel/metric v1.16.0 h1:RbrpwVG1Hfv85LgnZ7+txXioPDoh6EdbZHo26Q3hqOo=
|
||||||
|
go.opentelemetry.io/otel/metric v1.16.0/go.mod h1:QE47cpOmkwipPiefDwo2wDzwJrlfxxNYodqc4xnGCo4=
|
||||||
|
go.opentelemetry.io/otel/sdk v1.16.0 h1:Z1Ok1YsijYL0CSJpHt4cS3wDDh7p572grzNrBMiMWgE=
|
||||||
|
go.opentelemetry.io/otel/sdk v1.16.0/go.mod h1:tMsIuKXuuIWPBAOrH+eHtvhTL+SntFtXF9QD68aP6p4=
|
||||||
|
go.opentelemetry.io/otel/sdk/metric v0.39.0 h1:Kun8i1eYf48kHH83RucG93ffz0zGV1sh46FAScOTuDI=
|
||||||
|
go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
|
||||||
|
go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
|
||||||
|
go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
|
||||||
|
go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
|
||||||
|
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
|
||||||
|
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
|
||||||
|
go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
|
||||||
|
go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
|
||||||
|
go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
|
||||||
|
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
|
||||||
|
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
|
||||||
|
go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
|
||||||
|
go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
|
||||||
|
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||||
|
golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||||
|
golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||||
|
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||||
|
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||||
|
golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
|
||||||
|
golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
||||||
|
golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
|
||||||
|
golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
|
||||||
|
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||||
|
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||||
|
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
|
||||||
|
golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
|
||||||
|
golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
|
||||||
|
golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
|
||||||
|
golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
|
||||||
|
golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
|
||||||
|
golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
|
||||||
|
golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
|
||||||
|
golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
|
||||||
|
golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
|
||||||
|
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
|
||||||
|
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
|
||||||
|
golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
|
||||||
|
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
|
||||||
|
golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
|
||||||
|
golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
|
||||||
|
golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
|
||||||
|
golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
|
||||||
|
golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
|
||||||
|
golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
|
||||||
|
golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
|
||||||
|
golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
|
||||||
|
golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
|
||||||
|
golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
|
||||||
|
golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
|
||||||
|
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
|
||||||
|
golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
|
||||||
|
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||||
|
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||||
|
golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||||
|
golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||||
|
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||||
|
golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
|
||||||
|
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||||
|
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
|
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
|
golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
|
golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||||
|
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||||
|
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||||
|
golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||||
|
golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||||
|
golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
|
||||||
|
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
|
golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||||
|
golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||||
|
golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||||
|
golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||||
|
golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||||
|
golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
|
||||||
|
golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
|
||||||
|
golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
|
||||||
|
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||||
|
golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||||
|
golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||||
|
golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||||
|
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||||
|
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
|
||||||
|
golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||||
|
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||||
|
golang.org/x/net v0.13.0 h1:Nvo8UFsZ8X3BhAC9699Z1j7XQ3rsZnUUm7jfBEk1ueY=
|
||||||
|
golang.org/x/net v0.13.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
|
||||||
|
golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
|
||||||
|
golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
|
||||||
|
golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
|
||||||
|
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
|
golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
|
||||||
|
golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
|
||||||
|
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
|
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
|
golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
|
||||||
|
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||||
|
golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
|
||||||
|
golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
|
||||||
|
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
|
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
|
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
|
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||||
|
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
|
golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
|
golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
|
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
|
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||||
|
golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
|
||||||
|
golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||||
|
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||||
|
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||||
|
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||||
|
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
|
||||||
|
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||||
|
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||||
|
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||||
|
golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
|
||||||
|
golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||||
|
golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||||
|
golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||||
|
golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
|
||||||
|
golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
|
||||||
|
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
|
||||||
|
golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
|
||||||
|
golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
|
||||||
|
golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
|
||||||
|
golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
|
golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||||
|
golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
|
||||||
|
golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
|
||||||
|
golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
|
||||||
|
golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
|
golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
|
golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
|
golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
|
golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
|
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
|
golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
|
||||||
|
golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
|
||||||
|
golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
|
||||||
|
golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
|
||||||
|
golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||||
|
golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||||
|
golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||||
|
golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||||
|
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||||
|
golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||||
|
golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
|
||||||
|
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
|
||||||
|
golang.org/x/tools v0.11.0 h1:EMCa6U9S2LtZXLAMoWiR/R8dAQFRqbAitmbJ2UKhoi8=
|
||||||
|
golang.org/x/tools v0.11.0/go.mod h1:anzJrxPjNtfgiYQYirP2CPGzGLxrH2u2QBhn6Bf3qY8=
|
||||||
|
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
gomodules.xyz/jsonpatch/v2 v2.3.0 h1:8NFhfS6gzxNqjLIYnZxg319wZ5Qjnx4m/CcX+Klzazc=
|
||||||
|
google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
|
||||||
|
google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
|
||||||
|
google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
|
||||||
|
google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
|
||||||
|
google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
|
||||||
|
google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
|
||||||
|
google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
|
||||||
|
google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
|
||||||
|
google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
|
||||||
|
google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
|
||||||
|
google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
|
||||||
|
google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
|
||||||
|
google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
|
||||||
|
google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
|
||||||
|
google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
|
||||||
|
google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
|
||||||
|
google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
|
||||||
|
google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
|
||||||
|
google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
|
||||||
|
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
|
||||||
|
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||||
|
google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||||
|
google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
|
||||||
|
google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
|
||||||
|
google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
|
||||||
|
google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
|
||||||
|
google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
|
||||||
|
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
|
||||||
|
google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
|
||||||
|
google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
|
||||||
|
google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
|
||||||
|
google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
|
||||||
|
google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
|
||||||
|
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
|
||||||
|
google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
|
||||||
|
google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
|
||||||
|
google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
|
||||||
|
google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
|
||||||
|
google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
|
||||||
|
google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
|
||||||
|
google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
|
||||||
|
google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
|
||||||
|
google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
|
||||||
|
google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
|
||||||
|
google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
|
||||||
|
google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
|
||||||
|
google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||||
|
google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
|
||||||
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 h1:0nDDozoAU19Qb2HwhXadU8OcsiO/09cnTqhUtq2MEOM=
|
||||||
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
|
||||||
|
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
|
||||||
|
google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
|
||||||
|
google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
|
||||||
|
google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
|
||||||
|
google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
|
||||||
|
google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
|
||||||
|
google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
|
||||||
|
google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
|
||||||
|
google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
|
||||||
|
google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
|
||||||
|
google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
|
||||||
|
google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
|
||||||
|
google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
|
||||||
|
google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
|
||||||
|
google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
|
||||||
|
google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
|
||||||
|
google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
|
||||||
|
google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
|
||||||
|
google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
|
||||||
|
google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
|
||||||
|
google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
|
||||||
|
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 h1:rNBFJjBCOgVr9pWD7rs/knKL4FRTKgpZmsRfV214zcA=
|
||||||
|
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0/go.mod h1:Dk1tviKTvMCz5tvh7t+fh94dhmQVHuCt2OzJB3CTW9Y=
|
||||||
|
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||||
|
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
|
||||||
|
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
|
||||||
|
google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
|
||||||
|
google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
|
||||||
|
google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
|
||||||
|
google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
|
||||||
|
google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
|
||||||
|
google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
|
||||||
|
google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
|
||||||
|
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
|
||||||
|
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||||
|
google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
|
||||||
|
google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
|
||||||
|
google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||||
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
||||||
|
gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
|
||||||
|
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
|
||||||
|
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
|
||||||
|
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
|
gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
|
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
|
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
|
||||||
|
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
||||||
|
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
gotest.tools/v3 v3.1.0 h1:rVV8Tcg/8jHUkPUorwjaMTtemIMVXfIPKiOqnhEhakk=
|
||||||
|
gotest.tools/v3 v3.1.0/go.mod h1:fHy7eyTmJFO5bQbUsEGQ1v4m2J3Jz9eWL54TP2/ZuYQ=
|
||||||
|
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||||
|
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||||
|
honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||||
|
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||||
|
honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
|
||||||
|
honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
|
||||||
|
honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
|
||||||
|
k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y=
|
||||||
|
k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg=
|
||||||
|
k8s.io/apiextensions-apiserver v0.27.3 h1:xAwC1iYabi+TDfpRhxh4Eapl14Hs2OftM2DN5MpgKX4=
|
||||||
|
k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM=
|
||||||
|
k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
|
||||||
|
k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8=
|
||||||
|
k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48=
|
||||||
|
k8s.io/code-generator v0.28.0 h1:msdkRVJNVFgdiIJ8REl/d3cZsMB9HByFcWMmn13NyuE=
|
||||||
|
k8s.io/code-generator v0.28.0/go.mod h1:ueeSJZJ61NHBa0ccWLey6mwawum25vX61nRZ6WOzN9A=
|
||||||
|
k8s.io/component-base v0.27.3 h1:g078YmdcdTfrCE4fFobt7qmVXwS8J/3cI1XxRi/2+6k=
|
||||||
|
k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08=
|
||||||
|
k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
|
||||||
|
k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
|
||||||
|
k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
|
||||||
|
k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
|
||||||
|
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ=
|
||||||
|
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM=
|
||||||
|
k8s.io/utils v0.0.0-20230505201702-9f6742963106 h1:EObNQ3TW2D+WptiYXlApGNLVy0zm/JIBVY9i+M4wpAU=
|
||||||
|
k8s.io/utils v0.0.0-20230505201702-9f6742963106/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
||||||
|
kernel.org/pub/linux/libs/security/libcap/cap v1.2.69 h1:N0m3tKYbkRMmDobh/47ngz+AWeV7PcfXMDi8xu3Vrag=
|
||||||
|
kernel.org/pub/linux/libs/security/libcap/cap v1.2.69/go.mod h1:Tk5Ip2TuxaWGpccL7//rAsLRH6RQ/jfqTGxuN/+i/FQ=
|
||||||
|
kernel.org/pub/linux/libs/security/libcap/psx v1.2.69 h1:IdrOs1ZgwGw5CI+BH6GgVVlOt+LAXoPyh7enr8lfaXs=
|
||||||
|
kernel.org/pub/linux/libs/security/libcap/psx v1.2.69/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=
|
||||||
|
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
|
||||||
|
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
|
||||||
|
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
|
||||||
|
sigs.k8s.io/controller-runtime v0.15.0 h1:ML+5Adt3qZnMSYxZ7gAverBLNPSMQEibtzAgp0UPojU=
|
||||||
|
sigs.k8s.io/controller-runtime v0.15.0/go.mod h1:7ngYvp1MLT+9GeZ+6lH3LOlcHkp/+tzA/fmHa4iq9kk=
|
||||||
|
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
|
||||||
|
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
|
||||||
|
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
|
||||||
|
sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
|
||||||
|
sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
|
||||||
|
sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
|
||||||
|
sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
|
||||||
|
|
@ -0,0 +1,128 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package function_runtime_oci
|
||||||
|
|
||||||
|
import (
|
||||||
|
"io"
|
||||||
|
"net"
|
||||||
|
|
||||||
|
"google.golang.org/grpc"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/logging"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/proto/v1alpha1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings.
|
||||||
|
const (
|
||||||
|
errListen = "cannot listen for gRPC connections"
|
||||||
|
errServe = "cannot serve gRPC API"
|
||||||
|
)
|
||||||
|
|
||||||
|
const defaultCacheDir = "/function-runtime-oci"
|
||||||
|
|
||||||
|
// An ContainerRunner runs a Composition Function packaged as an OCI image by
|
||||||
|
// extracting it and running it as a 'rootless' container.
|
||||||
|
type ContainerRunner struct {
|
||||||
|
v1alpha1.UnimplementedContainerizedFunctionRunnerServiceServer
|
||||||
|
|
||||||
|
log logging.Logger
|
||||||
|
|
||||||
|
rootUID int
|
||||||
|
rootGID int
|
||||||
|
setuid bool // Specifically, CAP_SETUID and CAP_SETGID.
|
||||||
|
cache string
|
||||||
|
registry string
|
||||||
|
}
|
||||||
|
|
||||||
|
// A ContainerRunnerOption configures a new ContainerRunner.
|
||||||
|
type ContainerRunnerOption func(*ContainerRunner)
|
||||||
|
|
||||||
|
// MapToRoot configures what UID and GID should map to root (UID/GID 0) in the
|
||||||
|
// user namespace in which the function will be run.
|
||||||
|
func MapToRoot(uid, gid int) ContainerRunnerOption {
|
||||||
|
return func(r *ContainerRunner) {
|
||||||
|
r.rootUID = uid
|
||||||
|
r.rootGID = gid
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetUID indicates that the container runner should attempt operations that
|
||||||
|
// require CAP_SETUID and CAP_SETGID, for example creating a user namespace that
|
||||||
|
// maps arbitrary UIDs and GIDs to the parent namespace.
|
||||||
|
func SetUID(s bool) ContainerRunnerOption {
|
||||||
|
return func(r *ContainerRunner) {
|
||||||
|
r.setuid = s
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithCacheDir specifies the directory used for caching function images and
|
||||||
|
// containers.
|
||||||
|
func WithCacheDir(d string) ContainerRunnerOption {
|
||||||
|
return func(r *ContainerRunner) {
|
||||||
|
r.cache = d
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithRegistry specifies the default registry used to retrieve function images and
|
||||||
|
// containers.
|
||||||
|
func WithRegistry(dr string) ContainerRunnerOption {
|
||||||
|
return func(r *ContainerRunner) {
|
||||||
|
r.registry = dr
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithLogger configures which logger the container runner should use. Logging
|
||||||
|
// is disabled by default.
|
||||||
|
func WithLogger(l logging.Logger) ContainerRunnerOption {
|
||||||
|
return func(cr *ContainerRunner) {
|
||||||
|
cr.log = l
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewContainerRunner returns a new Runner that runs functions as rootless
|
||||||
|
// containers.
|
||||||
|
func NewContainerRunner(o ...ContainerRunnerOption) *ContainerRunner {
|
||||||
|
r := &ContainerRunner{cache: defaultCacheDir, log: logging.NewNopLogger()}
|
||||||
|
for _, fn := range o {
|
||||||
|
fn(r)
|
||||||
|
}
|
||||||
|
|
||||||
|
return r
|
||||||
|
}
|
||||||
|
|
||||||
|
// ListenAndServe gRPC connections at the supplied address.
|
||||||
|
func (r *ContainerRunner) ListenAndServe(network, address string) error {
|
||||||
|
r.log.Debug("Listening", "network", network, "address", address)
|
||||||
|
lis, err := net.Listen(network, address)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errListen)
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO(negz): Limit concurrent function runs?
|
||||||
|
srv := grpc.NewServer()
|
||||||
|
v1alpha1.RegisterContainerizedFunctionRunnerServiceServer(srv, r)
|
||||||
|
return errors.Wrap(srv.Serve(lis), errServe)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Stdio can be used to read and write a command's standard I/O.
|
||||||
|
type Stdio struct {
|
||||||
|
Stdin io.WriteCloser
|
||||||
|
Stdout io.ReadCloser
|
||||||
|
Stderr io.ReadCloser
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,185 @@
|
||||||
|
//go:build linux
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package function_runtime_oci
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"os/exec"
|
||||||
|
"syscall"
|
||||||
|
|
||||||
|
"google.golang.org/protobuf/proto"
|
||||||
|
"kernel.org/pub/linux/libs/security/libcap/cap"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/proto/v1alpha1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// NOTE(negz): Technically _all_ of the containerized Composition Functions
|
||||||
|
// implementation is only useful on Linux, but we want to support building what
|
||||||
|
// we can on other operating systems (e.g. Darwin) to make it possible for folks
|
||||||
|
// running them to ensure that code compiles and passes tests during
|
||||||
|
// development. Avoid adding code to this file unless it actually needs Linux to
|
||||||
|
// run.
|
||||||
|
|
||||||
|
// Error strings.
|
||||||
|
const (
|
||||||
|
errCreateStdioPipes = "cannot create stdio pipes"
|
||||||
|
errStartSpark = "cannot start " + spark
|
||||||
|
errCloseStdin = "cannot close stdin pipe"
|
||||||
|
errReadStdout = "cannot read from stdout pipe"
|
||||||
|
errReadStderr = "cannot read from stderr pipe"
|
||||||
|
errMarshalRequest = "cannot marshal RunFunctionRequest for " + spark
|
||||||
|
errWriteRequest = "cannot write RunFunctionRequest to " + spark + " stdin"
|
||||||
|
errUnmarshalResponse = "cannot unmarshal RunFunctionRequest from " + spark + " stdout"
|
||||||
|
)
|
||||||
|
|
||||||
|
// How many UIDs and GIDs to map from the parent to the child user namespace, if
|
||||||
|
// possible. Doing so requires CAP_SETUID and CAP_SETGID.
|
||||||
|
const (
|
||||||
|
UserNamespaceUIDs = 65536
|
||||||
|
UserNamespaceGIDs = 65536
|
||||||
|
MaxStdioBytes = 100 << 20 // 100 MB
|
||||||
|
)
|
||||||
|
|
||||||
|
// The subcommand of function-runtime-oci to invoke - i.e. "function-runtime-oci spark <source> <bundle>"
|
||||||
|
const spark = "spark"
|
||||||
|
|
||||||
|
// HasCapSetUID returns true if this process has CAP_SETUID.
|
||||||
|
func HasCapSetUID() bool {
|
||||||
|
pc := cap.GetProc()
|
||||||
|
setuid, _ := pc.GetFlag(cap.Effective, cap.SETUID)
|
||||||
|
return setuid
|
||||||
|
}
|
||||||
|
|
||||||
|
// HasCapSetGID returns true if this process has CAP_SETGID.
|
||||||
|
func HasCapSetGID() bool {
|
||||||
|
pc := cap.GetProc()
|
||||||
|
setgid, _ := pc.GetFlag(cap.Effective, cap.SETGID)
|
||||||
|
return setgid
|
||||||
|
}
|
||||||
|
|
||||||
|
// RunFunction runs a function as a rootless OCI container. Functions that
|
||||||
|
// return non-zero, or that cannot be executed in the first place (e.g. because
|
||||||
|
// they cannot be fetched from the registry) will return an error.
|
||||||
|
func (r *ContainerRunner) RunFunction(ctx context.Context, req *v1alpha1.RunFunctionRequest) (*v1alpha1.RunFunctionResponse, error) {
|
||||||
|
r.log.Debug("Running function", "image", req.Image)
|
||||||
|
|
||||||
|
/*
|
||||||
|
We want to create an overlayfs with the cached rootfs as the lower layer
|
||||||
|
and the bundle's rootfs as the upper layer, if possible. Kernel 5.11 and
|
||||||
|
later supports using overlayfs inside a user (and mount) namespace. The
|
||||||
|
best way to run code in a user namespace in Go is to execute a separate
|
||||||
|
binary; the unix.Unshare syscall affects only one OS thread, and the Go
|
||||||
|
scheduler might move the goroutine to another.
|
||||||
|
|
||||||
|
Therefore we execute a shim - function-runtime-oci spark - in a new user
|
||||||
|
and mount namespace. spark fetches and caches the image, creates an OCI
|
||||||
|
runtime bundle, then executes an OCI runtime in order to actually
|
||||||
|
execute the function.
|
||||||
|
*/
|
||||||
|
cmd := exec.CommandContext(ctx, os.Args[0], spark, "--cache-dir="+r.cache, "--registry="+r.registry, //nolint:gosec // We're intentionally executing with variable input.
|
||||||
|
fmt.Sprintf("--max-stdio-bytes=%d", MaxStdioBytes))
|
||||||
|
cmd.SysProcAttr = &syscall.SysProcAttr{
|
||||||
|
Cloneflags: syscall.CLONE_NEWUSER | syscall.CLONE_NEWNS,
|
||||||
|
UidMappings: []syscall.SysProcIDMap{{ContainerID: 0, HostID: r.rootUID, Size: 1}},
|
||||||
|
GidMappings: []syscall.SysProcIDMap{{ContainerID: 0, HostID: r.rootGID, Size: 1}},
|
||||||
|
}
|
||||||
|
|
||||||
|
// When we have CAP_SETUID and CAP_SETGID (i.e. typically when root), we can
|
||||||
|
// map a range of UIDs (0 to 65,336) inside the user namespace to a range in
|
||||||
|
// its parent. We can also drop privileges (in the parent user namespace) by
|
||||||
|
// running spark as root in the user namespace.
|
||||||
|
if r.setuid {
|
||||||
|
cmd.SysProcAttr.UidMappings = []syscall.SysProcIDMap{{ContainerID: 0, HostID: r.rootUID, Size: UserNamespaceUIDs}}
|
||||||
|
cmd.SysProcAttr.GidMappings = []syscall.SysProcIDMap{{ContainerID: 0, HostID: r.rootGID, Size: UserNamespaceGIDs}}
|
||||||
|
cmd.SysProcAttr.GidMappingsEnableSetgroups = true
|
||||||
|
|
||||||
|
/*
|
||||||
|
UID and GID 0 here are relative to the new user namespace - i.e. they
|
||||||
|
correspond to HostID in the parent. We're able to do this because
|
||||||
|
Go's exec.Command will:
|
||||||
|
|
||||||
|
1. Call clone(2) to create a child process in a new user namespace.
|
||||||
|
2. In the child process, wait for /proc/self/uid_map to be written.
|
||||||
|
3. In the parent process, write the child's /proc/$pid/uid_map.
|
||||||
|
4. In the child process, call setuid(2) and setgid(2) per Credential.
|
||||||
|
5. In the child process, call execve(2) to execute spark.
|
||||||
|
|
||||||
|
Per user_namespaces(7) the child process created by clone(2) starts
|
||||||
|
out with a complete set of capabilities in the new user namespace
|
||||||
|
until the call to execve(2) causes them to be recalculated. This
|
||||||
|
includes the CAP_SETUID and CAP_SETGID necessary to become UID 0 in
|
||||||
|
the child user namespace, effectively dropping privileges to UID
|
||||||
|
100000 in the parent user namespace.
|
||||||
|
|
||||||
|
https://github.com/golang/go/blob/1b03568/src/syscall/exec_linux.go#L446
|
||||||
|
*/
|
||||||
|
cmd.SysProcAttr.Credential = &syscall.Credential{Uid: 0, Gid: 0}
|
||||||
|
}
|
||||||
|
|
||||||
|
stdio, err := StdioPipes(cmd, r.rootUID, r.rootGID)
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errCreateStdioPipes)
|
||||||
|
}
|
||||||
|
|
||||||
|
b, err := proto.Marshal(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errMarshalRequest)
|
||||||
|
}
|
||||||
|
if err := cmd.Start(); err != nil {
|
||||||
|
return nil, errors.Wrap(err, errStartSpark)
|
||||||
|
}
|
||||||
|
if _, err := stdio.Stdin.Write(b); err != nil {
|
||||||
|
return nil, errors.Wrap(err, errWriteRequest)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Closing the write end of the stdio pipe will cause the read end to return
|
||||||
|
// EOF. This is necessary to avoid a function blocking forever while reading
|
||||||
|
// from stdin.
|
||||||
|
if err := stdio.Stdin.Close(); err != nil {
|
||||||
|
return nil, errors.Wrap(err, errCloseStdin)
|
||||||
|
}
|
||||||
|
|
||||||
|
// We must read all of stdout and stderr before calling cmd.Wait, which
|
||||||
|
// closes the underlying pipes.
|
||||||
|
// Limited to MaxStdioBytes to avoid OOMing if the function writes a lot of
|
||||||
|
// data to stdout or stderr.
|
||||||
|
stdout, err := io.ReadAll(io.LimitReader(stdio.Stdout, MaxStdioBytes))
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errReadStdout)
|
||||||
|
}
|
||||||
|
|
||||||
|
stderr, err := io.ReadAll(io.LimitReader(stdio.Stderr, MaxStdioBytes))
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errReadStderr)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := cmd.Wait(); err != nil {
|
||||||
|
// TODO(negz): Handle stderr being too long to be a useful error.
|
||||||
|
return nil, errors.Errorf("%w: %s", err, bytes.TrimSuffix(stderr, []byte("\n")))
|
||||||
|
}
|
||||||
|
|
||||||
|
rsp := &v1alpha1.RunFunctionResponse{}
|
||||||
|
return rsp, errors.Wrap(proto.Unmarshal(stdout, rsp), errUnmarshalResponse)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
//go:build !linux
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package function_runtime_oci
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/proto/v1alpha1"
|
||||||
|
)
|
||||||
|
|
||||||
|
const errLinuxOnly = "containerized functions are only supported on Linux"
|
||||||
|
|
||||||
|
// HasCapSetUID returns false on non-Linux.
|
||||||
|
func HasCapSetUID() bool { return false }
|
||||||
|
|
||||||
|
// HasCapSetGID returns false on non-Linux.
|
||||||
|
func HasCapSetGID() bool { return false }
|
||||||
|
|
||||||
|
// RunFunction returns an error on non-Linux.
|
||||||
|
func (r *ContainerRunner) RunFunction(_ context.Context, _ *v1alpha1.RunFunctionRequest) (*v1alpha1.RunFunctionResponse, error) {
|
||||||
|
return nil, errors.New(errLinuxOnly)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,30 @@
|
||||||
|
//go:build !unix
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package function_runtime_oci
|
||||||
|
|
||||||
|
import (
|
||||||
|
"os/exec"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// StdioPipes returns an error on non-Linux.
|
||||||
|
func StdioPipes(cmd *exec.Cmd, uid, gid int) (*Stdio, error) {
|
||||||
|
return nil, errors.New(errLinuxOnly)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,77 @@
|
||||||
|
//go:build unix
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package function_runtime_oci
|
||||||
|
|
||||||
|
import (
|
||||||
|
"os/exec"
|
||||||
|
"syscall"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// NOTE(negz): We build this function for unix so that folks running (e.g.)
|
||||||
|
// Darwin can build and test the code, even though it's only really useful for
|
||||||
|
// Linux systems.
|
||||||
|
|
||||||
|
// Error strings.
|
||||||
|
const (
|
||||||
|
errCreateStdinPipe = "cannot create stdin pipe"
|
||||||
|
errCreateStdoutPipe = "cannot create stdout pipe"
|
||||||
|
errCreateStderrPipe = "cannot create stderr pipe"
|
||||||
|
errChownFd = "cannot chown file descriptor"
|
||||||
|
)
|
||||||
|
|
||||||
|
// StdioPipes creates and returns pipes that will be connected to the supplied
|
||||||
|
// command's stdio when it starts. It calls fchown(2) to ensure all pipes are
|
||||||
|
// owned by the supplied user and group ID; this ensures that the command can
|
||||||
|
// read and write its stdio even when function-runtime-oci is running as root
|
||||||
|
// (in the parent namespace) and the command is not.
|
||||||
|
func StdioPipes(cmd *exec.Cmd, uid, gid int) (*Stdio, error) {
|
||||||
|
stdin, err := cmd.StdinPipe()
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errCreateStdinPipe)
|
||||||
|
}
|
||||||
|
stdout, err := cmd.StdoutPipe()
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errCreateStdoutPipe)
|
||||||
|
}
|
||||||
|
stderr, err := cmd.StderrPipe()
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errCreateStderrPipe)
|
||||||
|
}
|
||||||
|
|
||||||
|
// StdinPipe and friends above return "our end" of the pipe - i.e. stdin is
|
||||||
|
// the io.WriteCloser we can use to write to the command's stdin. They also
|
||||||
|
// setup the "command's end" of the pipe - i.e. cmd.Stdin is the io.Reader
|
||||||
|
// the command can use to read its stdin. In all cases these pipes _should_
|
||||||
|
// be *os.Files.
|
||||||
|
for _, s := range []any{stdin, stdout, stderr, cmd.Stdin, cmd.Stdout, cmd.Stderr} {
|
||||||
|
f, ok := s.(interface{ Fd() uintptr })
|
||||||
|
if !ok {
|
||||||
|
return nil, errors.Errorf("stdio pipe (type: %T) missing required Fd() method", f)
|
||||||
|
}
|
||||||
|
// We only build this file on unix because Fchown does not take an
|
||||||
|
// integer fd on Windows.
|
||||||
|
if err := syscall.Fchown(int(f.Fd()), uid, gid); err != nil {
|
||||||
|
return nil, errors.Wrap(err, errChownFd)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return &Stdio{Stdin: stdin, Stdout: stdout, Stderr: stderr}, nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package function-runtime-oci is the reference implementation of Composition
|
||||||
|
// Functions.
|
||||||
|
package function_runtime_oci
|
||||||
|
|
@ -0,0 +1,48 @@
|
||||||
|
/*
|
||||||
|
Copyright 2023 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package oci
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/x509"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ParseCertificatesFromPath parses PEM file containing extra x509
|
||||||
|
// certificates(s) and combines them with the built in root CA CertPool.
|
||||||
|
func ParseCertificatesFromPath(path string) (*x509.CertPool, error) {
|
||||||
|
// Get the SystemCertPool, continue with an empty pool on error
|
||||||
|
rootCAs, _ := x509.SystemCertPool()
|
||||||
|
if rootCAs == nil {
|
||||||
|
rootCAs = x509.NewCertPool()
|
||||||
|
}
|
||||||
|
|
||||||
|
// Read in the cert file
|
||||||
|
certs, err := os.ReadFile(filepath.Clean(path))
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrapf(err, "Failed to append %q to RootCAs", path)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Append our cert to the system pool
|
||||||
|
if ok := rootCAs.AppendCertsFromPEM(certs); !ok {
|
||||||
|
return nil, errors.Errorf("No certificates could be parsed from %q", path)
|
||||||
|
}
|
||||||
|
|
||||||
|
return rootCAs, nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package oci contains functionality for working with Open Container Initiative
|
||||||
|
// (OCI) images and containers.
|
||||||
|
package oci
|
||||||
|
|
@ -0,0 +1,342 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package layer extracts OCI image layer tarballs.
|
||||||
|
package layer
|
||||||
|
|
||||||
|
import (
|
||||||
|
"archive/tar"
|
||||||
|
"context"
|
||||||
|
"io"
|
||||||
|
"io/fs"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
securejoin "github.com/cyphar/filepath-securejoin"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings.
|
||||||
|
const (
|
||||||
|
errAdvanceTarball = "cannot advance to next entry in tarball"
|
||||||
|
errExtractTarHeader = "cannot extract tar header"
|
||||||
|
errEvalSymlinks = "cannot evaluate symlinks"
|
||||||
|
errMkdir = "cannot make directory"
|
||||||
|
errLstat = "cannot lstat directory"
|
||||||
|
errChmod = "cannot chmod path"
|
||||||
|
errSymlink = "cannot create symlink"
|
||||||
|
errOpenFile = "cannot open file"
|
||||||
|
errCopyFile = "cannot copy file"
|
||||||
|
errCloseFile = "cannot close file"
|
||||||
|
|
||||||
|
errFmtHandleTarHeader = "cannot handle tar header for %q"
|
||||||
|
errFmtWhiteoutFile = "cannot whiteout file %q"
|
||||||
|
errFmtWhiteoutDir = "cannot whiteout opaque directory %q"
|
||||||
|
errFmtUnsupportedType = "tarball contained header %q with unknown type %q"
|
||||||
|
errFmtNotDir = "path %q exists but is not a directory"
|
||||||
|
errFmtSize = "wrote %d bytes to %q; expected %d"
|
||||||
|
)
|
||||||
|
|
||||||
|
// OCI whiteouts.
|
||||||
|
// See https://github.com/opencontainers/image-spec/blob/v1.0/layer.md#whiteouts
|
||||||
|
const (
|
||||||
|
ociWhiteoutPrefix = ".wh."
|
||||||
|
ociWhiteoutMetaPrefix = ociWhiteoutPrefix + ociWhiteoutPrefix
|
||||||
|
ociWhiteoutOpaqueDir = ociWhiteoutMetaPrefix + ".opq"
|
||||||
|
)
|
||||||
|
|
||||||
|
// A HeaderHandler handles a single file (header) within a tarball.
|
||||||
|
type HeaderHandler interface {
|
||||||
|
// Handle the supplied tarball header by applying it to the supplied path,
|
||||||
|
// e.g. creating a file, directory, etc. The supplied io.Reader is expected
|
||||||
|
// to be a tarball advanced to the supplied header, i.e. via tr.Next().
|
||||||
|
Handle(h *tar.Header, tr io.Reader, path string) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A HeaderHandlerFn is a function that acts as a HeaderHandler.
|
||||||
|
type HeaderHandlerFn func(h *tar.Header, tr io.Reader, path string) error
|
||||||
|
|
||||||
|
// Handle the supplied tarball header.
|
||||||
|
func (fn HeaderHandlerFn) Handle(h *tar.Header, tr io.Reader, path string) error {
|
||||||
|
return fn(h, tr, path)
|
||||||
|
}
|
||||||
|
|
||||||
|
// A StackingExtractor is a Extractor that extracts an OCI layer by
|
||||||
|
// 'stacking' it atop the supplied root directory.
|
||||||
|
type StackingExtractor struct {
|
||||||
|
h HeaderHandler
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewStackingExtractor extracts an OCI layer by 'stacking' it atop the
|
||||||
|
// supplied root directory.
|
||||||
|
func NewStackingExtractor(h HeaderHandler) *StackingExtractor {
|
||||||
|
return &StackingExtractor{h: h}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Apply calls the StackingExtractor's HeaderHandler for each file in the
|
||||||
|
// supplied layer tarball, adjusting their path to be rooted under the supplied
|
||||||
|
// root directory. That is, /foo would be extracted to /bar as /bar/foo.
|
||||||
|
func (e *StackingExtractor) Apply(ctx context.Context, tb io.Reader, root string) error {
|
||||||
|
tr := tar.NewReader(tb)
|
||||||
|
for {
|
||||||
|
select {
|
||||||
|
case <-ctx.Done():
|
||||||
|
return ctx.Err()
|
||||||
|
default:
|
||||||
|
}
|
||||||
|
hdr, err := tr.Next()
|
||||||
|
if errors.Is(err, io.EOF) {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errAdvanceTarball)
|
||||||
|
}
|
||||||
|
|
||||||
|
// SecureJoin joins hdr.Name to root, ensuring the resulting path does
|
||||||
|
// not escape root either syntactically (via "..") or via symlinks in
|
||||||
|
// the path. For example:
|
||||||
|
//
|
||||||
|
// * Joining "/a" and "../etc/passwd" results in "/a/etc/passwd".
|
||||||
|
// * Joining "/a" and "evil/passwd" where "/a/evil" exists and is a
|
||||||
|
// symlink to "/etc" results in "/a/etc/passwd".
|
||||||
|
//
|
||||||
|
// https://codeql.github.com/codeql-query-help/go/go-unsafe-unzip-symlink/
|
||||||
|
path, err := securejoin.SecureJoin(root, hdr.Name)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errEvalSymlinks)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := e.h.Handle(hdr, tr, path); err != nil {
|
||||||
|
return errors.Wrapf(err, errFmtHandleTarHeader, hdr.Name)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO(negz): Handle MAC times for directories. This needs to be done last,
|
||||||
|
// since mutating a directory's contents will update its MAC times.
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// A WhiteoutHandler handles OCI whiteouts by deleting the corresponding files.
|
||||||
|
// It passes anything that is not a whiteout to an underlying HeaderHandler. It
|
||||||
|
// avoids deleting any file created by the underling HeaderHandler.
|
||||||
|
type WhiteoutHandler struct {
|
||||||
|
wrapped HeaderHandler
|
||||||
|
handled map[string]bool
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewWhiteoutHandler returns a HeaderHandler that handles OCI whiteouts by
|
||||||
|
// deleting the corresponding files.
|
||||||
|
func NewWhiteoutHandler(hh HeaderHandler) *WhiteoutHandler {
|
||||||
|
return &WhiteoutHandler{wrapped: hh, handled: make(map[string]bool)}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Handle the supplied tar header.
|
||||||
|
func (w *WhiteoutHandler) Handle(h *tar.Header, tr io.Reader, path string) error {
|
||||||
|
// If this isn't a whiteout file, extract it.
|
||||||
|
if !strings.HasPrefix(filepath.Base(path), ociWhiteoutPrefix) {
|
||||||
|
w.handled[path] = true
|
||||||
|
return w.wrapped.Handle(h, tr, path)
|
||||||
|
}
|
||||||
|
|
||||||
|
// We must only whiteout files from previous layers; i.e. not files that
|
||||||
|
// we've extracted from this layer. We're operating on a merged overlayfs,
|
||||||
|
// so we can't rely on the filesystem to distinguish what files are from a
|
||||||
|
// previous layer. Instead we track which files we've extracted from this
|
||||||
|
// layer and avoid whiting-out any file we've extracted. It's possible we'll
|
||||||
|
// see a whiteout out-of-order; i.e. we'll whiteout /foo, then later extract
|
||||||
|
// /foo from the same layer. This should be fine; we'll delete it, then
|
||||||
|
// recreate it, resulting in the desired file in our overlayfs upper dir.
|
||||||
|
// https://github.com/opencontainers/image-spec/blob/v1.0/layer.md#whiteouts
|
||||||
|
|
||||||
|
base := filepath.Base(path)
|
||||||
|
dir := filepath.Dir(path)
|
||||||
|
|
||||||
|
// Handle explicit whiteout files. These files resolve to an explicit path
|
||||||
|
// that should be deleted from the current layer.
|
||||||
|
if base != ociWhiteoutOpaqueDir {
|
||||||
|
whiteout := filepath.Join(dir, base[len(ociWhiteoutPrefix):])
|
||||||
|
|
||||||
|
if w.handled[whiteout] {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return errors.Wrapf(os.RemoveAll(whiteout), errFmtWhiteoutFile, whiteout)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Handle an opaque directory. These files indicate that all siblings in
|
||||||
|
// their directory should be deleted from the current layer.
|
||||||
|
err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
|
||||||
|
if errors.Is(err, os.ErrNotExist) {
|
||||||
|
// Either this path is under a directory we already deleted or we've
|
||||||
|
// been asked to whiteout a directory that doesn't exist.
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
// Don't delete the directory we're whiting out, or a file we've
|
||||||
|
// extracted from this layer.
|
||||||
|
if path == dir || w.handled[path] {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
return os.RemoveAll(path)
|
||||||
|
})
|
||||||
|
|
||||||
|
return errors.Wrapf(err, errFmtWhiteoutDir, dir)
|
||||||
|
}
|
||||||
|
|
||||||
|
// An ExtractHandler extracts from a tarball per the supplied tar header by
|
||||||
|
// calling a handler that knows how to extract the type of file.
|
||||||
|
type ExtractHandler struct {
|
||||||
|
handler map[byte]HeaderHandler
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewExtractHandler returns a HeaderHandler that extracts from a tarball per
|
||||||
|
// the supplied tar header by calling a handler that knows how to extract the
|
||||||
|
// type of file.
|
||||||
|
func NewExtractHandler() *ExtractHandler {
|
||||||
|
return &ExtractHandler{handler: map[byte]HeaderHandler{
|
||||||
|
tar.TypeDir: HeaderHandlerFn(ExtractDir),
|
||||||
|
tar.TypeSymlink: HeaderHandlerFn(ExtractSymlink),
|
||||||
|
tar.TypeReg: HeaderHandlerFn(ExtractFile),
|
||||||
|
tar.TypeFifo: HeaderHandlerFn(ExtractFIFO),
|
||||||
|
|
||||||
|
// TODO(negz): Don't extract hard links as symlinks. Creating an actual
|
||||||
|
// hard link would require us to securely join the path of the 'root'
|
||||||
|
// directory we're untarring into with h.Linkname, but we don't
|
||||||
|
// currently plumb the root directory down to this level.
|
||||||
|
tar.TypeLink: HeaderHandlerFn(ExtractSymlink),
|
||||||
|
}}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Handle creates a file at the supplied path per the supplied tar header.
|
||||||
|
func (e *ExtractHandler) Handle(h *tar.Header, tr io.Reader, path string) error {
|
||||||
|
// ExtractDir should correct these permissions.
|
||||||
|
if err := os.MkdirAll(filepath.Dir(path), 0750); err != nil {
|
||||||
|
return errors.Wrap(err, errMkdir)
|
||||||
|
}
|
||||||
|
|
||||||
|
hd, ok := e.handler[h.Typeflag]
|
||||||
|
if !ok {
|
||||||
|
// Better to return an error than to write a partial layer. Note that
|
||||||
|
// tar.TypeBlock and tar.TypeChar in particular are unsupported because
|
||||||
|
// they can't be created without CAP_MKNOD in the 'root' user namespace
|
||||||
|
// per https://man7.org/linux/man-pages/man7/user_namespaces.7.html
|
||||||
|
return errors.Errorf(errFmtUnsupportedType, h.Name, h.Typeflag)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := hd.Handle(h, tr, path); err != nil {
|
||||||
|
return errors.Wrap(err, errExtractTarHeader)
|
||||||
|
}
|
||||||
|
|
||||||
|
// We expect to have CAP_CHOWN (inside a user namespace) when running
|
||||||
|
// this code, but if that namespace was created by a user without
|
||||||
|
// CAP_SETUID and CAP_SETGID only one UID and GID (root) will exist and
|
||||||
|
// we'll get syscall.EINVAL if we try to chown to any other. We ignore
|
||||||
|
// this error and attempt to run the function regardless; functions that
|
||||||
|
// run 'as root' (in their namespace) should work fine.
|
||||||
|
|
||||||
|
// TODO(negz): Return this error if it isn't syscall.EINVAL? Currently
|
||||||
|
// doing so would require taking a dependency on the syscall package per
|
||||||
|
// https://groups.google.com/g/golang-nuts/c/BpWN9N-hw3s.
|
||||||
|
_ = os.Lchown(path, h.Uid, h.Gid)
|
||||||
|
|
||||||
|
// TODO(negz): Handle MAC times.
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExtractDir is a HeaderHandler that creates a directory at the supplied path
|
||||||
|
// per the supplied tar header.
|
||||||
|
func ExtractDir(h *tar.Header, _ io.Reader, path string) error {
|
||||||
|
mode := h.FileInfo().Mode()
|
||||||
|
fi, err := os.Lstat(path)
|
||||||
|
if errors.Is(err, os.ErrNotExist) {
|
||||||
|
return errors.Wrap(os.MkdirAll(path, mode.Perm()), errMkdir)
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errLstat)
|
||||||
|
}
|
||||||
|
|
||||||
|
if !fi.IsDir() {
|
||||||
|
return errors.Errorf(errFmtNotDir, path)
|
||||||
|
}
|
||||||
|
|
||||||
|
// We've been asked to extract a directory that exists; just try to ensure
|
||||||
|
// it has the correct permissions. It could be that we saw a file in this
|
||||||
|
// directory before we saw the directory itself, and created it with the
|
||||||
|
// file's permissions in a MkdirAll call.
|
||||||
|
return errors.Wrap(os.Chmod(path, mode.Perm()), errChmod)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExtractSymlink is a HeaderHandler that creates a symlink at the supplied path
|
||||||
|
// per the supplied tar header.
|
||||||
|
func ExtractSymlink(h *tar.Header, _ io.Reader, path string) error {
|
||||||
|
// We don't sanitize h.LinkName (the symlink's target). It will be sanitized
|
||||||
|
// by SecureJoin above to prevent malicious writes during the untar process,
|
||||||
|
// and will be evaluated relative to root during function execution.
|
||||||
|
return errors.Wrap(os.Symlink(h.Linkname, path), errSymlink)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExtractFile is a HeaderHandler that creates a regular file at the supplied
|
||||||
|
// path per the supplied tar header.
|
||||||
|
func ExtractFile(h *tar.Header, tr io.Reader, path string) error {
|
||||||
|
mode := h.FileInfo().Mode()
|
||||||
|
|
||||||
|
//nolint:gosec // The root of this path is user supplied input.
|
||||||
|
dst, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, mode)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errOpenFile)
|
||||||
|
}
|
||||||
|
|
||||||
|
n, err := copyChunks(dst, tr, 1024*1024) // Copy in 1MB chunks.
|
||||||
|
if err != nil {
|
||||||
|
_ = dst.Close()
|
||||||
|
return errors.Wrap(err, errCopyFile)
|
||||||
|
}
|
||||||
|
if err := dst.Close(); err != nil {
|
||||||
|
return errors.Wrap(err, errCloseFile)
|
||||||
|
}
|
||||||
|
if n != h.Size {
|
||||||
|
return errors.Errorf(errFmtSize, n, path, h.Size)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// copyChunks pleases gosec per https://github.com/securego/gosec/pull/433.
|
||||||
|
// Like Copy it reads from src until EOF, it does not treat an EOF from Read as
|
||||||
|
// an error to be reported.
|
||||||
|
//
|
||||||
|
// NOTE(negz): This rule confused me at first because io.Copy appears to use a
|
||||||
|
// buffer, but in fact it bypasses it if src/dst is an io.WriterTo/ReaderFrom.
|
||||||
|
func copyChunks(dst io.Writer, src io.Reader, chunkSize int64) (int64, error) {
|
||||||
|
var written int64
|
||||||
|
for {
|
||||||
|
w, err := io.CopyN(dst, src, chunkSize)
|
||||||
|
written += w
|
||||||
|
if errors.Is(err, io.EOF) {
|
||||||
|
return written, nil
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return written, err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,31 @@
|
||||||
|
//go:build !unix
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package layer
|
||||||
|
|
||||||
|
import (
|
||||||
|
"archive/tar"
|
||||||
|
"io"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ExtractFIFO returns an error on non-Unix systems
|
||||||
|
func ExtractFIFO(_ *tar.Header, _ io.Reader, _ string) error {
|
||||||
|
return errors.New("FIFOs are only supported on Unix")
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,466 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package layer
|
||||||
|
|
||||||
|
import (
|
||||||
|
"archive/tar"
|
||||||
|
"bytes"
|
||||||
|
"context"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/google/go-cmp/cmp"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/test"
|
||||||
|
)
|
||||||
|
|
||||||
|
type MockHandler struct{ err error }
|
||||||
|
|
||||||
|
func (h *MockHandler) Handle(_ *tar.Header, _ io.Reader, _ string) error {
|
||||||
|
return h.err
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestStackingExtractor(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
coolFile := "/cool/file"
|
||||||
|
cancelled, cancel := context.WithCancel(context.Background())
|
||||||
|
cancel()
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
ctx context.Context
|
||||||
|
tb io.Reader
|
||||||
|
root string
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
e *StackingExtractor
|
||||||
|
args args
|
||||||
|
want error
|
||||||
|
}{
|
||||||
|
"ContextDone": {
|
||||||
|
reason: "If the supplied context is done we should return its error.",
|
||||||
|
e: NewStackingExtractor(&MockHandler{}),
|
||||||
|
args: args{
|
||||||
|
ctx: cancelled,
|
||||||
|
},
|
||||||
|
want: cancelled.Err(),
|
||||||
|
},
|
||||||
|
"NotATarball": {
|
||||||
|
reason: "If the supplied io.Reader is not a tarball we should return an error.",
|
||||||
|
e: NewStackingExtractor(&MockHandler{}),
|
||||||
|
args: args{
|
||||||
|
ctx: context.Background(),
|
||||||
|
tb: func() io.Reader {
|
||||||
|
b := &bytes.Buffer{}
|
||||||
|
_, _ = b.WriteString("hi!")
|
||||||
|
return b
|
||||||
|
}(),
|
||||||
|
},
|
||||||
|
want: errors.Wrap(errors.New("unexpected EOF"), errAdvanceTarball),
|
||||||
|
},
|
||||||
|
"ErrorHandlingHeader": {
|
||||||
|
reason: "If our HeaderHandler returns an error we should surface it.",
|
||||||
|
e: NewStackingExtractor(&MockHandler{err: errBoom}),
|
||||||
|
args: args{
|
||||||
|
ctx: context.Background(),
|
||||||
|
tb: func() io.Reader {
|
||||||
|
b := &bytes.Buffer{}
|
||||||
|
tb := tar.NewWriter(b)
|
||||||
|
tb.WriteHeader(&tar.Header{
|
||||||
|
Typeflag: tar.TypeReg,
|
||||||
|
Name: coolFile,
|
||||||
|
})
|
||||||
|
_, _ = io.WriteString(tb, "hi!")
|
||||||
|
tb.Close()
|
||||||
|
return b
|
||||||
|
}(),
|
||||||
|
},
|
||||||
|
want: errors.Wrapf(errBoom, errFmtHandleTarHeader, coolFile),
|
||||||
|
},
|
||||||
|
"Success": {
|
||||||
|
reason: "If we successfully extract our tarball we should return a nil error.",
|
||||||
|
e: NewStackingExtractor(&MockHandler{}),
|
||||||
|
args: args{
|
||||||
|
ctx: context.Background(),
|
||||||
|
tb: func() io.Reader {
|
||||||
|
b := &bytes.Buffer{}
|
||||||
|
tb := tar.NewWriter(b)
|
||||||
|
tb.WriteHeader(&tar.Header{
|
||||||
|
Typeflag: tar.TypeReg,
|
||||||
|
Name: coolFile,
|
||||||
|
})
|
||||||
|
_, _ = io.WriteString(tb, "hi!")
|
||||||
|
tb.Close()
|
||||||
|
return b
|
||||||
|
}(),
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := tc.e.Apply(tc.args.ctx, tc.args.tb, tc.args.root)
|
||||||
|
if diff := cmp.Diff(tc.want, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\ne.Apply(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWhiteoutHandler(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
|
||||||
|
tmp, _ := os.MkdirTemp(os.TempDir(), t.Name())
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
coolDir := filepath.Join(tmp, "cool")
|
||||||
|
coolFile := filepath.Join(coolDir, "file")
|
||||||
|
coolWhiteout := filepath.Join(coolDir, ociWhiteoutPrefix+"file")
|
||||||
|
_ = os.MkdirAll(coolDir, 0700)
|
||||||
|
|
||||||
|
opaqueDir := filepath.Join(tmp, "opaque")
|
||||||
|
opaqueDirWhiteout := filepath.Join(opaqueDir, ociWhiteoutOpaqueDir)
|
||||||
|
_ = os.MkdirAll(opaqueDir, 0700)
|
||||||
|
f, _ := os.Create(filepath.Join(opaqueDir, "some-file"))
|
||||||
|
f.Close()
|
||||||
|
|
||||||
|
nonExistentDirWhiteout := filepath.Join(tmp, "non-exist", ociWhiteoutOpaqueDir)
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
h *tar.Header
|
||||||
|
tr io.Reader
|
||||||
|
path string
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
h HeaderHandler
|
||||||
|
args args
|
||||||
|
want error
|
||||||
|
}{
|
||||||
|
"NotAWhiteout": {
|
||||||
|
reason: "Files that aren't whiteouts should be passed to the underlying handler.",
|
||||||
|
h: NewWhiteoutHandler(&MockHandler{err: errBoom}),
|
||||||
|
args: args{
|
||||||
|
path: coolFile,
|
||||||
|
},
|
||||||
|
want: errBoom,
|
||||||
|
},
|
||||||
|
"HeaderAlreadyHandled": {
|
||||||
|
reason: "We shouldn't whiteout a file that was already handled.",
|
||||||
|
h: func() HeaderHandler {
|
||||||
|
w := NewWhiteoutHandler(&MockHandler{})
|
||||||
|
_ = w.Handle(nil, nil, coolFile) // Handle the file we'll try to whiteout.
|
||||||
|
return w
|
||||||
|
}(),
|
||||||
|
args: args{
|
||||||
|
path: coolWhiteout,
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
"WhiteoutFile": {
|
||||||
|
reason: "We should delete a whited-out file.",
|
||||||
|
h: NewWhiteoutHandler(&MockHandler{}),
|
||||||
|
args: args{
|
||||||
|
path: filepath.Join(tmp, coolWhiteout),
|
||||||
|
},
|
||||||
|
// os.RemoveAll won't return an error even if this doesn't exist.
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
"OpaqueDirDoesNotExist": {
|
||||||
|
reason: "We should return early if asked to whiteout a directory that doesn't exist.",
|
||||||
|
h: NewWhiteoutHandler(&MockHandler{}),
|
||||||
|
args: args{
|
||||||
|
path: nonExistentDirWhiteout,
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
"WhiteoutOpaqueDir": {
|
||||||
|
reason: "We should whiteout all files in an opaque directory.",
|
||||||
|
h: NewWhiteoutHandler(&MockHandler{}),
|
||||||
|
args: args{
|
||||||
|
path: opaqueDirWhiteout,
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := tc.h.Handle(tc.args.h, tc.args.tr, tc.args.path)
|
||||||
|
if diff := cmp.Diff(tc.want, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nh.Handle(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestExtractHandler(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
|
||||||
|
tmp, _ := os.MkdirTemp(os.TempDir(), t.Name())
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
coolDir := filepath.Join(tmp, "cool")
|
||||||
|
coolFile := filepath.Join(coolDir, "file")
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
h *tar.Header
|
||||||
|
tr io.Reader
|
||||||
|
path string
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
h HeaderHandler
|
||||||
|
args args
|
||||||
|
want error
|
||||||
|
}{
|
||||||
|
"UnsupportedMode": {
|
||||||
|
reason: "Handling an unsupported file type should return an error.",
|
||||||
|
h: &ExtractHandler{handler: map[byte]HeaderHandler{}},
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{
|
||||||
|
Typeflag: tar.TypeReg,
|
||||||
|
Name: coolFile,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: errors.Errorf(errFmtUnsupportedType, coolFile, tar.TypeReg),
|
||||||
|
},
|
||||||
|
"HandlerError": {
|
||||||
|
reason: "Errors from an underlying handler should be returned.",
|
||||||
|
h: &ExtractHandler{handler: map[byte]HeaderHandler{
|
||||||
|
tar.TypeReg: &MockHandler{err: errBoom},
|
||||||
|
}},
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{
|
||||||
|
Typeflag: tar.TypeReg,
|
||||||
|
Name: coolFile,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: errors.Wrap(errBoom, errExtractTarHeader),
|
||||||
|
},
|
||||||
|
"Success": {
|
||||||
|
reason: "If the underlying handler works we should return a nil error.",
|
||||||
|
h: &ExtractHandler{handler: map[byte]HeaderHandler{
|
||||||
|
tar.TypeReg: &MockHandler{},
|
||||||
|
}},
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{
|
||||||
|
Typeflag: tar.TypeReg,
|
||||||
|
|
||||||
|
// We don't currently check the return value of Lchown, but
|
||||||
|
// this will increase the chances it works by ensuring we
|
||||||
|
// try to chown to our own UID/GID.
|
||||||
|
Uid: os.Getuid(),
|
||||||
|
Gid: os.Getgid(),
|
||||||
|
},
|
||||||
|
path: coolFile,
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := tc.h.Handle(tc.args.h, tc.args.tr, tc.args.path)
|
||||||
|
if diff := cmp.Diff(tc.want, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nh.Handle(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestExtractDir(t *testing.T) {
|
||||||
|
tmp, _ := os.MkdirTemp(os.TempDir(), t.Name())
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
newDir := filepath.Join(tmp, "new")
|
||||||
|
existingDir := filepath.Join(tmp, "existing-dir")
|
||||||
|
existingFile := filepath.Join(tmp, "existing-file")
|
||||||
|
_ = os.MkdirAll(existingDir, 0700)
|
||||||
|
f, _ := os.Create(existingFile)
|
||||||
|
f.Close()
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
h *tar.Header
|
||||||
|
tr io.Reader
|
||||||
|
path string
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
h HeaderHandler
|
||||||
|
args args
|
||||||
|
want error
|
||||||
|
}{
|
||||||
|
"ExistingPathIsNotADir": {
|
||||||
|
reason: "We should return an error if trying to extract a dir to a path that exists but is not a dir.",
|
||||||
|
h: HeaderHandlerFn(ExtractDir),
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{Mode: 0700},
|
||||||
|
path: existingFile,
|
||||||
|
},
|
||||||
|
want: errors.Errorf(errFmtNotDir, existingFile),
|
||||||
|
},
|
||||||
|
"SuccessfulCreate": {
|
||||||
|
reason: "We should not return an error if we can create the dir.",
|
||||||
|
h: HeaderHandlerFn(ExtractDir),
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{Mode: 0700},
|
||||||
|
path: newDir,
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
"SuccessfulChmod": {
|
||||||
|
reason: "We should not return an error if we can chmod the existing dir",
|
||||||
|
h: HeaderHandlerFn(ExtractDir),
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{Mode: 0700},
|
||||||
|
path: existingDir,
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := tc.h.Handle(tc.args.h, tc.args.tr, tc.args.path)
|
||||||
|
if diff := cmp.Diff(tc.want, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nh.Handle(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestExtractSymlink(t *testing.T) {
|
||||||
|
tmp, _ := os.MkdirTemp(os.TempDir(), t.Name())
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
linkSrc := filepath.Join(tmp, "src")
|
||||||
|
linkDst := filepath.Join(tmp, "dst")
|
||||||
|
inNonExistentDir := filepath.Join(tmp, "non-exist", "src")
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
h *tar.Header
|
||||||
|
tr io.Reader
|
||||||
|
path string
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
h HeaderHandler
|
||||||
|
args args
|
||||||
|
want error
|
||||||
|
}{
|
||||||
|
"SymlinkError": {
|
||||||
|
reason: "We should return an error if we can't create a symlink",
|
||||||
|
h: HeaderHandlerFn(ExtractSymlink),
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{Linkname: linkDst},
|
||||||
|
path: inNonExistentDir,
|
||||||
|
},
|
||||||
|
want: errors.Wrap(errors.Errorf("symlink %s %s: no such file or directory", linkDst, inNonExistentDir), errSymlink),
|
||||||
|
},
|
||||||
|
"Successful": {
|
||||||
|
reason: "We should not return an error if we can create a symlink",
|
||||||
|
h: HeaderHandlerFn(ExtractSymlink),
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{Linkname: linkDst},
|
||||||
|
path: linkSrc,
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := tc.h.Handle(tc.args.h, tc.args.tr, tc.args.path)
|
||||||
|
if diff := cmp.Diff(tc.want, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nh.Handle(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestExtractFile(t *testing.T) {
|
||||||
|
tmp, _ := os.MkdirTemp(os.TempDir(), t.Name())
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
inNonExistentDir := filepath.Join(tmp, "non-exist", "file")
|
||||||
|
newFile := filepath.Join(tmp, "coolFile")
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
h *tar.Header
|
||||||
|
tr io.Reader
|
||||||
|
path string
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
h HeaderHandler
|
||||||
|
args args
|
||||||
|
want error
|
||||||
|
}{
|
||||||
|
"OpenFileError": {
|
||||||
|
reason: "We should return an error if we can't create a file",
|
||||||
|
h: HeaderHandlerFn(ExtractFile),
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{},
|
||||||
|
path: inNonExistentDir,
|
||||||
|
},
|
||||||
|
want: errors.Wrap(errors.Errorf("open %s: no such file or directory", inNonExistentDir), errOpenFile),
|
||||||
|
},
|
||||||
|
"SuccessfulWRite": {
|
||||||
|
reason: "We should return a nil error if we successfully wrote the file.",
|
||||||
|
h: HeaderHandlerFn(ExtractFile),
|
||||||
|
args: func() args {
|
||||||
|
b := &bytes.Buffer{}
|
||||||
|
tw := tar.NewWriter(b)
|
||||||
|
|
||||||
|
content := []byte("hi!")
|
||||||
|
h := &tar.Header{
|
||||||
|
Typeflag: tar.TypeReg,
|
||||||
|
Mode: 0600,
|
||||||
|
Size: int64(len(content)),
|
||||||
|
}
|
||||||
|
|
||||||
|
_ = tw.WriteHeader(h)
|
||||||
|
_, _ = tw.Write(content)
|
||||||
|
_ = tw.Close()
|
||||||
|
|
||||||
|
tr := tar.NewReader(b)
|
||||||
|
tr.Next()
|
||||||
|
|
||||||
|
return args{
|
||||||
|
h: h,
|
||||||
|
tr: tr,
|
||||||
|
path: newFile,
|
||||||
|
}
|
||||||
|
}(),
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := tc.h.Handle(tc.args.h, tc.args.tr, tc.args.path)
|
||||||
|
if diff := cmp.Diff(tc.want, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nh.Handle(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
//go:build unix
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package layer
|
||||||
|
|
||||||
|
import (
|
||||||
|
"archive/tar"
|
||||||
|
"io"
|
||||||
|
|
||||||
|
"golang.org/x/sys/unix"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings.
|
||||||
|
const (
|
||||||
|
errCreateFIFO = "cannot create FIFO"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ExtractFIFO is a HeaderHandler that creates a FIFO at the supplied path per
|
||||||
|
// the supplied tar header.
|
||||||
|
func ExtractFIFO(h *tar.Header, _ io.Reader, path string) error {
|
||||||
|
// We won't have CAP_MKNOD in a user namespace created by a user who doesn't
|
||||||
|
// have CAP_MKNOD in the initial/root user namespace, but we don't need it
|
||||||
|
// to use mknod to create a FIFO.
|
||||||
|
// https://man7.org/linux/man-pages/man2/mknod.2.html
|
||||||
|
mode := uint32(h.Mode&0777) | unix.S_IFIFO
|
||||||
|
dev := unix.Mkdev(uint32(h.Devmajor), uint32(h.Devminor))
|
||||||
|
return errors.Wrap(unix.Mknod(path, mode, int(dev)), errCreateFIFO)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,78 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package layer
|
||||||
|
|
||||||
|
import (
|
||||||
|
"archive/tar"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/google/go-cmp/cmp"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/test"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestExtractFIFO(t *testing.T) {
|
||||||
|
tmp, _ := os.MkdirTemp(os.TempDir(), t.Name())
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
inNonExistentDir := filepath.Join(tmp, "non-exist", "src")
|
||||||
|
newFIFO := filepath.Join(tmp, "fifo")
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
h *tar.Header
|
||||||
|
tr io.Reader
|
||||||
|
path string
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
h HeaderHandler
|
||||||
|
args args
|
||||||
|
want error
|
||||||
|
}{
|
||||||
|
"FIFOError": {
|
||||||
|
reason: "We should return an error if we can't create a FIFO",
|
||||||
|
h: HeaderHandlerFn(ExtractFIFO),
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{Mode: 0700},
|
||||||
|
path: inNonExistentDir,
|
||||||
|
},
|
||||||
|
want: errors.Wrap(errors.New("no such file or directory"), errCreateFIFO),
|
||||||
|
},
|
||||||
|
"Successful": {
|
||||||
|
reason: "We should not return an error if we can create a symlink",
|
||||||
|
h: HeaderHandlerFn(ExtractFIFO),
|
||||||
|
args: args{
|
||||||
|
h: &tar.Header{Mode: 0700},
|
||||||
|
path: newFIFO,
|
||||||
|
},
|
||||||
|
want: nil,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := tc.h.Handle(tc.args.h, tc.args.tr, tc.args.path)
|
||||||
|
if diff := cmp.Diff(tc.want, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nh.Handle(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,250 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package oci
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/tls"
|
||||||
|
"crypto/x509"
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"github.com/google/go-containerregistry/pkg/authn"
|
||||||
|
"github.com/google/go-containerregistry/pkg/name"
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
"github.com/google/go-containerregistry/pkg/v1/remote"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings.
|
||||||
|
const (
|
||||||
|
errPullNever = "refusing to pull from remote with image pull policy " + string(ImagePullPolicyNever)
|
||||||
|
errNewDigestStore = "cannot create new image digest store"
|
||||||
|
errPullImage = "cannot pull image from remote"
|
||||||
|
errStoreImage = "cannot cache image"
|
||||||
|
errImageDigest = "cannot get image digest"
|
||||||
|
errStoreDigest = "cannot cache image digest"
|
||||||
|
errLoadImage = "cannot load image from cache"
|
||||||
|
errLoadHash = "cannot load image digest"
|
||||||
|
)
|
||||||
|
|
||||||
|
// An ImagePullPolicy dictates when an image may be pulled from a remote.
|
||||||
|
type ImagePullPolicy string
|
||||||
|
|
||||||
|
// Image pull policies
|
||||||
|
const (
|
||||||
|
// ImagePullPolicyIfNotPresent only pulls from a remote if the image is not
|
||||||
|
// in the local cache. It is equivalent to ImagePullPolicyNever with a
|
||||||
|
// fall-back to ImagePullPolicyAlways.
|
||||||
|
ImagePullPolicyIfNotPresent ImagePullPolicy = "IfNotPresent"
|
||||||
|
|
||||||
|
// ImagePullPolicyAlways always pulls at least the image manifest from the
|
||||||
|
// remote. Layers are pulled if they are not in cache.
|
||||||
|
ImagePullPolicyAlways ImagePullPolicy = "Always"
|
||||||
|
|
||||||
|
// ImagePullPolicyNever never pulls anything from the remote. It resolves
|
||||||
|
// OCI references to digests (i.e. SHAs) using a local cache of known
|
||||||
|
// mappings.
|
||||||
|
ImagePullPolicyNever ImagePullPolicy = "Never"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ImagePullAuth configures authentication to a remote registry.
|
||||||
|
type ImagePullAuth struct {
|
||||||
|
Username string
|
||||||
|
Password string
|
||||||
|
Auth string
|
||||||
|
|
||||||
|
// IdentityToken is used to authenticate the user and get
|
||||||
|
// an access token for the registry.
|
||||||
|
IdentityToken string
|
||||||
|
|
||||||
|
// RegistryToken is a bearer token to be sent to a registry.
|
||||||
|
RegistryToken string
|
||||||
|
}
|
||||||
|
|
||||||
|
// Authorization builds a go-containerregistry compatible AuthConfig.
|
||||||
|
func (a ImagePullAuth) Authorization() (*authn.AuthConfig, error) {
|
||||||
|
return &authn.AuthConfig{
|
||||||
|
Username: a.Username,
|
||||||
|
Password: a.Password,
|
||||||
|
Auth: a.Auth,
|
||||||
|
IdentityToken: a.IdentityToken,
|
||||||
|
RegistryToken: a.RegistryToken,
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ImageClientOptions configure an ImageClient.
|
||||||
|
type ImageClientOptions struct {
|
||||||
|
pull ImagePullPolicy
|
||||||
|
auth *ImagePullAuth
|
||||||
|
transport *http.Transport
|
||||||
|
}
|
||||||
|
|
||||||
|
func parse(o ...ImageClientOption) ImageClientOptions {
|
||||||
|
opt := &ImageClientOptions{
|
||||||
|
pull: ImagePullPolicyIfNotPresent, // The default.
|
||||||
|
}
|
||||||
|
for _, fn := range o {
|
||||||
|
fn(opt)
|
||||||
|
}
|
||||||
|
return *opt
|
||||||
|
}
|
||||||
|
|
||||||
|
// An ImageClientOption configures an ImageClient.
|
||||||
|
type ImageClientOption func(c *ImageClientOptions)
|
||||||
|
|
||||||
|
// WithPullPolicy specifies whether a client may pull from a remote.
|
||||||
|
func WithPullPolicy(p ImagePullPolicy) ImageClientOption {
|
||||||
|
return func(c *ImageClientOptions) {
|
||||||
|
c.pull = p
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithPullAuth specifies how a client should authenticate to a remote.
|
||||||
|
func WithPullAuth(a *ImagePullAuth) ImageClientOption {
|
||||||
|
return func(c *ImageClientOptions) {
|
||||||
|
c.auth = a
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithCustomCA adds given root certificates to tls client configuration
|
||||||
|
func WithCustomCA(rootCAs *x509.CertPool) ImageClientOption {
|
||||||
|
return func(c *ImageClientOptions) {
|
||||||
|
c.transport = remote.DefaultTransport.(*http.Transport).Clone()
|
||||||
|
c.transport.TLSClientConfig = &tls.Config{RootCAs: rootCAs, MinVersion: tls.VersionTLS12}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// An ImageClient is an OCI registry client.
|
||||||
|
type ImageClient interface {
|
||||||
|
// Image pulls an OCI image.
|
||||||
|
Image(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
// An ImageCache caches OCI images.
|
||||||
|
type ImageCache interface {
|
||||||
|
Image(h ociv1.Hash) (ociv1.Image, error)
|
||||||
|
WriteImage(img ociv1.Image) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A HashCache maps OCI references to hashes.
|
||||||
|
type HashCache interface {
|
||||||
|
Hash(r name.Reference) (ociv1.Hash, error)
|
||||||
|
WriteHash(r name.Reference, h ociv1.Hash) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RemoteClient fetches OCI image manifests.
|
||||||
|
type RemoteClient struct{}
|
||||||
|
|
||||||
|
// Image fetches an image manifest. The returned image lazily pulls its layers.
|
||||||
|
func (i *RemoteClient) Image(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
opts := parse(o...)
|
||||||
|
iOpts := []remote.Option{remote.WithContext(ctx)}
|
||||||
|
if opts.auth != nil {
|
||||||
|
iOpts = append(iOpts, remote.WithAuth(opts.auth))
|
||||||
|
}
|
||||||
|
if opts.transport != nil {
|
||||||
|
iOpts = append(iOpts, remote.WithTransport(opts.transport))
|
||||||
|
}
|
||||||
|
if opts.pull == ImagePullPolicyNever {
|
||||||
|
return nil, errors.New(errPullNever)
|
||||||
|
}
|
||||||
|
return remote.Image(ref, iOpts...)
|
||||||
|
}
|
||||||
|
|
||||||
|
// A CachingPuller pulls OCI images. Images are pulled either from a local cache
|
||||||
|
// or a remote depending on whether they are available locally and a supplied
|
||||||
|
// ImagePullPolicy.
|
||||||
|
type CachingPuller struct {
|
||||||
|
remote ImageClient
|
||||||
|
local ImageCache
|
||||||
|
mapping HashCache
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewCachingPuller returns an OCI image puller with a local cache.
|
||||||
|
func NewCachingPuller(h HashCache, i ImageCache, r ImageClient) *CachingPuller {
|
||||||
|
return &CachingPuller{remote: r, local: i, mapping: h}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Image pulls the supplied image and all of its layers. The supplied config
|
||||||
|
// determines where the image may be pulled from - i.e. the local store or a
|
||||||
|
// remote. Images that are pulled from a remote are cached in the local store.
|
||||||
|
func (f *CachingPuller) Image(ctx context.Context, r name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
opts := parse(o...)
|
||||||
|
|
||||||
|
switch opts.pull {
|
||||||
|
case ImagePullPolicyNever:
|
||||||
|
return f.never(r)
|
||||||
|
case ImagePullPolicyAlways:
|
||||||
|
return f.always(ctx, r, o...)
|
||||||
|
case ImagePullPolicyIfNotPresent:
|
||||||
|
fallthrough
|
||||||
|
default:
|
||||||
|
img, err := f.never(r)
|
||||||
|
if err == nil {
|
||||||
|
return img, nil
|
||||||
|
}
|
||||||
|
return f.always(ctx, r, o...)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
func (f *CachingPuller) never(r name.Reference) (ociv1.Image, error) {
|
||||||
|
var h ociv1.Hash
|
||||||
|
var err error
|
||||||
|
|
||||||
|
// Avoid a cache lookup if the digest was specified explicitly.
|
||||||
|
switch d := r.(type) {
|
||||||
|
case name.Digest:
|
||||||
|
h, err = ociv1.NewHash(d.DigestStr())
|
||||||
|
default:
|
||||||
|
h, err = f.mapping.Hash(r)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errLoadHash)
|
||||||
|
}
|
||||||
|
|
||||||
|
i, err := f.local.Image(h)
|
||||||
|
return i, errors.Wrap(err, errLoadImage)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (f *CachingPuller) always(ctx context.Context, r name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
// This will only pull the image's manifest and config, not layers.
|
||||||
|
img, err := f.remote.Image(ctx, r, o...)
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errPullImage)
|
||||||
|
}
|
||||||
|
|
||||||
|
// This will fetch any layers that aren't already in the store.
|
||||||
|
if err := f.local.WriteImage(img); err != nil {
|
||||||
|
return nil, errors.Wrap(err, errStoreImage)
|
||||||
|
}
|
||||||
|
|
||||||
|
d, err := img.Digest()
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errImageDigest)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Store a mapping from this reference to its digest.
|
||||||
|
if err := f.mapping.WriteHash(r, d); err != nil {
|
||||||
|
return nil, errors.Wrap(err, errStoreDigest)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Return the stored image to ensure future reads are from disk, not
|
||||||
|
// from remote.
|
||||||
|
img, err = f.local.Image(d)
|
||||||
|
return img, errors.Wrap(err, errLoadImage)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,402 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package oci
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/x509"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/google/go-cmp/cmp"
|
||||||
|
"github.com/google/go-containerregistry/pkg/name"
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/test"
|
||||||
|
)
|
||||||
|
|
||||||
|
type MockImage struct {
|
||||||
|
ociv1.Image
|
||||||
|
|
||||||
|
MockDigest func() (ociv1.Hash, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (i *MockImage) Digest() (ociv1.Hash, error) { return i.MockDigest() }
|
||||||
|
|
||||||
|
type MockImageClient struct {
|
||||||
|
MockImage func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *MockImageClient) Image(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return c.MockImage(ctx, ref, o...)
|
||||||
|
}
|
||||||
|
|
||||||
|
type MockImageCache struct {
|
||||||
|
MockImage func(h ociv1.Hash) (ociv1.Image, error)
|
||||||
|
MockWriteImage func(img ociv1.Image) error
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *MockImageCache) Image(h ociv1.Hash) (ociv1.Image, error) {
|
||||||
|
return c.MockImage(h)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *MockImageCache) WriteImage(img ociv1.Image) error {
|
||||||
|
return c.MockWriteImage(img)
|
||||||
|
}
|
||||||
|
|
||||||
|
type MockHashCache struct {
|
||||||
|
MockHash func(r name.Reference) (ociv1.Hash, error)
|
||||||
|
MockWriteHash func(r name.Reference, h ociv1.Hash) error
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *MockHashCache) Hash(r name.Reference) (ociv1.Hash, error) {
|
||||||
|
return c.MockHash(r)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *MockHashCache) WriteHash(r name.Reference, h ociv1.Hash) error {
|
||||||
|
return c.MockWriteHash(r, h)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestImage(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
coolImage := &MockImage{}
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
ctx context.Context
|
||||||
|
r name.Reference
|
||||||
|
o []ImageClientOption
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
i ociv1.Image
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
p *CachingPuller
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"NeverPullHashError": {
|
||||||
|
reason: "We should return an error if we must but can't read a hash from our HashStore.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockHash: func(r name.Reference) (ociv1.Hash, error) { return ociv1.Hash{}, errBoom },
|
||||||
|
},
|
||||||
|
&MockImageCache{},
|
||||||
|
&MockImageClient{},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyNever)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errLoadHash),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NeverPullImageError": {
|
||||||
|
reason: "We should return an error if we must but can't read our image from cache.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockHash: func(r name.Reference) (ociv1.Hash, error) { return ociv1.Hash{}, nil },
|
||||||
|
},
|
||||||
|
&MockImageCache{
|
||||||
|
MockImage: func(h ociv1.Hash) (ociv1.Image, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
&MockImageClient{},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyNever)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errLoadImage),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NeverPullSuccess": {
|
||||||
|
reason: "We should return our image from cache.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockHash: func(r name.Reference) (ociv1.Hash, error) { return ociv1.Hash{}, nil },
|
||||||
|
},
|
||||||
|
&MockImageCache{
|
||||||
|
MockImage: func(h ociv1.Hash) (ociv1.Image, error) { return coolImage, nil },
|
||||||
|
},
|
||||||
|
&MockImageClient{},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyNever)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
i: coolImage,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NeverPullSuccessExplicit": {
|
||||||
|
reason: "We should return our image from cache without looking up its digest if the digest was specified explicitly.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{},
|
||||||
|
&MockImageCache{
|
||||||
|
MockImage: func(h ociv1.Hash) (ociv1.Image, error) {
|
||||||
|
if h.Hex != "c34045c1a1db8d1b3fca8a692198466952daae07eaf6104b4c87ed3b55b6af1b" {
|
||||||
|
return nil, errors.New("unexpected hash")
|
||||||
|
}
|
||||||
|
return coolImage, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
&MockImageClient{},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
r: name.MustParseReference("example.org/coolimage@sha256:c34045c1a1db8d1b3fca8a692198466952daae07eaf6104b4c87ed3b55b6af1b"),
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyNever)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
i: coolImage,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"AlwaysPullRemoteError": {
|
||||||
|
reason: "We should return an error if we must but can't pull our image manifest from the remote.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{},
|
||||||
|
&MockImageCache{},
|
||||||
|
&MockImageClient{
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return nil, errBoom
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyAlways)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errPullImage),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"AlwaysPullWriteImageError": {
|
||||||
|
reason: "We should return an error if we must but can't write our image to the local cache.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{},
|
||||||
|
&MockImageCache{
|
||||||
|
MockWriteImage: func(img ociv1.Image) error { return errBoom },
|
||||||
|
},
|
||||||
|
&MockImageClient{
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return nil, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyAlways)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errStoreImage),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"AlwaysPullImageDigestError": {
|
||||||
|
reason: "We should return an error if we can't get our image's digest.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{},
|
||||||
|
&MockImageCache{
|
||||||
|
MockWriteImage: func(img ociv1.Image) error { return nil },
|
||||||
|
},
|
||||||
|
&MockImageClient{
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{}, errBoom },
|
||||||
|
}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyAlways)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errImageDigest),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"AlwaysPullWriteDigestError": {
|
||||||
|
reason: "We should return an error if we can't write our digest mapping to the cache.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockWriteHash: func(r name.Reference, h ociv1.Hash) error { return errBoom },
|
||||||
|
},
|
||||||
|
&MockImageCache{
|
||||||
|
MockWriteImage: func(img ociv1.Image) error { return nil },
|
||||||
|
},
|
||||||
|
&MockImageClient{
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{}, nil },
|
||||||
|
}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyAlways)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errStoreDigest),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"AlwaysPullImageError": {
|
||||||
|
reason: "We should return an error if we must but can't read our image back from cache.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockWriteHash: func(r name.Reference, h ociv1.Hash) error { return nil },
|
||||||
|
},
|
||||||
|
&MockImageCache{
|
||||||
|
MockWriteImage: func(img ociv1.Image) error { return nil },
|
||||||
|
MockImage: func(h ociv1.Hash) (ociv1.Image, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
&MockImageClient{
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{}, nil },
|
||||||
|
}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyAlways)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errLoadImage),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"AlwaysPullSuccess": {
|
||||||
|
reason: "We should return a pulled and cached image.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockWriteHash: func(r name.Reference, h ociv1.Hash) error { return nil },
|
||||||
|
},
|
||||||
|
&MockImageCache{
|
||||||
|
MockWriteImage: func(img ociv1.Image) error { return nil },
|
||||||
|
MockImage: func(h ociv1.Hash) (ociv1.Image, error) { return &MockImage{}, nil },
|
||||||
|
},
|
||||||
|
&MockImageClient{
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{}, nil },
|
||||||
|
}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyAlways)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
i: &MockImage{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"PullWithCustomCA": {
|
||||||
|
reason: "We should return a pulled and cached image.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockHash: func(r name.Reference) (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{}, errors.New("this error should not be returned")
|
||||||
|
},
|
||||||
|
MockWriteHash: func(r name.Reference, h ociv1.Hash) error {
|
||||||
|
return nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
&MockImageCache{
|
||||||
|
MockWriteImage: func(img ociv1.Image) error { return nil },
|
||||||
|
MockImage: func(h ociv1.Hash) (ociv1.Image, error) { return &MockImage{}, nil },
|
||||||
|
},
|
||||||
|
&MockImageClient{
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
if len(o) != 1 {
|
||||||
|
return nil, errors.New("the number of options should be one")
|
||||||
|
}
|
||||||
|
c := &ImageClientOptions{}
|
||||||
|
o[0](c)
|
||||||
|
if c.transport == nil {
|
||||||
|
return nil, errors.New("Transport should be set")
|
||||||
|
}
|
||||||
|
return &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{}, nil },
|
||||||
|
}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithCustomCA(&x509.CertPool{})},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
i: &MockImage{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"IfNotPresentTriesCacheFirst": {
|
||||||
|
reason: "The IfNotPresent policy should try to read from cache first.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockHash: func(r name.Reference) (ociv1.Hash, error) { return ociv1.Hash{}, nil },
|
||||||
|
},
|
||||||
|
&MockImageCache{
|
||||||
|
MockImage: func(h ociv1.Hash) (ociv1.Image, error) { return &MockImage{}, nil },
|
||||||
|
},
|
||||||
|
&MockImageClient{
|
||||||
|
// If we get here it indicates we called always.
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return nil, errors.New("this error should not be returned")
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyIfNotPresent)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
i: &MockImage{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"IfNotPresentFallsBackToRemote": {
|
||||||
|
reason: "The IfNotPresent policy should fall back to pulling from the remote if it can't read the image from cache.",
|
||||||
|
p: NewCachingPuller(
|
||||||
|
&MockHashCache{
|
||||||
|
MockHash: func(r name.Reference) (ociv1.Hash, error) {
|
||||||
|
// Trigger a fall-back from never to always.
|
||||||
|
return ociv1.Hash{}, errors.New("this error should not be returned")
|
||||||
|
},
|
||||||
|
},
|
||||||
|
&MockImageCache{},
|
||||||
|
&MockImageClient{
|
||||||
|
MockImage: func(ctx context.Context, ref name.Reference, o ...ImageClientOption) (ociv1.Image, error) {
|
||||||
|
return nil, errBoom
|
||||||
|
},
|
||||||
|
},
|
||||||
|
),
|
||||||
|
args: args{
|
||||||
|
o: []ImageClientOption{WithPullPolicy(ImagePullPolicyIfNotPresent)},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
// This indicates we fell back to always.
|
||||||
|
err: errors.Wrap(errBoom, errPullImage),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
|
||||||
|
i, err := tc.p.Image(tc.args.ctx, tc.args.r, tc.args.o...)
|
||||||
|
if diff := cmp.Diff(tc.want.i, i); diff != "" {
|
||||||
|
t.Errorf("\n%s\nImage(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nImage(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,81 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package spec
|
||||||
|
|
||||||
|
// The below is all copied from k/k to avoid taking a dependency.
|
||||||
|
// https://github.com/kubernetes/kubernetes/blob/685d639/pkg/kubelet/cm/helpers_linux.go
|
||||||
|
|
||||||
|
const (
|
||||||
|
// These limits are defined in the kernel:
|
||||||
|
// https://github.com/torvalds/linux/blob/0bddd227f3dc55975e2b8dfa7fc6f959b062a2c7/kernel/sched/sched.h#L427-L428
|
||||||
|
minShares = 2
|
||||||
|
maxShares = 262144
|
||||||
|
|
||||||
|
sharesPerCPU = 1024
|
||||||
|
milliCPUToCPU = 1000
|
||||||
|
|
||||||
|
// 100000 microseconds is equivalent to 100ms
|
||||||
|
quotaPeriod = 100000
|
||||||
|
|
||||||
|
// 1000 microseconds is equivalent to 1ms
|
||||||
|
// defined here:
|
||||||
|
// https://github.com/torvalds/linux/blob/cac03ac368fabff0122853de2422d4e17a32de08/kernel/sched/core.c#L10546
|
||||||
|
minQuotaPeriod = 1000
|
||||||
|
)
|
||||||
|
|
||||||
|
// milliCPUToShares converts the milliCPU to CFS shares.
|
||||||
|
func milliCPUToShares(milliCPU int64) uint64 {
|
||||||
|
if milliCPU == 0 {
|
||||||
|
// Docker converts zero milliCPU to unset, which maps to kernel default
|
||||||
|
// for unset: 1024. Return 2 here to really match kernel default for
|
||||||
|
// zero milliCPU.
|
||||||
|
return minShares
|
||||||
|
}
|
||||||
|
// Conceptually (milliCPU / milliCPUToCPU) * sharesPerCPU, but factored to improve rounding.
|
||||||
|
shares := (milliCPU * sharesPerCPU) / milliCPUToCPU
|
||||||
|
if shares < minShares {
|
||||||
|
return minShares
|
||||||
|
}
|
||||||
|
if shares > maxShares {
|
||||||
|
return maxShares
|
||||||
|
}
|
||||||
|
return uint64(shares)
|
||||||
|
}
|
||||||
|
|
||||||
|
// milliCPUToQuota converts milliCPU to CFS quota and period values.
|
||||||
|
// Input parameters and resulting value is number of microseconds.
|
||||||
|
func milliCPUToQuota(milliCPU int64, period int64) (quota int64) {
|
||||||
|
// CFS quota is measured in two values:
|
||||||
|
// - cfs_period_us=100ms (the amount of time to measure usage across given by period)
|
||||||
|
// - cfs_quota=20ms (the amount of cpu time allowed to be used across a period)
|
||||||
|
// so in the above example, you are limited to 20% of a single CPU
|
||||||
|
// for multi-cpu environments, you just scale equivalent amounts
|
||||||
|
// see https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt for details
|
||||||
|
|
||||||
|
if milliCPU == 0 {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// we then convert your milliCPU to a value normalized over a period
|
||||||
|
quota = (milliCPU * period) / milliCPUToCPU
|
||||||
|
|
||||||
|
// quota needs to be a minimum of 1ms.
|
||||||
|
if quota < minQuotaPeriod {
|
||||||
|
quota = minQuotaPeriod
|
||||||
|
}
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,601 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package spec implements OCI runtime spec support.
|
||||||
|
package spec
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/csv"
|
||||||
|
"encoding/json"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
runtime "github.com/opencontainers/runtime-spec/specs-go"
|
||||||
|
"k8s.io/apimachinery/pkg/api/resource"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
errApplySpecOption = "cannot apply spec option"
|
||||||
|
errNew = "cannot create new spec"
|
||||||
|
errMarshal = "cannot marshal spec to JSON"
|
||||||
|
errWriteFile = "cannot write file"
|
||||||
|
errParseCPULimit = "cannot parse CPU limit"
|
||||||
|
errParseMemoryLimit = "cannot parse memory limit"
|
||||||
|
errNoCmd = "OCI image must specify entrypoint and/or cmd"
|
||||||
|
errParsePasswd = "cannot parse passwd file data"
|
||||||
|
errParseGroup = "cannot parse group file data"
|
||||||
|
errResolveUser = "cannot resolve user specified by OCI image config"
|
||||||
|
errNonIntegerUID = "cannot parse non-integer UID"
|
||||||
|
errNonIntegerGID = "cannot parse non-integer GID"
|
||||||
|
errOpenPasswdFile = "cannot open passwd file"
|
||||||
|
errOpenGroupFile = "cannot open group file"
|
||||||
|
errParsePasswdFiles = "cannot parse container's /etc/passwd and/or /etc/group files"
|
||||||
|
|
||||||
|
errFmtTooManyColons = "cannot parse user %q (too many colon separators)"
|
||||||
|
errFmtNonExistentUser = "cannot resolve UID of user %q that doesn't exist in container's /etc/passwd"
|
||||||
|
errFmtNonExistentGroup = "cannot resolve GID of group %q that doesn't exist in container's /etc/group"
|
||||||
|
)
|
||||||
|
|
||||||
|
// An Option specifies optional OCI runtime configuration.
|
||||||
|
type Option func(s *runtime.Spec) error
|
||||||
|
|
||||||
|
// New produces a new OCI runtime spec (i.e. config.json).
|
||||||
|
func New(o ...Option) (*runtime.Spec, error) {
|
||||||
|
// NOTE(negz): Most of this is what `crun spec --rootless` produces.
|
||||||
|
spec := &runtime.Spec{
|
||||||
|
Version: runtime.Version,
|
||||||
|
Process: &runtime.Process{
|
||||||
|
User: runtime.User{UID: 0, GID: 0},
|
||||||
|
Env: []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},
|
||||||
|
Cwd: "/",
|
||||||
|
Capabilities: &runtime.LinuxCapabilities{
|
||||||
|
Bounding: []string{
|
||||||
|
"CAP_AUDIT_WRITE",
|
||||||
|
"CAP_KILL",
|
||||||
|
"CAP_NET_BIND_SERVICE",
|
||||||
|
},
|
||||||
|
Effective: []string{
|
||||||
|
"CAP_AUDIT_WRITE",
|
||||||
|
"CAP_KILL",
|
||||||
|
"CAP_NET_BIND_SERVICE",
|
||||||
|
},
|
||||||
|
Permitted: []string{
|
||||||
|
"CAP_AUDIT_WRITE",
|
||||||
|
"CAP_KILL",
|
||||||
|
"CAP_NET_BIND_SERVICE",
|
||||||
|
},
|
||||||
|
Ambient: []string{
|
||||||
|
"CAP_AUDIT_WRITE",
|
||||||
|
"CAP_KILL",
|
||||||
|
"CAP_NET_BIND_SERVICE",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Rlimits: []runtime.POSIXRlimit{
|
||||||
|
{
|
||||||
|
Type: "RLIMIT_NOFILE",
|
||||||
|
Hard: 1024,
|
||||||
|
Soft: 1024,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Hostname: "function-runtime-oci",
|
||||||
|
Mounts: []runtime.Mount{
|
||||||
|
{
|
||||||
|
Type: "bind",
|
||||||
|
Destination: "/proc",
|
||||||
|
Source: "/proc",
|
||||||
|
Options: []string{"nosuid", "noexec", "nodev", "rbind"},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Type: "tmpfs",
|
||||||
|
Destination: "/dev",
|
||||||
|
Source: "tmpfs",
|
||||||
|
Options: []string{"nosuid", "strictatime", "mode=755", "size=65536k"},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Type: "tmpfs",
|
||||||
|
Destination: "/tmp",
|
||||||
|
Source: "tmp",
|
||||||
|
Options: []string{"nosuid", "strictatime", "mode=755", "size=65536k"},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Type: "bind",
|
||||||
|
Destination: "/sys",
|
||||||
|
Source: "/sys",
|
||||||
|
Options: []string{"rprivate", "nosuid", "noexec", "nodev", "ro", "rbind"},
|
||||||
|
},
|
||||||
|
|
||||||
|
{
|
||||||
|
Destination: "/dev/pts",
|
||||||
|
Type: "devpts",
|
||||||
|
Source: "devpts",
|
||||||
|
Options: []string{"nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Destination: "/dev/mqueue",
|
||||||
|
Type: "mqueue",
|
||||||
|
Source: "mqueue",
|
||||||
|
Options: []string{"nosuid", "noexec", "nodev"},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Destination: "/sys/fs/cgroup",
|
||||||
|
Type: "cgroup",
|
||||||
|
Source: "cgroup",
|
||||||
|
Options: []string{"rprivate", "nosuid", "noexec", "nodev", "relatime", "ro"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
// TODO(negz): Do we need a seccomp policy? Our host probably has one.
|
||||||
|
Linux: &runtime.Linux{
|
||||||
|
Resources: &runtime.LinuxResources{
|
||||||
|
Devices: []runtime.LinuxDeviceCgroup{
|
||||||
|
{
|
||||||
|
Allow: false,
|
||||||
|
Access: "rwm",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Pids: &runtime.LinuxPids{
|
||||||
|
Limit: 32768,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Namespaces: []runtime.LinuxNamespace{
|
||||||
|
{Type: runtime.PIDNamespace},
|
||||||
|
{Type: runtime.IPCNamespace},
|
||||||
|
{Type: runtime.UTSNamespace},
|
||||||
|
{Type: runtime.MountNamespace},
|
||||||
|
{Type: runtime.CgroupNamespace},
|
||||||
|
{Type: runtime.NetworkNamespace},
|
||||||
|
},
|
||||||
|
MaskedPaths: []string{
|
||||||
|
"/proc/acpi",
|
||||||
|
"/proc/kcore",
|
||||||
|
"/proc/keys",
|
||||||
|
"/proc/latency_stats",
|
||||||
|
"/proc/timer_list",
|
||||||
|
"/proc/timer_stats",
|
||||||
|
"/proc/sched_debug",
|
||||||
|
"/proc/scsi",
|
||||||
|
"/sys/firmware",
|
||||||
|
"/sys/fs/selinux",
|
||||||
|
"/sys/dev/block",
|
||||||
|
},
|
||||||
|
ReadonlyPaths: []string{
|
||||||
|
"/proc/asound",
|
||||||
|
"/proc/bus",
|
||||||
|
"/proc/fs",
|
||||||
|
"/proc/irq",
|
||||||
|
"/proc/sys",
|
||||||
|
"/proc/sysrq-trigger",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, fn := range o {
|
||||||
|
if err := fn(spec); err != nil {
|
||||||
|
return nil, errors.Wrap(err, errApplySpecOption)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return spec, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Write an OCI runtime spec to the supplied path.
|
||||||
|
func Write(path string, o ...Option) error {
|
||||||
|
s, err := New(o...)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errNew)
|
||||||
|
}
|
||||||
|
b, err := json.Marshal(s)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errMarshal)
|
||||||
|
}
|
||||||
|
return errors.Wrap(os.WriteFile(path, b, 0o600), errWriteFile)
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithRootFS configures a container's rootfs.
|
||||||
|
func WithRootFS(path string, readonly bool) Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
s.Root = &runtime.Root{
|
||||||
|
Path: path,
|
||||||
|
Readonly: readonly,
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO(negz): Does it make sense to convert Kubernetes-style resource
|
||||||
|
// quantities into cgroup limits here, or should our gRPC API accept cgroup
|
||||||
|
// style limits like the CRI API does?
|
||||||
|
|
||||||
|
// WithCPULimit limits the container's CPU usage per the supplied
|
||||||
|
// Kubernetes-style limit string (e.g. 0.5 or 500m for half a core).
|
||||||
|
func WithCPULimit(limit string) Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
q, err := resource.ParseQuantity(limit)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errParseCPULimit)
|
||||||
|
}
|
||||||
|
shares := milliCPUToShares(q.MilliValue())
|
||||||
|
quota := milliCPUToQuota(q.MilliValue(), quotaPeriod)
|
||||||
|
|
||||||
|
if s.Linux == nil {
|
||||||
|
s.Linux = &runtime.Linux{}
|
||||||
|
}
|
||||||
|
if s.Linux.Resources == nil {
|
||||||
|
s.Linux.Resources = &runtime.LinuxResources{}
|
||||||
|
}
|
||||||
|
s.Linux.Resources.CPU = &runtime.LinuxCPU{
|
||||||
|
Shares: &shares,
|
||||||
|
Quota: "a,
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithMemoryLimit limits the container's memory usage per the supplied
|
||||||
|
// Kubernetes-style limit string (e.g. 512Mi).
|
||||||
|
func WithMemoryLimit(limit string) Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
q, err := resource.ParseQuantity(limit)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errParseMemoryLimit)
|
||||||
|
}
|
||||||
|
limit := q.Value()
|
||||||
|
|
||||||
|
if s.Linux == nil {
|
||||||
|
s.Linux = &runtime.Linux{}
|
||||||
|
}
|
||||||
|
if s.Linux.Resources == nil {
|
||||||
|
s.Linux.Resources = &runtime.LinuxResources{}
|
||||||
|
}
|
||||||
|
s.Linux.Resources.Memory = &runtime.LinuxMemory{
|
||||||
|
Limit: &limit,
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithHostNetwork configures the container to share the host's (i.e.
|
||||||
|
// function-runtime-oci container's) network namespace.
|
||||||
|
func WithHostNetwork() Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
s.Mounts = append(s.Mounts, runtime.Mount{
|
||||||
|
Type: "bind",
|
||||||
|
Destination: "/etc/resolv.conf",
|
||||||
|
Source: "/etc/resolv.conf",
|
||||||
|
Options: []string{"rbind", "ro"},
|
||||||
|
})
|
||||||
|
if s.Linux == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// We share the host's network by removing any network namespaces.
|
||||||
|
filtered := make([]runtime.LinuxNamespace, 0, len(s.Linux.Namespaces))
|
||||||
|
for _, ns := range s.Linux.Namespaces {
|
||||||
|
if ns.Type == runtime.NetworkNamespace {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
filtered = append(filtered, ns)
|
||||||
|
}
|
||||||
|
s.Linux.Namespaces = filtered
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithImageConfig extends a Spec with configuration derived from an OCI image
|
||||||
|
// config file. If the image config specifies a user it will be resolved using
|
||||||
|
// the supplied passwd and group files.
|
||||||
|
func WithImageConfig(cfg *ociv1.ConfigFile, passwd, group string) Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
if cfg.Config.Hostname != "" {
|
||||||
|
s.Hostname = cfg.Config.Hostname
|
||||||
|
}
|
||||||
|
|
||||||
|
args := make([]string, 0, len(cfg.Config.Entrypoint)+len(cfg.Config.Cmd))
|
||||||
|
args = append(args, cfg.Config.Entrypoint...)
|
||||||
|
args = append(args, cfg.Config.Cmd...)
|
||||||
|
if len(args) == 0 {
|
||||||
|
return errors.New(errNoCmd)
|
||||||
|
}
|
||||||
|
|
||||||
|
if s.Process == nil {
|
||||||
|
s.Process = &runtime.Process{}
|
||||||
|
}
|
||||||
|
|
||||||
|
s.Process.Args = args
|
||||||
|
s.Process.Env = append(s.Process.Env, cfg.Config.Env...)
|
||||||
|
|
||||||
|
if cfg.Config.WorkingDir != "" {
|
||||||
|
s.Process.Cwd = cfg.Config.WorkingDir
|
||||||
|
}
|
||||||
|
|
||||||
|
if cfg.Config.User != "" {
|
||||||
|
p, err := ParsePasswdFiles(passwd, group)
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errParsePasswdFiles)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := WithUser(cfg.Config.User, p)(s); err != nil {
|
||||||
|
return errors.Wrap(err, errResolveUser)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// A Username within an /etc/passwd file.
|
||||||
|
type Username string
|
||||||
|
|
||||||
|
// A Groupname within an /etc/group file.
|
||||||
|
type Groupname string
|
||||||
|
|
||||||
|
// A UID within an /etc/passwd file.
|
||||||
|
type UID int
|
||||||
|
|
||||||
|
// A GID within an /etc/passwd or /etc/group file.
|
||||||
|
type GID int
|
||||||
|
|
||||||
|
// Unknown UID and GIDs.
|
||||||
|
const (
|
||||||
|
UnknownUID = UID(-1)
|
||||||
|
UnknownGID = GID(-1)
|
||||||
|
)
|
||||||
|
|
||||||
|
// Passwd (and group) file data.
|
||||||
|
type Passwd struct {
|
||||||
|
UID map[Username]UID
|
||||||
|
GID map[Groupname]GID
|
||||||
|
Groups map[UID]Groups
|
||||||
|
}
|
||||||
|
|
||||||
|
// Groups represents a user's groups.
|
||||||
|
type Groups struct {
|
||||||
|
// Elsewhere we use types like UID and GID for self-documenting map keys. We
|
||||||
|
// use uint32 here for convenience. It's what runtime.User wants and we
|
||||||
|
// don't want to have to convert a slice of GID to a slice of uint32.
|
||||||
|
|
||||||
|
PrimaryGID uint32
|
||||||
|
AdditionalGIDs []uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
// ParsePasswdFiles parses the passwd and group files at the supplied paths. If
|
||||||
|
// either path does not exist it returns empty Passwd data.
|
||||||
|
func ParsePasswdFiles(passwd, group string) (Passwd, error) {
|
||||||
|
p, err := os.Open(passwd) //nolint:gosec // We intentionally take a variable here.
|
||||||
|
if errors.Is(err, os.ErrNotExist) {
|
||||||
|
return Passwd{}, nil
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return Passwd{}, errors.Wrap(err, errOpenPasswdFile)
|
||||||
|
}
|
||||||
|
defer p.Close() //nolint:errcheck // Only open for reading.
|
||||||
|
|
||||||
|
g, err := os.Open(group) //nolint:gosec // We intentionally take a variable here.
|
||||||
|
if errors.Is(err, os.ErrNotExist) {
|
||||||
|
return Passwd{}, nil
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return Passwd{}, errors.Wrap(err, errOpenGroupFile)
|
||||||
|
}
|
||||||
|
defer g.Close() //nolint:errcheck // Only open for reading.
|
||||||
|
|
||||||
|
return ParsePasswd(p, g)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ParsePasswd parses the supplied passwd and group data.
|
||||||
|
func ParsePasswd(passwd, group io.Reader) (Passwd, error) { //nolint:gocyclo // Breaking each loop into its own function seems more complicated.
|
||||||
|
out := Passwd{
|
||||||
|
UID: make(map[Username]UID),
|
||||||
|
GID: make(map[Groupname]GID),
|
||||||
|
Groups: make(map[UID]Groups),
|
||||||
|
}
|
||||||
|
|
||||||
|
// Formatted as name:password:UID:GID:GECOS:directory:shell
|
||||||
|
p := csv.NewReader(passwd)
|
||||||
|
p.Comma = ':'
|
||||||
|
p.Comment = '#'
|
||||||
|
p.TrimLeadingSpace = true
|
||||||
|
p.FieldsPerRecord = 7 // len(r) will be guaranteed to be 7.
|
||||||
|
|
||||||
|
for {
|
||||||
|
r, err := p.Read()
|
||||||
|
if errors.Is(err, io.EOF) {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return Passwd{}, errors.Wrap(err, errParsePasswd)
|
||||||
|
}
|
||||||
|
|
||||||
|
username := r[0]
|
||||||
|
uid, err := strconv.ParseUint(r[2], 10, 32)
|
||||||
|
if err != nil {
|
||||||
|
return Passwd{}, errors.Wrap(err, errNonIntegerUID)
|
||||||
|
}
|
||||||
|
gid, err := strconv.ParseUint(r[3], 10, 32)
|
||||||
|
if err != nil {
|
||||||
|
return Passwd{}, errors.Wrap(err, errNonIntegerGID)
|
||||||
|
}
|
||||||
|
|
||||||
|
out.UID[Username(username)] = UID(uid)
|
||||||
|
out.Groups[UID(uid)] = Groups{PrimaryGID: uint32(gid)}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Formatted as group_name:password:GID:comma_separated_user_list
|
||||||
|
g := csv.NewReader(group)
|
||||||
|
g.Comma = ':'
|
||||||
|
g.Comment = '#'
|
||||||
|
g.TrimLeadingSpace = true
|
||||||
|
g.FieldsPerRecord = 4 // len(r) will be guaranteed to be 4.
|
||||||
|
|
||||||
|
for {
|
||||||
|
r, err := g.Read()
|
||||||
|
if errors.Is(err, io.EOF) {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return Passwd{}, errors.Wrap(err, errParseGroup)
|
||||||
|
}
|
||||||
|
|
||||||
|
groupname := r[0]
|
||||||
|
gid, err := strconv.ParseUint(r[2], 10, 32)
|
||||||
|
if err != nil {
|
||||||
|
return Passwd{}, errors.Wrap(err, errNonIntegerGID)
|
||||||
|
}
|
||||||
|
|
||||||
|
out.GID[Groupname(groupname)] = GID(gid)
|
||||||
|
|
||||||
|
users := r[3]
|
||||||
|
|
||||||
|
// This group has no users (except those with membership via passwd).
|
||||||
|
if users == "" {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, u := range strings.Split(users, ",") {
|
||||||
|
uid, ok := out.UID[Username(u)]
|
||||||
|
if !ok || gid == uint64(out.Groups[uid].PrimaryGID) {
|
||||||
|
// Either this user doesn't exist, or they do and the group is
|
||||||
|
// their primary group. Either way we want to skip it.
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
g := out.Groups[uid]
|
||||||
|
g.AdditionalGIDs = append(g.AdditionalGIDs, uint32(gid))
|
||||||
|
out.Groups[uid] = g
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return out, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithUser resolves an OCI image config user string in order to set the spec's
|
||||||
|
// process user. According to the OCI image config v1.0 spec: "For Linux based
|
||||||
|
// systems, all of the following are valid: user, uid, user:group, uid:gid,
|
||||||
|
// uid:group, user:gid. If group/GID is not specified, the default group and
|
||||||
|
// supplementary groups of the given user/UID in /etc/passwd from the container
|
||||||
|
// are applied."
|
||||||
|
func WithUser(user string, p Passwd) Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
if s.Process == nil {
|
||||||
|
s.Process = &runtime.Process{}
|
||||||
|
}
|
||||||
|
|
||||||
|
parts := strings.Split(user, ":")
|
||||||
|
switch len(parts) {
|
||||||
|
case 1:
|
||||||
|
return WithUserOnly(parts[0], p)(s)
|
||||||
|
case 2:
|
||||||
|
return WithUserAndGroup(parts[0], parts[1], p)(s)
|
||||||
|
default:
|
||||||
|
return errors.Errorf(errFmtTooManyColons, user)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithUserOnly resolves an OCI Image config user string in order to set the
|
||||||
|
// spec's process user. The supplied user string must either be an integer UID
|
||||||
|
// (that may or may not exist in the container's /etc/passwd) or a username that
|
||||||
|
// exists in the container's /etc/passwd. The supplied user string must not
|
||||||
|
// contain any group information.
|
||||||
|
func WithUserOnly(user string, p Passwd) Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
if s.Process == nil {
|
||||||
|
s.Process = &runtime.Process{}
|
||||||
|
}
|
||||||
|
|
||||||
|
uid := UnknownUID
|
||||||
|
|
||||||
|
// If user is an integer we treat it as a UID.
|
||||||
|
if v, err := strconv.ParseUint(user, 10, 32); err == nil {
|
||||||
|
uid = UID(v)
|
||||||
|
}
|
||||||
|
|
||||||
|
// If user is not an integer we must resolve it to one using data
|
||||||
|
// extracted from the container's passwd file.
|
||||||
|
if uid == UnknownUID {
|
||||||
|
v, ok := p.UID[Username(user)]
|
||||||
|
if !ok {
|
||||||
|
return errors.Errorf(errFmtNonExistentUser, user)
|
||||||
|
}
|
||||||
|
uid = v
|
||||||
|
}
|
||||||
|
|
||||||
|
// At this point the UID was either explicitly specified or
|
||||||
|
// resolved. Note that if the UID doesn't exist in the supplied
|
||||||
|
// passwd and group data we'll set its GID to 0. This behaviour isn't
|
||||||
|
// specified by the OCI spec, but matches what containerd does.
|
||||||
|
s.Process.User = runtime.User{
|
||||||
|
UID: uint32(uid),
|
||||||
|
GID: p.Groups[uid].PrimaryGID,
|
||||||
|
AdditionalGids: p.Groups[uid].AdditionalGIDs,
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// WithUserAndGroup resolves an OCI image config user string in order to set the
|
||||||
|
// spec's process user. The supplied user string must either be an integer UID
|
||||||
|
// (that may or may not exist in the container's /etc/passwd) or a username that
|
||||||
|
// exists in the container's /etc/passwd. The supplied group must either be an
|
||||||
|
// integer GID (that may or may not exist in the container's /etc/group) or a
|
||||||
|
// group name that exists in the container's /etc/group.
|
||||||
|
func WithUserAndGroup(user, group string, p Passwd) Option {
|
||||||
|
return func(s *runtime.Spec) error {
|
||||||
|
if s.Process == nil {
|
||||||
|
s.Process = &runtime.Process{}
|
||||||
|
}
|
||||||
|
|
||||||
|
uid, gid := UnknownUID, UnknownGID
|
||||||
|
|
||||||
|
// If user and/or group are integers we treat them as UID/GIDs.
|
||||||
|
if v, err := strconv.ParseUint(user, 10, 32); err == nil {
|
||||||
|
uid = UID(v)
|
||||||
|
}
|
||||||
|
if v, err := strconv.ParseUint(group, 10, 32); err == nil {
|
||||||
|
gid = GID(v)
|
||||||
|
}
|
||||||
|
|
||||||
|
// If user and/or group weren't integers we must resolve them to a
|
||||||
|
// UID/GID that exists within the container's passwd/group files.
|
||||||
|
if uid == UnknownUID {
|
||||||
|
v, ok := p.UID[Username(user)]
|
||||||
|
if !ok {
|
||||||
|
return errors.Errorf(errFmtNonExistentUser, user)
|
||||||
|
}
|
||||||
|
uid = v
|
||||||
|
}
|
||||||
|
if gid == UnknownGID {
|
||||||
|
v, ok := p.GID[Groupname(group)]
|
||||||
|
if !ok {
|
||||||
|
return errors.Errorf(errFmtNonExistentGroup, group)
|
||||||
|
}
|
||||||
|
gid = v
|
||||||
|
}
|
||||||
|
|
||||||
|
// At this point the UID and GID were either explicitly specified or
|
||||||
|
// resolved. All we need to do is supply any additional GIDs.
|
||||||
|
s.Process.User = runtime.User{
|
||||||
|
UID: uint32(uid),
|
||||||
|
GID: uint32(gid),
|
||||||
|
AdditionalGids: p.Groups[uid].AdditionalGIDs,
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,931 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package spec
|
||||||
|
|
||||||
|
import (
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/google/go-cmp/cmp"
|
||||||
|
"github.com/google/go-cmp/cmp/cmpopts"
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
runtime "github.com/opencontainers/runtime-spec/specs-go"
|
||||||
|
"k8s.io/apimachinery/pkg/api/resource"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/test"
|
||||||
|
)
|
||||||
|
|
||||||
|
type TestBundle struct{ path string }
|
||||||
|
|
||||||
|
func (b TestBundle) Path() string { return b.path }
|
||||||
|
func (b TestBundle) Cleanup() error { return os.RemoveAll(b.path) }
|
||||||
|
|
||||||
|
func TestNew(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
o []Option
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
s *runtime.Spec
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"InvalidOption": {
|
||||||
|
reason: "We should return an error if the supplied option is invalid.",
|
||||||
|
args: args{
|
||||||
|
o: []Option{func(s *runtime.Spec) error { return errBoom }},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errApplySpecOption),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Minimal": {
|
||||||
|
reason: "It should be possible to apply an option to a new spec.",
|
||||||
|
args: args{
|
||||||
|
o: []Option{func(s *runtime.Spec) error {
|
||||||
|
s.Annotations = map[string]string{"cool": "very"}
|
||||||
|
return nil
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: func() *runtime.Spec {
|
||||||
|
s, _ := New()
|
||||||
|
s.Annotations = map[string]string{"cool": "very"}
|
||||||
|
return s
|
||||||
|
}(),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
got, err := New(tc.args.o...)
|
||||||
|
if diff := cmp.Diff(tc.want.s, got); diff != "" {
|
||||||
|
t.Errorf("\n%s\nCreate(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nCreate(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWithCPULimit(t *testing.T) {
|
||||||
|
var shares uint64 = 512
|
||||||
|
var quota int64 = 50000
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
limit string
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
s *runtime.Spec
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
s *runtime.Spec
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"ParseLimitError": {
|
||||||
|
reason: "We should return any error encountered while parsing the CPU limit.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
limit: "",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
err: errors.Wrap(resource.ErrFormatWrong, errParseCPULimit),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessMilliCPUs": {
|
||||||
|
reason: "We should set shares and quota according to the supplied milliCPUs.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
limit: "500m",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{
|
||||||
|
Linux: &runtime.Linux{
|
||||||
|
Resources: &runtime.LinuxResources{
|
||||||
|
CPU: &runtime.LinuxCPU{
|
||||||
|
Shares: &shares,
|
||||||
|
Quota: "a,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessCores": {
|
||||||
|
reason: "We should set shares and quota according to the supplied cores.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
limit: "0.5",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{
|
||||||
|
Linux: &runtime.Linux{
|
||||||
|
Resources: &runtime.LinuxResources{
|
||||||
|
CPU: &runtime.LinuxCPU{
|
||||||
|
Shares: &shares,
|
||||||
|
Quota: "a,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := WithCPULimit(tc.args.limit)(tc.s)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.s, tc.s, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithCPULimit(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithCPULimit(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWithMemoryLimit(t *testing.T) {
|
||||||
|
var limit int64 = 512 * 1024 * 1024
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
limit string
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
s *runtime.Spec
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
s *runtime.Spec
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"ParseLimitError": {
|
||||||
|
reason: "We should return any error encountered while parsing the memory limit.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
limit: "",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
err: errors.Wrap(resource.ErrFormatWrong, errParseMemoryLimit),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Success": {
|
||||||
|
reason: "We should set the supplied memory limit.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
limit: "512Mi",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{
|
||||||
|
Linux: &runtime.Linux{
|
||||||
|
Resources: &runtime.LinuxResources{
|
||||||
|
Memory: &runtime.LinuxMemory{
|
||||||
|
Limit: &limit,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := WithMemoryLimit(tc.args.limit)(tc.s)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.s, tc.s, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithMemoryLimit(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithMemoryLimit(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWithHostNetwork(t *testing.T) {
|
||||||
|
type want struct {
|
||||||
|
s *runtime.Spec
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
s *runtime.Spec
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"RemoveNetworkNamespace": {
|
||||||
|
reason: "We should remote the network namespace if it exists.",
|
||||||
|
s: &runtime.Spec{
|
||||||
|
Linux: &runtime.Linux{
|
||||||
|
Namespaces: []runtime.LinuxNamespace{
|
||||||
|
{Type: runtime.CgroupNamespace},
|
||||||
|
{Type: runtime.NetworkNamespace},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{
|
||||||
|
Mounts: []runtime.Mount{{
|
||||||
|
Type: "bind",
|
||||||
|
Destination: "/etc/resolv.conf",
|
||||||
|
Source: "/etc/resolv.conf",
|
||||||
|
Options: []string{"rbind", "ro"},
|
||||||
|
}},
|
||||||
|
Linux: &runtime.Linux{
|
||||||
|
Namespaces: []runtime.LinuxNamespace{
|
||||||
|
{Type: runtime.CgroupNamespace},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"EmptySpec": {
|
||||||
|
reason: "We should handle an empty spec without issue.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{
|
||||||
|
Mounts: []runtime.Mount{{
|
||||||
|
Type: "bind",
|
||||||
|
Destination: "/etc/resolv.conf",
|
||||||
|
Source: "/etc/resolv.conf",
|
||||||
|
Options: []string{"rbind", "ro"},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := WithHostNetwork()(tc.s)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.s, tc.s, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithHostNetwork(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithHostNetwork(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWithImageConfig(t *testing.T) {
|
||||||
|
type args struct {
|
||||||
|
cfg *ociv1.ConfigFile
|
||||||
|
passwd string
|
||||||
|
group string
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
s *runtime.Spec
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
s *runtime.Spec
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"NoCommand": {
|
||||||
|
reason: "We should return an error if the supplied image config has no entrypoint and no cmd.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
cfg: &ociv1.ConfigFile{},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
err: errors.New(errNoCmd),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"UnresolvableUser": {
|
||||||
|
reason: "We should return an error if there is no passwd data and a string username.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
cfg: &ociv1.ConfigFile{
|
||||||
|
Config: ociv1.Config{
|
||||||
|
Entrypoint: []string{"/bin/sh"},
|
||||||
|
User: "negz",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{
|
||||||
|
Process: &runtime.Process{
|
||||||
|
Args: []string{"/bin/sh"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
err: errors.Wrap(errors.Errorf(errFmtNonExistentUser, "negz"), errResolveUser),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Success": {
|
||||||
|
reason: "We should build a runtime config from the supplied image config.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
cfg: &ociv1.ConfigFile{
|
||||||
|
Config: ociv1.Config{
|
||||||
|
Hostname: "coolhost",
|
||||||
|
Entrypoint: []string{"/bin/sh"},
|
||||||
|
Cmd: []string{"cool"},
|
||||||
|
Env: []string{"COOL=very"},
|
||||||
|
WorkingDir: "/",
|
||||||
|
User: "1000:100",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{
|
||||||
|
Process: &runtime.Process{
|
||||||
|
Args: []string{"/bin/sh", "cool"},
|
||||||
|
Env: []string{"COOL=very"},
|
||||||
|
Cwd: "/",
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
GID: 100,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Hostname: "coolhost",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := WithImageConfig(tc.args.cfg, tc.args.passwd, tc.args.group)(tc.s)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.s, tc.s, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithImageConfig(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithImageConfig(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestParsePasswd(t *testing.T) {
|
||||||
|
passwd := `
|
||||||
|
# Ensure that comments and leading whitespace are supported.
|
||||||
|
root:x:0:0:System administrator:/root:/run/current-system/sw/bin/zsh
|
||||||
|
negz:x:1000:100::/home/negz:/run/current-system/sw/bin/zsh
|
||||||
|
primary:x:1001:100::/home/primary:/run/current-system/sw/bin/zsh
|
||||||
|
`
|
||||||
|
|
||||||
|
group := `
|
||||||
|
root:x:0:
|
||||||
|
wheel:x:1:negz
|
||||||
|
# This is primary's primary group, and doesnotexist doesn't exist in passwd.
|
||||||
|
users:x:100:primary,doesnotexist
|
||||||
|
`
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
passwd io.Reader
|
||||||
|
group io.Reader
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
p Passwd
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"EmptyFiles": {
|
||||||
|
reason: "We should return an empty Passwd when both files are empty.",
|
||||||
|
args: args{
|
||||||
|
passwd: strings.NewReader(""),
|
||||||
|
group: strings.NewReader(""),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
p: Passwd{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
// TODO(negz): Should we try fuzz this?
|
||||||
|
"MalformedPasswd": {
|
||||||
|
reason: "We should return an error when the passwd file is malformed.",
|
||||||
|
args: args{
|
||||||
|
passwd: strings.NewReader("@!#!:f"),
|
||||||
|
group: strings.NewReader(""),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errors.New("record on line 1: wrong number of fields"), errParsePasswd),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"MalformedGroup": {
|
||||||
|
reason: "We should return an error when the group file is malformed.",
|
||||||
|
args: args{
|
||||||
|
passwd: strings.NewReader(""),
|
||||||
|
group: strings.NewReader("@!#!:f"),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errors.New("record on line 1: wrong number of fields"), errParseGroup),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NonIntegerPasswdUID": {
|
||||||
|
reason: "We should return an error when the passwd file contains a non-integer uid.",
|
||||||
|
args: args{
|
||||||
|
passwd: strings.NewReader("username:password:uid:gid:gecos:homedir:shell"),
|
||||||
|
group: strings.NewReader(""),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errors.New("strconv.ParseUint: parsing \"uid\": invalid syntax"), errNonIntegerUID),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NonIntegerPasswdGID": {
|
||||||
|
reason: "We should return an error when the passwd file contains a non-integer gid.",
|
||||||
|
args: args{
|
||||||
|
passwd: strings.NewReader("username:password:42:gid:gecos:homedir:shell"),
|
||||||
|
group: strings.NewReader(""),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errors.New("strconv.ParseUint: parsing \"gid\": invalid syntax"), errNonIntegerGID),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NonIntegerGroupGID": {
|
||||||
|
reason: "We should return an error when the group file contains a non-integer gid.",
|
||||||
|
args: args{
|
||||||
|
passwd: strings.NewReader(""),
|
||||||
|
group: strings.NewReader("groupname:password:gid:username"),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errors.New("strconv.ParseUint: parsing \"gid\": invalid syntax"), errNonIntegerGID),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Success": {
|
||||||
|
reason: "We should successfully parse well formatted passwd and group files.",
|
||||||
|
args: args{
|
||||||
|
passwd: strings.NewReader(passwd),
|
||||||
|
group: strings.NewReader(group),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
p: Passwd{
|
||||||
|
UID: map[Username]UID{
|
||||||
|
"root": 0,
|
||||||
|
"negz": 1000,
|
||||||
|
"primary": 1001,
|
||||||
|
},
|
||||||
|
GID: map[Groupname]GID{
|
||||||
|
"root": 0,
|
||||||
|
"wheel": 1,
|
||||||
|
"users": 100,
|
||||||
|
},
|
||||||
|
Groups: map[UID]Groups{
|
||||||
|
0: {PrimaryGID: 0},
|
||||||
|
1000: {PrimaryGID: 100, AdditionalGIDs: []uint32{1}},
|
||||||
|
1001: {PrimaryGID: 100},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
got, err := ParsePasswd(tc.args.passwd, tc.args.group)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.p, got, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nParsePasswd(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nParsePasswd(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestParsePasswdFiles(t *testing.T) {
|
||||||
|
passwd := `
|
||||||
|
# Ensure that comments and leading whitespace are supported.
|
||||||
|
root:x:0:0:System administrator:/root:/run/current-system/sw/bin/zsh
|
||||||
|
negz:x:1000:100::/home/negz:/run/current-system/sw/bin/zsh
|
||||||
|
primary:x:1001:100::/home/primary:/run/current-system/sw/bin/zsh
|
||||||
|
`
|
||||||
|
|
||||||
|
group := `
|
||||||
|
root:x:0:
|
||||||
|
wheel:x:1:negz
|
||||||
|
# This is primary's primary group, and doesnotexist doesn't exist in passwd.
|
||||||
|
users:x:100:primary,doesnotexist
|
||||||
|
`
|
||||||
|
|
||||||
|
tmp, err := os.MkdirTemp(os.TempDir(), t.Name())
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf(err.Error())
|
||||||
|
}
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
_ = os.WriteFile(filepath.Join(tmp, "passwd"), []byte(passwd), 0600)
|
||||||
|
_ = os.WriteFile(filepath.Join(tmp, "group"), []byte(group), 0600)
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
passwd string
|
||||||
|
group string
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
p Passwd
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"NoPasswdFile": {
|
||||||
|
reason: "We should not return an error if the passwd file doesn't exist.",
|
||||||
|
args: args{
|
||||||
|
passwd: filepath.Join(tmp, "nonexist"),
|
||||||
|
group: filepath.Join(tmp, "group"),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
p: Passwd{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NoGroupFile": {
|
||||||
|
reason: "We should not return an error if the group file doesn't exist.",
|
||||||
|
args: args{
|
||||||
|
passwd: filepath.Join(tmp, "passwd"),
|
||||||
|
group: filepath.Join(tmp, "nonexist"),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
p: Passwd{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Success": {
|
||||||
|
reason: "We should successfully parse well formatted passwd and group files.",
|
||||||
|
args: args{
|
||||||
|
passwd: filepath.Join(tmp, "passwd"),
|
||||||
|
group: filepath.Join(tmp, "group"),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
p: Passwd{
|
||||||
|
UID: map[Username]UID{
|
||||||
|
"root": 0,
|
||||||
|
"negz": 1000,
|
||||||
|
"primary": 1001,
|
||||||
|
},
|
||||||
|
GID: map[Groupname]GID{
|
||||||
|
"root": 0,
|
||||||
|
"wheel": 1,
|
||||||
|
"users": 100,
|
||||||
|
},
|
||||||
|
Groups: map[UID]Groups{
|
||||||
|
0: {PrimaryGID: 0},
|
||||||
|
1000: {PrimaryGID: 100, AdditionalGIDs: []uint32{1}},
|
||||||
|
1001: {PrimaryGID: 100},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
got, err := ParsePasswdFiles(tc.args.passwd, tc.args.group)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.p, got, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nParsePasswd(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nParsePasswd(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWithUser(t *testing.T) {
|
||||||
|
type args struct {
|
||||||
|
user string
|
||||||
|
p Passwd
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
s *runtime.Spec
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
// NOTE(negz): We 'test through' here only to test that WithUser can
|
||||||
|
// distinguish a user (only) from a user and group and route them to the
|
||||||
|
// right place; see TestWithUserOnly and TestWithUserAndGroup.
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
s *runtime.Spec
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"TooManyColons": {
|
||||||
|
reason: "We should return an error if the supplied user string contains more than one colon separator.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "user:group:wat",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{}},
|
||||||
|
err: errors.Errorf(errFmtTooManyColons, "user:group:wat"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"UIDOnly": {
|
||||||
|
reason: "We should handle a user string that is a UID without error.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "1000",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"UIDAndGID": {
|
||||||
|
reason: "We should handle a user string that is a UID and GID without error.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "1000:100",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
GID: 100,
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := WithUser(tc.args.user, tc.args.p)(tc.s)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.s, tc.s, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithUser(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithUser(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWithUserOnly(t *testing.T) {
|
||||||
|
type args struct {
|
||||||
|
user string
|
||||||
|
p Passwd
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
s *runtime.Spec
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
s *runtime.Spec
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"UIDOnly": {
|
||||||
|
reason: "We should handle a user string that is a UID without error.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "1000",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ResolveUIDGroups": {
|
||||||
|
reason: "We should 'resolve' a UID's groups per the supplied Passwd data.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "1000",
|
||||||
|
p: Passwd{
|
||||||
|
Groups: map[UID]Groups{
|
||||||
|
1000: {
|
||||||
|
PrimaryGID: 100,
|
||||||
|
AdditionalGIDs: []uint32{1},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
GID: 100,
|
||||||
|
AdditionalGids: []uint32{1},
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NonExistentUser": {
|
||||||
|
reason: "We should return an error if the supplied username doesn't exist in the supplied Passwd data.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "doesnotexist",
|
||||||
|
p: Passwd{},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{}},
|
||||||
|
err: errors.Errorf(errFmtNonExistentUser, "doesnotexist"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ResolveUserToUID": {
|
||||||
|
reason: "We should 'resolve' a username to a UID per the supplied Passwd data.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "negz",
|
||||||
|
p: Passwd{
|
||||||
|
UID: map[Username]UID{
|
||||||
|
"negz": 1000,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := WithUserOnly(tc.args.user, tc.args.p)(tc.s)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.s, tc.s, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithUserOnly(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithUserOnly(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWithUserAndGroup(t *testing.T) {
|
||||||
|
type args struct {
|
||||||
|
user string
|
||||||
|
group string
|
||||||
|
p Passwd
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
s *runtime.Spec
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
s *runtime.Spec
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"UIDAndGID": {
|
||||||
|
reason: "We should handle a UID and GID without error.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "1000",
|
||||||
|
group: "100",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
GID: 100,
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ResolveAdditionalGIDs": {
|
||||||
|
reason: "We should resolve any additional GIDs in the supplied Passwd data.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "1000",
|
||||||
|
group: "100",
|
||||||
|
p: Passwd{
|
||||||
|
Groups: map[UID]Groups{
|
||||||
|
1000: {
|
||||||
|
PrimaryGID: 42, // This should be ignored, since an explicit GID was supplied.
|
||||||
|
AdditionalGIDs: []uint32{1},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
GID: 100,
|
||||||
|
AdditionalGids: []uint32{1},
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NonExistentUser": {
|
||||||
|
reason: "We should return an error if the supplied username doesn't exist in the supplied Passwd data.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "doesnotexist",
|
||||||
|
p: Passwd{},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{}},
|
||||||
|
err: errors.Errorf(errFmtNonExistentUser, "doesnotexist"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NonExistentGroup": {
|
||||||
|
reason: "We should return an error if the supplied group doesn't exist in the supplied Passwd data.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "exists",
|
||||||
|
group: "doesnotexist",
|
||||||
|
p: Passwd{
|
||||||
|
UID: map[Username]UID{"exists": 1000},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{}},
|
||||||
|
err: errors.Errorf(errFmtNonExistentGroup, "doesnotexist"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ResolveUserAndGroupToUIDAndGID": {
|
||||||
|
reason: "We should 'resolve' a username to a UID and a groupname to a GID per the supplied Passwd data.",
|
||||||
|
s: &runtime.Spec{},
|
||||||
|
args: args{
|
||||||
|
user: "negz",
|
||||||
|
group: "users",
|
||||||
|
p: Passwd{
|
||||||
|
UID: map[Username]UID{
|
||||||
|
"negz": 1000,
|
||||||
|
},
|
||||||
|
GID: map[Groupname]GID{
|
||||||
|
"users": 100,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
s: &runtime.Spec{Process: &runtime.Process{
|
||||||
|
User: runtime.User{
|
||||||
|
UID: 1000,
|
||||||
|
GID: 100,
|
||||||
|
},
|
||||||
|
}},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
err := WithUserAndGroup(tc.args.user, tc.args.group, tc.args.p)(tc.s)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.s, tc.s, cmpopts.EquateEmpty()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithUserAndGroup(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWithUserAndGroup(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,479 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package overlay implements an overlay based container store.
|
||||||
|
package overlay
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/resource"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/layer"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/spec"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/store"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings
|
||||||
|
const (
|
||||||
|
errMkContainerStore = "cannot make container store directory"
|
||||||
|
errMkLayerStore = "cannot make layer store directory"
|
||||||
|
errReadConfigFile = "cannot read image config file"
|
||||||
|
errGetLayers = "cannot get image layers"
|
||||||
|
errResolveLayer = "cannot resolve layer to suitable overlayfs lower directory"
|
||||||
|
errBootstrapBundle = "cannot bootstrap bundle rootfs"
|
||||||
|
errWriteRuntimeSpec = "cannot write OCI runtime spec"
|
||||||
|
errGetDigest = "cannot get digest"
|
||||||
|
errMkAlgoDir = "cannot create store directory"
|
||||||
|
errFetchLayer = "cannot fetch and decompress layer"
|
||||||
|
errMkWorkdir = "cannot create work directory to extract layer"
|
||||||
|
errApplyLayer = "cannot apply (extract) uncompressed tarball layer"
|
||||||
|
errMvWorkdir = "cannot move temporary work directory"
|
||||||
|
errStatLayer = "cannot determine whether layer exists in store"
|
||||||
|
errCleanupWorkdir = "cannot cleanup temporary work directory"
|
||||||
|
errMkOverlayDirTmpfs = "cannot make overlay tmpfs dir"
|
||||||
|
errMkdirTemp = "cannot make temporary dir"
|
||||||
|
errMountOverlayfs = "cannot mount overlayfs"
|
||||||
|
|
||||||
|
errFmtMkOverlayDir = "cannot make overlayfs %q dir"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Common overlayfs directories.
|
||||||
|
const (
|
||||||
|
overlayDirTmpfs = "tmpfs"
|
||||||
|
overlayDirUpper = "upper"
|
||||||
|
overlayDirWork = "work"
|
||||||
|
overlayDirLower = "lower" // Only used when there are no parent layers.
|
||||||
|
overlayDirMerged = "merged" // Only used when generating diff layers.
|
||||||
|
)
|
||||||
|
|
||||||
|
// Supported returns true if the supplied cacheRoot supports the overlay
|
||||||
|
// filesystem. Notably overlayfs was not supported in unprivileged user
|
||||||
|
// namespaces until Linux kernel 5.11. It's also not possible to create an
|
||||||
|
// overlayfs where the upper dir is itself on an overlayfs (i.e. is on a
|
||||||
|
// container's root filesystem).
|
||||||
|
// https://github.com/torvalds/linux/commit/459c7c565ac36ba09ffbf
|
||||||
|
func Supported(cacheRoot string) bool {
|
||||||
|
// We use NewLayerWorkdir to test because it needs to create an upper dir on
|
||||||
|
// the same filesystem as the supplied cacheRoot in order to be able to move
|
||||||
|
// it into place as a cached layer. NewOverlayBundle creates an upper dir on
|
||||||
|
// a tmpfs, and is thus supported in some cases where NewLayerWorkdir isn't.
|
||||||
|
w, err := NewLayerWorkdir(cacheRoot, "supports-overlay-test", []string{})
|
||||||
|
if err != nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
if err := w.Cleanup(); err != nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
// An LayerResolver resolves the supplied layer to a path suitable for use as an
|
||||||
|
// overlayfs lower directory.
|
||||||
|
type LayerResolver interface {
|
||||||
|
// Resolve the supplied layer to a path suitable for use as a lower dir.
|
||||||
|
Resolve(ctx context.Context, l ociv1.Layer, parents ...ociv1.Layer) (string, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
// A TarballApplicator applies (i.e. extracts) an OCI layer tarball.
|
||||||
|
// https://github.com/opencontainers/image-spec/blob/v1.0/layer.md
|
||||||
|
type TarballApplicator interface {
|
||||||
|
// Apply the supplied tarball - an OCI filesystem layer - to the supplied
|
||||||
|
// root directory. Applying all of an image's layers, in the correct order,
|
||||||
|
// should produce the image's "flattened" filesystem.
|
||||||
|
Apply(ctx context.Context, tb io.Reader, root string) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A BundleBootstrapper bootstraps a bundle by creating and mounting its rootfs.
|
||||||
|
type BundleBootstrapper interface {
|
||||||
|
Bootstrap(path string, parentLayerPaths []string) (Bundle, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
// A BundleBootstrapperFn bootstraps a bundle by creating and mounting its
|
||||||
|
// rootfs.
|
||||||
|
type BundleBootstrapperFn func(path string, parentLayerPaths []string) (Bundle, error)
|
||||||
|
|
||||||
|
// Bootstrap a bundle by creating and mounting its rootfs.
|
||||||
|
func (fn BundleBootstrapperFn) Bootstrap(path string, parentLayerPaths []string) (Bundle, error) {
|
||||||
|
return fn(path, parentLayerPaths)
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RuntimeSpecWriter writes an OCI runtime spec to the supplied path.
|
||||||
|
type RuntimeSpecWriter interface {
|
||||||
|
// Write and write an OCI runtime spec to the supplied path.
|
||||||
|
Write(path string, o ...spec.Option) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RuntimeSpecWriterFn allows a function to satisfy RuntimeSpecCreator.
|
||||||
|
type RuntimeSpecWriterFn func(path string, o ...spec.Option) error
|
||||||
|
|
||||||
|
// Write an OCI runtime spec to the supplied path.
|
||||||
|
func (fn RuntimeSpecWriterFn) Write(path string, o ...spec.Option) error { return fn(path, o...) }
|
||||||
|
|
||||||
|
// An CachingBundler stores OCI containers, images, and layers. When asked to
|
||||||
|
// bundle a container for a new image the CachingBundler will extract and cache
|
||||||
|
// the image's layers as files on disk. The container's root filesystem is then
|
||||||
|
// created as an overlay atop the image's layers. The upper layer of this
|
||||||
|
// overlay is stored in memory on a tmpfs, and discarded once the container has
|
||||||
|
// finished running.
|
||||||
|
type CachingBundler struct {
|
||||||
|
root string
|
||||||
|
layer LayerResolver
|
||||||
|
bundle BundleBootstrapper
|
||||||
|
spec RuntimeSpecWriter
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewCachingBundler returns a bundler that creates container filesystems as
|
||||||
|
// overlays on their image's layers, which are stored as extracted, overlay
|
||||||
|
// compatible directories of files.
|
||||||
|
func NewCachingBundler(root string) (*CachingBundler, error) {
|
||||||
|
l, err := NewCachingLayerResolver(filepath.Join(root, store.DirOverlays))
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errMkLayerStore)
|
||||||
|
}
|
||||||
|
|
||||||
|
s := &CachingBundler{
|
||||||
|
root: filepath.Join(root, store.DirContainers),
|
||||||
|
layer: l,
|
||||||
|
bundle: BundleBootstrapperFn(BootstrapBundle),
|
||||||
|
spec: RuntimeSpecWriterFn(spec.Write),
|
||||||
|
}
|
||||||
|
return s, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Bundle returns an OCI bundle ready for use by an OCI runtime. The supplied
|
||||||
|
// image will be fetched and cached in the store if it does not already exist.
|
||||||
|
func (c *CachingBundler) Bundle(ctx context.Context, i ociv1.Image, id string, o ...spec.Option) (store.Bundle, error) {
|
||||||
|
cfg, err := i.ConfigFile()
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errReadConfigFile)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := store.Validate(i); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
layers, err := i.Layers()
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errGetLayers)
|
||||||
|
}
|
||||||
|
|
||||||
|
lowerPaths := make([]string, len(layers))
|
||||||
|
for i := range layers {
|
||||||
|
p, err := c.layer.Resolve(ctx, layers[i], layers[:i]...)
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errResolveLayer)
|
||||||
|
}
|
||||||
|
lowerPaths[i] = p
|
||||||
|
}
|
||||||
|
|
||||||
|
path := filepath.Join(c.root, id)
|
||||||
|
|
||||||
|
b, err := c.bundle.Bootstrap(path, lowerPaths)
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errBootstrapBundle)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Inject config derived from the image first, so that any options passed in
|
||||||
|
// by the caller will override it.
|
||||||
|
rootfs := filepath.Join(path, store.DirRootFS)
|
||||||
|
p, g := filepath.Join(rootfs, "etc", "passwd"), filepath.Join(rootfs, "etc", "group")
|
||||||
|
opts := append([]spec.Option{spec.WithImageConfig(cfg, p, g), spec.WithRootFS(store.DirRootFS, true)}, o...)
|
||||||
|
|
||||||
|
if err = c.spec.Write(filepath.Join(path, store.FileSpec), opts...); err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return nil, errors.Wrap(err, errWriteRuntimeSpec)
|
||||||
|
}
|
||||||
|
|
||||||
|
return b, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// A CachingLayerResolver resolves an OCI layer to an overlay compatible
|
||||||
|
// directory on disk. The directory is created the first time a layer is
|
||||||
|
// resolved; subsequent calls return the cached directory.
|
||||||
|
type CachingLayerResolver struct {
|
||||||
|
root string
|
||||||
|
tarball TarballApplicator
|
||||||
|
wdopts []NewLayerWorkdirOption
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewCachingLayerResolver returns a LayerResolver that extracts layers upon
|
||||||
|
// first resolution, returning cached layer paths on subsequent calls.
|
||||||
|
func NewCachingLayerResolver(root string) (*CachingLayerResolver, error) {
|
||||||
|
c := &CachingLayerResolver{
|
||||||
|
root: root,
|
||||||
|
tarball: layer.NewStackingExtractor(layer.NewWhiteoutHandler(layer.NewExtractHandler())),
|
||||||
|
}
|
||||||
|
return c, os.MkdirAll(root, 0700)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Resolve the supplied layer to a path suitable for use as an overlayfs lower
|
||||||
|
// layer directory. The first time a layer is resolved it will be extracted and
|
||||||
|
// cached as an overlayfs compatible directory of files, with any OCI whiteouts
|
||||||
|
// converted to overlayfs whiteouts.
|
||||||
|
func (s *CachingLayerResolver) Resolve(ctx context.Context, l ociv1.Layer, parents ...ociv1.Layer) (string, error) {
|
||||||
|
d, err := l.DiffID() // The uncompressed layer digest.
|
||||||
|
if err != nil {
|
||||||
|
return "", errors.Wrap(err, errGetDigest)
|
||||||
|
}
|
||||||
|
|
||||||
|
path := filepath.Join(s.root, d.Algorithm, d.Hex)
|
||||||
|
if _, err = os.Stat(path); !errors.Is(err, os.ErrNotExist) {
|
||||||
|
// The path exists or we encountered an error other than ErrNotExist.
|
||||||
|
// Either way return the path and the wrapped error - errors.Wrap will
|
||||||
|
// return nil if the path exists.
|
||||||
|
return path, errors.Wrap(err, errStatLayer)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Doesn't exist - cache it. It's possible multiple callers may hit this
|
||||||
|
// branch at once. This will result in multiple extractions to different
|
||||||
|
// temporary dirs. We ignore EEXIST errors from os.Rename, so callers
|
||||||
|
// that lose the race should return the path cached by the successful
|
||||||
|
// caller.
|
||||||
|
|
||||||
|
// This call to Uncompressed is what actually pulls a remote layer. In
|
||||||
|
// most cases we'll be using an image backed by our local image store.
|
||||||
|
tarball, err := l.Uncompressed()
|
||||||
|
if err != nil {
|
||||||
|
return "", errors.Wrap(err, errFetchLayer)
|
||||||
|
}
|
||||||
|
|
||||||
|
parentPaths := make([]string, len(parents))
|
||||||
|
for i := range parents {
|
||||||
|
d, err := parents[i].DiffID()
|
||||||
|
if err != nil {
|
||||||
|
return "", errors.Wrap(err, errGetDigest)
|
||||||
|
}
|
||||||
|
parentPaths[i] = filepath.Join(s.root, d.Algorithm, d.Hex)
|
||||||
|
}
|
||||||
|
|
||||||
|
lw, err := NewLayerWorkdir(filepath.Join(s.root, d.Algorithm), d.Hex, parentPaths, s.wdopts...)
|
||||||
|
if err != nil {
|
||||||
|
return "", errors.Wrap(err, errMkWorkdir)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := s.tarball.Apply(ctx, tarball, lw.ApplyPath()); err != nil {
|
||||||
|
_ = lw.Cleanup()
|
||||||
|
return "", errors.Wrap(err, errApplyLayer)
|
||||||
|
}
|
||||||
|
|
||||||
|
// If newpath exists now (when it didn't above) we must have lost a race
|
||||||
|
// with another caller to cache this layer.
|
||||||
|
if err := os.Rename(lw.ResultPath(), path); resource.Ignore(os.IsExist, err) != nil {
|
||||||
|
_ = lw.Cleanup()
|
||||||
|
return "", errors.Wrap(err, errMvWorkdir)
|
||||||
|
}
|
||||||
|
|
||||||
|
return path, errors.Wrap(lw.Cleanup(), errCleanupWorkdir)
|
||||||
|
}
|
||||||
|
|
||||||
|
// An Bundle is an OCI runtime bundle. Its root filesystem is a temporary
|
||||||
|
// overlay atop its image's cached layers.
|
||||||
|
type Bundle struct {
|
||||||
|
path string
|
||||||
|
mounts []Mount
|
||||||
|
}
|
||||||
|
|
||||||
|
// BootstrapBundle creates and returns an OCI runtime bundle with a root
|
||||||
|
// filesystem backed by a temporary (tmpfs) overlay atop the supplied lower
|
||||||
|
// layer paths.
|
||||||
|
func BootstrapBundle(path string, parentLayerPaths []string) (Bundle, error) {
|
||||||
|
if err := os.MkdirAll(path, 0700); err != nil {
|
||||||
|
return Bundle{}, errors.Wrap(err, "cannot create bundle dir")
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := os.Mkdir(filepath.Join(path, overlayDirTmpfs), 0700); err != nil {
|
||||||
|
_ = os.RemoveAll(path)
|
||||||
|
return Bundle{}, errors.Wrap(err, errMkOverlayDirTmpfs)
|
||||||
|
}
|
||||||
|
|
||||||
|
tm := TmpFSMount{Mountpoint: filepath.Join(path, overlayDirTmpfs)}
|
||||||
|
if err := tm.Mount(); err != nil {
|
||||||
|
_ = os.RemoveAll(path)
|
||||||
|
return Bundle{}, errors.Wrap(err, "cannot mount workdir tmpfs")
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, p := range []string{
|
||||||
|
filepath.Join(path, overlayDirTmpfs, overlayDirUpper),
|
||||||
|
filepath.Join(path, overlayDirTmpfs, overlayDirWork),
|
||||||
|
filepath.Join(path, store.DirRootFS),
|
||||||
|
} {
|
||||||
|
if err := os.Mkdir(p, 0700); err != nil {
|
||||||
|
_ = os.RemoveAll(path)
|
||||||
|
return Bundle{}, errors.Wrapf(err, "cannot create %s dir", p)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
om := OverlayMount{
|
||||||
|
Lower: parentLayerPaths,
|
||||||
|
Upper: filepath.Join(path, overlayDirTmpfs, overlayDirUpper),
|
||||||
|
Work: filepath.Join(path, overlayDirTmpfs, overlayDirWork),
|
||||||
|
Mountpoint: filepath.Join(path, store.DirRootFS),
|
||||||
|
}
|
||||||
|
if err := om.Mount(); err != nil {
|
||||||
|
_ = os.RemoveAll(path)
|
||||||
|
return Bundle{}, errors.Wrap(err, "cannot mount workdir overlayfs")
|
||||||
|
}
|
||||||
|
|
||||||
|
// We pass mounts in the order they should be unmounted.
|
||||||
|
return Bundle{path: path, mounts: []Mount{om, tm}}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Path to the OCI bundle.
|
||||||
|
func (b Bundle) Path() string { return b.path }
|
||||||
|
|
||||||
|
// Cleanup the OCI bundle.
|
||||||
|
func (b Bundle) Cleanup() error {
|
||||||
|
for _, m := range b.mounts {
|
||||||
|
if err := m.Unmount(); err != nil {
|
||||||
|
return errors.Wrap(err, "cannot unmount bundle filesystem")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return errors.Wrap(os.RemoveAll(b.path), "cannot remove bundle")
|
||||||
|
}
|
||||||
|
|
||||||
|
// A Mount of a filesystem.
|
||||||
|
type Mount interface {
|
||||||
|
Mount() error
|
||||||
|
Unmount() error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A TmpFSMount represents a mount of type tmpfs.
|
||||||
|
type TmpFSMount struct {
|
||||||
|
Mountpoint string
|
||||||
|
}
|
||||||
|
|
||||||
|
// An OverlayMount represents a mount of type overlay.
|
||||||
|
type OverlayMount struct { //nolint:revive // overlay.OverlayMount makes sense given that overlay.TmpFSMount exists too.
|
||||||
|
Mountpoint string
|
||||||
|
Lower []string
|
||||||
|
Upper string
|
||||||
|
Work string
|
||||||
|
}
|
||||||
|
|
||||||
|
// A LayerWorkdir is a temporary directory used to produce an overlayfs layer
|
||||||
|
// from an OCI layer by applying the OCI layer to a temporary overlay mount.
|
||||||
|
// It's not possible to _directly_ create overlay whiteout files in an
|
||||||
|
// unprivileged user namespace because doing so requires CAP_MKNOD in the 'root'
|
||||||
|
// or 'initial' user namespace - whiteout files are actually character devices
|
||||||
|
// per "whiteouts and opaque directories" at
|
||||||
|
// https://www.kernel.org/doc/Documentation/filesystems/overlayfs.txt
|
||||||
|
//
|
||||||
|
// We can however create overlay whiteout files indirectly by creating an
|
||||||
|
// overlay where the parent OCI layers are the lower overlayfs layers, and
|
||||||
|
// applying the layer to be cached to said fs. Doing so will produce an upper
|
||||||
|
// overlayfs layer that we can cache. This layer will be a valid lower layer
|
||||||
|
// (complete with overlay whiteout files) for either subsequent layers from the
|
||||||
|
// OCI image, or the final container root filesystem layer.
|
||||||
|
type LayerWorkdir struct {
|
||||||
|
overlay Mount
|
||||||
|
path string
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewOverlayMountFn creates an overlay mount.
|
||||||
|
type NewOverlayMountFn func(path string, parentLayerPaths []string) Mount
|
||||||
|
|
||||||
|
// WorkDirOptions configure how a new layer workdir is created.
|
||||||
|
type WorkDirOptions struct {
|
||||||
|
NewOverlayMount NewOverlayMountFn
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewLayerWorkdirOption configures how a new layer workdir is created.
|
||||||
|
type NewLayerWorkdirOption func(*WorkDirOptions)
|
||||||
|
|
||||||
|
// WithNewOverlayMountFn configures how a new layer workdir creates an overlay
|
||||||
|
// mount.
|
||||||
|
func WithNewOverlayMountFn(fn NewOverlayMountFn) NewLayerWorkdirOption {
|
||||||
|
return func(wdo *WorkDirOptions) {
|
||||||
|
wdo.NewOverlayMount = fn
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultNewOverlayMount is the default OverlayMount created by NewLayerWorkdir.
|
||||||
|
func DefaultNewOverlayMount(path string, parentLayerPaths []string) Mount {
|
||||||
|
om := OverlayMount{
|
||||||
|
Lower: []string{filepath.Join(path, overlayDirLower)},
|
||||||
|
Upper: filepath.Join(path, overlayDirUpper),
|
||||||
|
Work: filepath.Join(path, overlayDirWork),
|
||||||
|
Mountpoint: filepath.Join(path, overlayDirMerged),
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(parentLayerPaths) != 0 {
|
||||||
|
om.Lower = parentLayerPaths
|
||||||
|
}
|
||||||
|
return om
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewLayerWorkdir returns a temporary directory used to produce an overlayfs
|
||||||
|
// layer from an OCI layer.
|
||||||
|
func NewLayerWorkdir(dir, digest string, parentLayerPaths []string, o ...NewLayerWorkdirOption) (LayerWorkdir, error) {
|
||||||
|
opts := &WorkDirOptions{
|
||||||
|
NewOverlayMount: DefaultNewOverlayMount,
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, fn := range o {
|
||||||
|
fn(opts)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := os.MkdirAll(dir, 0700); err != nil {
|
||||||
|
return LayerWorkdir{}, errors.Wrap(err, errMkdirTemp)
|
||||||
|
}
|
||||||
|
tmp, err := os.MkdirTemp(dir, fmt.Sprintf("%s-", digest))
|
||||||
|
if err != nil {
|
||||||
|
return LayerWorkdir{}, errors.Wrap(err, errMkdirTemp)
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, d := range []string{overlayDirMerged, overlayDirUpper, overlayDirLower, overlayDirWork} {
|
||||||
|
if err := os.Mkdir(filepath.Join(tmp, d), 0700); err != nil {
|
||||||
|
_ = os.RemoveAll(tmp)
|
||||||
|
return LayerWorkdir{}, errors.Wrapf(err, errFmtMkOverlayDir, d)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
om := opts.NewOverlayMount(tmp, parentLayerPaths)
|
||||||
|
if err := om.Mount(); err != nil {
|
||||||
|
_ = os.RemoveAll(tmp)
|
||||||
|
return LayerWorkdir{}, errors.Wrap(err, errMountOverlayfs)
|
||||||
|
}
|
||||||
|
|
||||||
|
return LayerWorkdir{overlay: om, path: tmp}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ApplyPath returns the path an OCI layer should be applied (i.e. extracted) to
|
||||||
|
// in order to create an overlayfs layer.
|
||||||
|
func (d LayerWorkdir) ApplyPath() string {
|
||||||
|
return filepath.Join(d.path, overlayDirMerged)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ResultPath returns the path of the resulting overlayfs layer.
|
||||||
|
func (d LayerWorkdir) ResultPath() string {
|
||||||
|
return filepath.Join(d.path, overlayDirUpper)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Cleanup the temporary directory.
|
||||||
|
func (d LayerWorkdir) Cleanup() error {
|
||||||
|
if err := d.overlay.Unmount(); err != nil {
|
||||||
|
return errors.Wrap(err, "cannot unmount workdir overlayfs")
|
||||||
|
}
|
||||||
|
return errors.Wrap(os.RemoveAll(d.path), "cannot remove workdir")
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,59 @@
|
||||||
|
//go:build linux
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package overlay
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"golang.org/x/sys/unix"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// NOTE(negz): Technically _all_ of the overlay implementation is only useful on
|
||||||
|
// Linux, but we want to support building what we can on other operating systems
|
||||||
|
// (e.g. Darwin) to make it possible for folks running them to ensure that code
|
||||||
|
// compiles and passes tests during development. Avoid adding code to this file
|
||||||
|
// unless it actually needs Linux to run.
|
||||||
|
|
||||||
|
// Mount the tmpfs mount.
|
||||||
|
func (m TmpFSMount) Mount() error {
|
||||||
|
var flags uintptr
|
||||||
|
return errors.Wrapf(unix.Mount("tmpfs", m.Mountpoint, "tmpfs", flags, ""), "cannot mount tmpfs at %q", m.Mountpoint)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Unmount the tmpfs mount.
|
||||||
|
func (m TmpFSMount) Unmount() error {
|
||||||
|
var flags int
|
||||||
|
return errors.Wrapf(unix.Unmount(m.Mountpoint, flags), "cannot unmount tmpfs at %q", m.Mountpoint)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Mount the overlay mount.
|
||||||
|
func (m OverlayMount) Mount() error {
|
||||||
|
var flags uintptr
|
||||||
|
data := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", strings.Join(m.Lower, ":"), m.Upper, m.Work)
|
||||||
|
return errors.Wrapf(unix.Mount("overlay", m.Mountpoint, "overlay", flags, data), "cannot mount overlayfs at %q", m.Mountpoint)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Unmount the overlay mount.
|
||||||
|
func (m OverlayMount) Unmount() error {
|
||||||
|
var flags int
|
||||||
|
return errors.Wrapf(unix.Unmount(m.Mountpoint, flags), "cannot unmount overlayfs at %q", m.Mountpoint)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,37 @@
|
||||||
|
//go:build !linux
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package overlay
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
const errLinuxOnly = "overlayfs is only only supported on Linux"
|
||||||
|
|
||||||
|
// Mount returns an error on non-Linux systems.
|
||||||
|
func (m TmpFSMount) Mount() error { return errors.New(errLinuxOnly) }
|
||||||
|
|
||||||
|
// Unmount returns an error on non-Linux systems.
|
||||||
|
func (m TmpFSMount) Unmount() error { return errors.New(errLinuxOnly) }
|
||||||
|
|
||||||
|
// Mount returns an error on non-Linux systems.
|
||||||
|
func (m OverlayMount) Mount() error { return errors.New(errLinuxOnly) }
|
||||||
|
|
||||||
|
// Unmount returns an error on non-Linux systems.
|
||||||
|
func (m OverlayMount) Unmount() error { return errors.New(errLinuxOnly) }
|
||||||
|
|
@ -0,0 +1,453 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package overlay
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/google/go-cmp/cmp"
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/test"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/spec"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/store"
|
||||||
|
)
|
||||||
|
|
||||||
|
type MockImage struct {
|
||||||
|
ociv1.Image
|
||||||
|
|
||||||
|
MockDigest func() (ociv1.Hash, error)
|
||||||
|
MockConfigFile func() (*ociv1.ConfigFile, error)
|
||||||
|
MockLayers func() ([]ociv1.Layer, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (i *MockImage) Digest() (ociv1.Hash, error) { return i.MockDigest() }
|
||||||
|
func (i *MockImage) ConfigFile() (*ociv1.ConfigFile, error) { return i.MockConfigFile() }
|
||||||
|
func (i *MockImage) Layers() ([]ociv1.Layer, error) { return i.MockLayers() }
|
||||||
|
|
||||||
|
type MockLayer struct {
|
||||||
|
ociv1.Layer
|
||||||
|
|
||||||
|
MockDiffID func() (ociv1.Hash, error)
|
||||||
|
MockUncompressed func() (io.ReadCloser, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (l *MockLayer) DiffID() (ociv1.Hash, error) { return l.MockDiffID() }
|
||||||
|
func (l *MockLayer) Uncompressed() (io.ReadCloser, error) { return l.MockUncompressed() }
|
||||||
|
|
||||||
|
type MockLayerResolver struct {
|
||||||
|
path string
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *MockLayerResolver) Resolve(_ context.Context, _ ociv1.Layer, _ ...ociv1.Layer) (string, error) {
|
||||||
|
return r.path, r.err
|
||||||
|
}
|
||||||
|
|
||||||
|
type MockTarballApplicator struct{ err error }
|
||||||
|
|
||||||
|
func (a *MockTarballApplicator) Apply(_ context.Context, _ io.Reader, _ string) error { return a.err }
|
||||||
|
|
||||||
|
type MockRuntimeSpecWriter struct{ err error }
|
||||||
|
|
||||||
|
func (c *MockRuntimeSpecWriter) Write(_ string, _ ...spec.Option) error { return c.err }
|
||||||
|
|
||||||
|
type MockCloser struct {
|
||||||
|
io.Reader
|
||||||
|
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *MockCloser) Close() error { return c.err }
|
||||||
|
|
||||||
|
type MockMount struct{ err error }
|
||||||
|
|
||||||
|
func (m *MockMount) Mount() error { return m.err }
|
||||||
|
func (m *MockMount) Unmount() error { return m.err }
|
||||||
|
|
||||||
|
func TestBundle(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
|
||||||
|
type params struct {
|
||||||
|
layer LayerResolver
|
||||||
|
bundle BundleBootstrapper
|
||||||
|
spec RuntimeSpecWriter
|
||||||
|
}
|
||||||
|
type args struct {
|
||||||
|
ctx context.Context
|
||||||
|
i ociv1.Image
|
||||||
|
id string
|
||||||
|
o []spec.Option
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
b store.Bundle
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
params params
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"ReadConfigFileError": {
|
||||||
|
reason: "We should return any error encountered reading the image's config file.",
|
||||||
|
params: params{},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errReadConfigFile),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"GetLayersError": {
|
||||||
|
reason: "We should return any error encountered reading the image's layers.",
|
||||||
|
params: params{},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return nil, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errGetLayers),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ResolveLayerError": {
|
||||||
|
reason: "We should return any error encountered opening an image's layers.",
|
||||||
|
params: params{
|
||||||
|
layer: &MockLayerResolver{err: errBoom},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return nil, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) {
|
||||||
|
return []ociv1.Layer{&MockLayer{}}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errResolveLayer),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"BootstrapBundleError": {
|
||||||
|
reason: "We should return any error encountered bootstrapping a bundle rootfs.",
|
||||||
|
params: params{
|
||||||
|
layer: &MockLayerResolver{err: nil},
|
||||||
|
bundle: BundleBootstrapperFn(func(path string, parentLayerPaths []string) (Bundle, error) {
|
||||||
|
return Bundle{}, errBoom
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return nil, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) { return nil, nil },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errBootstrapBundle),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"WriteSpecError": {
|
||||||
|
reason: "We should return any error encountered writing a runtime spec to the bundle.",
|
||||||
|
params: params{
|
||||||
|
layer: &MockLayerResolver{err: nil},
|
||||||
|
bundle: BundleBootstrapperFn(func(path string, parentLayerPaths []string) (Bundle, error) {
|
||||||
|
return Bundle{}, nil
|
||||||
|
}),
|
||||||
|
spec: &MockRuntimeSpecWriter{err: errBoom},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return nil, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) { return nil, nil },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errWriteRuntimeSpec),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Success": {
|
||||||
|
reason: "We should successfully return our Bundle.",
|
||||||
|
params: params{
|
||||||
|
layer: &MockLayerResolver{err: nil},
|
||||||
|
bundle: BundleBootstrapperFn(func(path string, parentLayerPaths []string) (Bundle, error) {
|
||||||
|
return Bundle{path: "/coolbundle"}, nil
|
||||||
|
}),
|
||||||
|
spec: &MockRuntimeSpecWriter{err: nil},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return nil, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) {
|
||||||
|
return []ociv1.Layer{&MockLayer{}}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
b: Bundle{path: "/coolbundle"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
tmp, err := os.MkdirTemp(os.TempDir(), strings.ReplaceAll(t.Name(), string(os.PathSeparator), "_"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err.Error())
|
||||||
|
}
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
c := &CachingBundler{
|
||||||
|
root: tmp,
|
||||||
|
layer: tc.params.layer,
|
||||||
|
bundle: tc.params.bundle,
|
||||||
|
spec: tc.params.spec,
|
||||||
|
}
|
||||||
|
|
||||||
|
got, err := c.Bundle(tc.args.ctx, tc.args.i, tc.args.id, tc.args.o...)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.b, got, cmp.AllowUnexported(Bundle{})); diff != "" {
|
||||||
|
t.Errorf("\n%s\nBundle(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nBundle(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestResolve(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
|
||||||
|
type params struct {
|
||||||
|
tarball TarballApplicator
|
||||||
|
wdopts []NewLayerWorkdirOption
|
||||||
|
}
|
||||||
|
type args struct {
|
||||||
|
ctx context.Context
|
||||||
|
l ociv1.Layer
|
||||||
|
parents []ociv1.Layer
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
path string
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
files map[string][]byte
|
||||||
|
params params
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"DiffIDError": {
|
||||||
|
reason: "We should return any error encountered getting the uncompressed layer's digest.",
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) { return ociv1.Hash{}, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errGetDigest),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessExistingLayer": {
|
||||||
|
reason: "We should skip straight to returning the layer if it already exists.",
|
||||||
|
files: map[string][]byte{
|
||||||
|
"sha256/deadbeef": nil,
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "deadbeef"}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
path: "/sha256/deadbeef",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"FetchLayerError": {
|
||||||
|
reason: "We should return any error we encounter while fetching a layer.",
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "deadbeef"}, nil
|
||||||
|
},
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errFetchLayer),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ParentDiffIDError": {
|
||||||
|
reason: "We should return any error we encounter while fetching a parent's uncompressed digest.",
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "deadbeef"}, nil
|
||||||
|
},
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return nil, nil },
|
||||||
|
},
|
||||||
|
parents: []ociv1.Layer{
|
||||||
|
&MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{}, errBoom
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errGetDigest),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"NewLayerWorkDirMountOverlayError": {
|
||||||
|
reason: "We should return any error we encounter when mounting our overlayfs",
|
||||||
|
params: params{
|
||||||
|
wdopts: []NewLayerWorkdirOption{
|
||||||
|
WithNewOverlayMountFn(func(path string, parentLayerPaths []string) Mount {
|
||||||
|
return &MockMount{err: errBoom}
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "deadbeef"}, nil
|
||||||
|
},
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return nil, nil },
|
||||||
|
},
|
||||||
|
parents: []ociv1.Layer{
|
||||||
|
&MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "badc0ffee"}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errors.Wrap(errBoom, errMountOverlayfs), errMkWorkdir),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ApplyTarballError": {
|
||||||
|
reason: "We should return any error we encounter while applying our layer tarball.",
|
||||||
|
params: params{
|
||||||
|
tarball: &MockTarballApplicator{err: errBoom},
|
||||||
|
wdopts: []NewLayerWorkdirOption{
|
||||||
|
WithNewOverlayMountFn(func(path string, parentLayerPaths []string) Mount {
|
||||||
|
return &MockMount{err: nil}
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "deadbeef"}, nil
|
||||||
|
},
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return nil, nil },
|
||||||
|
},
|
||||||
|
parents: []ociv1.Layer{
|
||||||
|
&MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "badc0ffee"}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errApplyLayer),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessNewlyCachedLayer": {
|
||||||
|
reason: "We should return the path to our successfully cached layer.",
|
||||||
|
params: params{
|
||||||
|
tarball: &MockTarballApplicator{},
|
||||||
|
wdopts: []NewLayerWorkdirOption{
|
||||||
|
WithNewOverlayMountFn(func(path string, parentLayerPaths []string) Mount {
|
||||||
|
return &MockMount{err: nil}
|
||||||
|
}),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "deadbeef"}, nil
|
||||||
|
},
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return nil, nil },
|
||||||
|
},
|
||||||
|
parents: []ociv1.Layer{
|
||||||
|
&MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) {
|
||||||
|
return ociv1.Hash{Algorithm: "sha256", Hex: "badc0ffee"}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
path: "/sha256/deadbeef",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
tmp, err := os.MkdirTemp(os.TempDir(), strings.ReplaceAll(t.Name(), string(os.PathSeparator), "_"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err.Error())
|
||||||
|
}
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
for name, data := range tc.files {
|
||||||
|
path := filepath.Join(tmp, name)
|
||||||
|
_ = os.MkdirAll(filepath.Dir(path), 0700)
|
||||||
|
_ = os.WriteFile(path, data, 0600)
|
||||||
|
}
|
||||||
|
|
||||||
|
c := &CachingLayerResolver{
|
||||||
|
root: tmp,
|
||||||
|
tarball: tc.params.tarball,
|
||||||
|
wdopts: tc.params.wdopts,
|
||||||
|
}
|
||||||
|
|
||||||
|
// Prepend our randomly named tmp dir to our wanted layer path.
|
||||||
|
wantPath := tc.want.path
|
||||||
|
if tc.want.path != "" {
|
||||||
|
wantPath = filepath.Join(tmp, tc.want.path)
|
||||||
|
}
|
||||||
|
|
||||||
|
path, err := c.Resolve(tc.args.ctx, tc.args.l, tc.args.parents...)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(wantPath, path); diff != "" {
|
||||||
|
t.Errorf("\n%s\nResolve(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nResolve(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,371 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package store implements OCI container storage.
|
||||||
|
package store
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/sha256"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
|
||||||
|
"github.com/google/go-containerregistry/pkg/name"
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
v1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
"github.com/google/go-containerregistry/pkg/v1/partial"
|
||||||
|
"github.com/google/go-containerregistry/pkg/v1/types"
|
||||||
|
"github.com/google/go-containerregistry/pkg/v1/validate"
|
||||||
|
"golang.org/x/sync/errgroup"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/spec"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Store directories.
|
||||||
|
// Shorter is better, to avoid passing too much data to the mount syscall when
|
||||||
|
// creating an overlay mount with many layers as lower directories.
|
||||||
|
const (
|
||||||
|
DirDigests = "d"
|
||||||
|
DirImages = "i"
|
||||||
|
DirOverlays = "o"
|
||||||
|
DirContainers = "c"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Bundle paths.
|
||||||
|
const (
|
||||||
|
DirRootFS = "rootfs"
|
||||||
|
FileConfig = "config.json"
|
||||||
|
FileSpec = "config.json"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings
|
||||||
|
const (
|
||||||
|
errMkDigestStore = "cannot make digest store"
|
||||||
|
errReadDigest = "cannot read digest"
|
||||||
|
errParseDigest = "cannot parse digest"
|
||||||
|
errStoreDigest = "cannot store digest"
|
||||||
|
errPartial = "cannot complete partial implementation" // This should never happen.
|
||||||
|
errInvalidImage = "stored image is invalid"
|
||||||
|
errGetDigest = "cannot get digest"
|
||||||
|
errMkAlgoDir = "cannot create store directory"
|
||||||
|
errGetRawConfigFile = "cannot get image config file"
|
||||||
|
errMkTmpfile = "cannot create temporary layer file"
|
||||||
|
errReadLayer = "cannot read layer"
|
||||||
|
errMvTmpfile = "cannot move temporary layer file"
|
||||||
|
errOpenConfigFile = "cannot open image config file"
|
||||||
|
errWriteLayers = "cannot write image layers"
|
||||||
|
errInvalidLayer = "stored layer is invalid"
|
||||||
|
errWriteConfigFile = "cannot write image config file"
|
||||||
|
errGetLayers = "cannot get image layers"
|
||||||
|
errWriteLayer = "cannot write layer"
|
||||||
|
errOpenLayer = "cannot open layer"
|
||||||
|
errStatLayer = "cannot stat layer"
|
||||||
|
errCheckExistence = "cannot determine whether layer exists"
|
||||||
|
errFmtTooManyLayers = "image has too many layers: %d (max %d)"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
// MaxLayers is the maximum number of layers an image can have.
|
||||||
|
MaxLayers = 256
|
||||||
|
)
|
||||||
|
|
||||||
|
// A Bundler prepares OCI runtime bundles for use by an OCI runtime.
|
||||||
|
type Bundler interface {
|
||||||
|
// Bundle returns an OCI bundle ready for use by an OCI runtime.
|
||||||
|
Bundle(ctx context.Context, i ociv1.Image, id string, o ...spec.Option) (Bundle, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
// A Bundle for use by an OCI runtime.
|
||||||
|
type Bundle interface {
|
||||||
|
// Path of the OCI bundle.
|
||||||
|
Path() string
|
||||||
|
|
||||||
|
// Cleanup the OCI bundle after the container has finished running.
|
||||||
|
Cleanup() error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A Digest store is used to map OCI references to digests. Each mapping is a
|
||||||
|
// file. The filename is the SHA256 hash of the reference, and the content is
|
||||||
|
// the digest in algo:hex format.
|
||||||
|
type Digest struct{ root string }
|
||||||
|
|
||||||
|
// NewDigest returns a store used to map OCI references to digests.
|
||||||
|
func NewDigest(root string) (*Digest, error) {
|
||||||
|
// We only use sha256 hashes. The sha256 subdirectory is for symmetry with
|
||||||
|
// the other stores, which at least hypothetically support other hashes.
|
||||||
|
path := filepath.Join(root, DirDigests, "sha256")
|
||||||
|
err := os.MkdirAll(path, 0700)
|
||||||
|
return &Digest{root: path}, errors.Wrap(err, errMkDigestStore)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Hash returns the stored hash for the supplied reference.
|
||||||
|
func (d *Digest) Hash(r name.Reference) (ociv1.Hash, error) {
|
||||||
|
b, err := os.ReadFile(d.path(r))
|
||||||
|
if err != nil {
|
||||||
|
return ociv1.Hash{}, errors.Wrap(err, errReadDigest)
|
||||||
|
}
|
||||||
|
h, err := ociv1.NewHash(string(b))
|
||||||
|
return h, errors.Wrap(err, errParseDigest)
|
||||||
|
}
|
||||||
|
|
||||||
|
// WriteHash maps the supplied reference to the supplied hash.
|
||||||
|
func (d *Digest) WriteHash(r name.Reference, h ociv1.Hash) error {
|
||||||
|
return errors.Wrap(os.WriteFile(d.path(r), []byte(h.String()), 0600), errStoreDigest)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Digest) path(r name.Reference) string {
|
||||||
|
return filepath.Join(d.root, fmt.Sprintf("%x", sha256.Sum256([]byte(r.String()))))
|
||||||
|
}
|
||||||
|
|
||||||
|
// An Image store is used to store OCI images and their layers. It uses a
|
||||||
|
// similar disk layout to the blobs directory of an OCI image layout, but may
|
||||||
|
// contain blobs for more than one image. Layers are stored as uncompressed
|
||||||
|
// tarballs in order to speed up extraction by the uncompressed Bundler, which
|
||||||
|
// extracts a fresh root filesystem each time a container is run.
|
||||||
|
// https://github.com/opencontainers/image-spec/blob/v1.0/image-layout.md
|
||||||
|
type Image struct{ root string }
|
||||||
|
|
||||||
|
// NewImage returns a store used to store OCI images and their layers.
|
||||||
|
func NewImage(root string) *Image {
|
||||||
|
return &Image{root: filepath.Join(root, DirImages)}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Image returns the stored image with the supplied hash, if any.
|
||||||
|
func (i *Image) Image(h ociv1.Hash) (ociv1.Image, error) {
|
||||||
|
uncompressed := image{root: i.root, h: h}
|
||||||
|
|
||||||
|
// NOTE(negz): At the time of writing UncompressedToImage doesn't actually
|
||||||
|
// return an error.
|
||||||
|
oi, err := partial.UncompressedToImage(uncompressed)
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errPartial)
|
||||||
|
}
|
||||||
|
|
||||||
|
// This validates the image's manifest, config file, and layers. The
|
||||||
|
// manifest and config file are validated fairly extensively (i.e. their
|
||||||
|
// size, digest, etc must be correct). Layers are only validated to exist.
|
||||||
|
return oi, errors.Wrap(validate.Image(oi, validate.Fast), errInvalidImage)
|
||||||
|
}
|
||||||
|
|
||||||
|
// WriteImage writes the supplied image to the store.
|
||||||
|
func (i *Image) WriteImage(img ociv1.Image) error { //nolint:gocyclo // TODO(phisco): Refactor to reduce complexity.
|
||||||
|
d, err := img.Digest()
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errGetDigest)
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err = i.Image(d); err == nil {
|
||||||
|
// Image already exists in the store.
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
path := filepath.Join(i.root, d.Algorithm, d.Hex)
|
||||||
|
|
||||||
|
if err := os.MkdirAll(filepath.Join(i.root, d.Algorithm), 0700); err != nil {
|
||||||
|
return errors.Wrap(err, errMkAlgoDir)
|
||||||
|
}
|
||||||
|
|
||||||
|
raw, err := img.RawConfigFile()
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errGetRawConfigFile)
|
||||||
|
}
|
||||||
|
|
||||||
|
// CreateTemp creates a file with permission mode 0600.
|
||||||
|
tmp, err := os.CreateTemp(filepath.Join(i.root, d.Algorithm), fmt.Sprintf("%s-", d.Hex))
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errMkTmpfile)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := os.WriteFile(tmp.Name(), raw, 0600); err != nil {
|
||||||
|
_ = os.Remove(tmp.Name())
|
||||||
|
return errors.Wrap(err, errWriteConfigFile)
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO(negz): Ignore os.ErrExist? We might get one here if two callers race
|
||||||
|
// to cache the same image.
|
||||||
|
if err := os.Rename(tmp.Name(), path); err != nil {
|
||||||
|
_ = os.Remove(tmp.Name())
|
||||||
|
return errors.Wrap(err, errMvTmpfile)
|
||||||
|
}
|
||||||
|
|
||||||
|
layers, err := img.Layers()
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errGetLayers)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := Validate(img); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
g := &errgroup.Group{}
|
||||||
|
for _, l := range layers {
|
||||||
|
l := l // Pin loop var.
|
||||||
|
g.Go(func() error {
|
||||||
|
return i.WriteLayer(l)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
return errors.Wrap(g.Wait(), errWriteLayers)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Layer returns the stored layer with the supplied hash, if any.
|
||||||
|
func (i *Image) Layer(h ociv1.Hash) (ociv1.Layer, error) {
|
||||||
|
uncompressed := layer{root: i.root, h: h}
|
||||||
|
|
||||||
|
// NOTE(negz): At the time of writing UncompressedToLayer doesn't actually
|
||||||
|
// return an error.
|
||||||
|
ol, err := partial.UncompressedToLayer(uncompressed)
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errPartial)
|
||||||
|
}
|
||||||
|
|
||||||
|
// This just validates that the layer exists on disk.
|
||||||
|
return ol, errors.Wrap(validate.Layer(ol, validate.Fast), errInvalidLayer)
|
||||||
|
}
|
||||||
|
|
||||||
|
// WriteLayer writes the supplied layer to the store.
|
||||||
|
func (i *Image) WriteLayer(l ociv1.Layer) error {
|
||||||
|
d, err := l.DiffID() // The digest of the uncompressed layer.
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errGetDigest)
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := i.Layer(d); err == nil {
|
||||||
|
// Layer already exists in the store.
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := os.MkdirAll(filepath.Join(i.root, d.Algorithm), 0700); err != nil {
|
||||||
|
return errors.Wrap(err, errMkAlgoDir)
|
||||||
|
}
|
||||||
|
|
||||||
|
// CreateTemp creates a file with permission mode 0600.
|
||||||
|
tmp, err := os.CreateTemp(filepath.Join(i.root, d.Algorithm), fmt.Sprintf("%s-", d.Hex))
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errMkTmpfile)
|
||||||
|
}
|
||||||
|
|
||||||
|
// This call to Uncompressed is what actually pulls the layer.
|
||||||
|
u, err := l.Uncompressed()
|
||||||
|
if err != nil {
|
||||||
|
_ = os.Remove(tmp.Name())
|
||||||
|
return errors.Wrap(err, errReadLayer)
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := copyChunks(tmp, u, 1024*1024); err != nil { // Copy 1MB chunks.
|
||||||
|
_ = os.Remove(tmp.Name())
|
||||||
|
return errors.Wrap(err, errWriteLayer)
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO(negz): Ignore os.ErrExist? We might get one here if two callers race
|
||||||
|
// to cache the same layer.
|
||||||
|
if err := os.Rename(tmp.Name(), filepath.Join(i.root, d.Algorithm, d.Hex)); err != nil {
|
||||||
|
_ = os.Remove(tmp.Name())
|
||||||
|
return errors.Wrap(err, errMvTmpfile)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// image implements partial.UncompressedImage per
|
||||||
|
// https://pkg.go.dev/github.com/google/go-containerregistry/pkg/v1/partial
|
||||||
|
type image struct {
|
||||||
|
root string
|
||||||
|
h ociv1.Hash
|
||||||
|
}
|
||||||
|
|
||||||
|
func (i image) RawConfigFile() ([]byte, error) {
|
||||||
|
b, err := os.ReadFile(filepath.Join(i.root, i.h.Algorithm, i.h.Hex))
|
||||||
|
return b, errors.Wrap(err, errOpenConfigFile)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (i image) MediaType() (types.MediaType, error) {
|
||||||
|
return types.OCIManifestSchema1, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (i image) LayerByDiffID(h ociv1.Hash) (partial.UncompressedLayer, error) {
|
||||||
|
return layer{root: i.root, h: h}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// layer implements partial.UncompressedLayer per
|
||||||
|
// https://pkg.go.dev/github.com/google/go-containerregistry/pkg/v1/partial
|
||||||
|
type layer struct {
|
||||||
|
root string
|
||||||
|
h ociv1.Hash
|
||||||
|
}
|
||||||
|
|
||||||
|
func (l layer) DiffID() (v1.Hash, error) {
|
||||||
|
return l.h, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (l layer) Uncompressed() (io.ReadCloser, error) {
|
||||||
|
f, err := os.Open(filepath.Join(l.root, l.h.Algorithm, l.h.Hex))
|
||||||
|
return f, errors.Wrap(err, errOpenLayer)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (l layer) MediaType() (types.MediaType, error) {
|
||||||
|
return types.OCIUncompressedLayer, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Exists satisfies partial.Exists, which is used to validate the image when
|
||||||
|
// validate.Image or validate.Layer is run with the validate.Fast option.
|
||||||
|
func (l layer) Exists() (bool, error) {
|
||||||
|
_, err := os.Stat(filepath.Join(l.root, l.h.Algorithm, l.h.Hex))
|
||||||
|
if errors.Is(err, os.ErrNotExist) {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return false, errors.Wrap(err, errStatLayer)
|
||||||
|
}
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// copyChunks pleases gosec per https://github.com/securego/gosec/pull/433.
|
||||||
|
// Like Copy it reads from src until EOF, it does not treat an EOF from Read as
|
||||||
|
// an error to be reported.
|
||||||
|
//
|
||||||
|
// NOTE(negz): This rule confused me at first because io.Copy appears to use a
|
||||||
|
// buffer, but in fact it bypasses it if src/dst is an io.WriterTo/ReaderFrom.
|
||||||
|
func copyChunks(dst io.Writer, src io.Reader, chunkSize int64) (int64, error) {
|
||||||
|
var written int64
|
||||||
|
for {
|
||||||
|
w, err := io.CopyN(dst, src, chunkSize)
|
||||||
|
written += w
|
||||||
|
if errors.Is(err, io.EOF) {
|
||||||
|
return written, nil
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return written, err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Validate returns an error if the supplied image is invalid,
|
||||||
|
// e.g. the number of layers is above the maximum allowed.
|
||||||
|
func Validate(img ociv1.Image) error {
|
||||||
|
layers, err := img.Layers()
|
||||||
|
if err != nil {
|
||||||
|
return errors.Wrap(err, errGetLayers)
|
||||||
|
}
|
||||||
|
if nLayers := len(layers); nLayers > MaxLayers {
|
||||||
|
return errors.Errorf(errFmtTooManyLayers, nLayers, MaxLayers)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,353 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package store implements OCI container storage.
|
||||||
|
package store
|
||||||
|
|
||||||
|
import (
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/google/go-cmp/cmp"
|
||||||
|
"github.com/google/go-cmp/cmp/cmpopts"
|
||||||
|
"github.com/google/go-containerregistry/pkg/name"
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/test"
|
||||||
|
)
|
||||||
|
|
||||||
|
type MockImage struct {
|
||||||
|
ociv1.Image
|
||||||
|
|
||||||
|
MockDigest func() (ociv1.Hash, error)
|
||||||
|
MockRawConfigFile func() ([]byte, error)
|
||||||
|
MockLayers func() ([]ociv1.Layer, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (i *MockImage) Digest() (ociv1.Hash, error) { return i.MockDigest() }
|
||||||
|
func (i *MockImage) RawConfigFile() ([]byte, error) { return i.MockRawConfigFile() }
|
||||||
|
func (i *MockImage) Layers() ([]ociv1.Layer, error) { return i.MockLayers() }
|
||||||
|
|
||||||
|
type MockLayer struct {
|
||||||
|
ociv1.Layer
|
||||||
|
|
||||||
|
MockDiffID func() (ociv1.Hash, error)
|
||||||
|
MockUncompressed func() (io.ReadCloser, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (l *MockLayer) DiffID() (ociv1.Hash, error) { return l.MockDiffID() }
|
||||||
|
func (l *MockLayer) Uncompressed() (io.ReadCloser, error) { return l.MockUncompressed() }
|
||||||
|
|
||||||
|
func TestHash(t *testing.T) {
|
||||||
|
type args struct {
|
||||||
|
r name.Reference
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
h ociv1.Hash
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
files map[string][]byte
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"ReadError": {
|
||||||
|
reason: "We should return any error encountered reading the stored hash.",
|
||||||
|
args: args{
|
||||||
|
r: name.MustParseReference("example.org/image"),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
// Note we're matching with cmpopts.EquateErrors, which only
|
||||||
|
// cares that the returned error errors.Is() this one.
|
||||||
|
err: os.ErrNotExist,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ParseError": {
|
||||||
|
reason: "We should return any error encountered reading the stored hash.",
|
||||||
|
files: map[string][]byte{
|
||||||
|
"276640b463239572f62edd97253f05e0de082e9888f57dac0b83d2149efa59e0": []byte("wat"),
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
r: name.MustParseReference("example.org/image"),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: cmpopts.AnyError,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessfulRead": {
|
||||||
|
reason: "We should return the stored hash.",
|
||||||
|
files: map[string][]byte{
|
||||||
|
"276640b463239572f62edd97253f05e0de082e9888f57dac0b83d2149efa59e0": []byte("sha256:c34045c1a1db8d1b3fca8a692198466952daae07eaf6104b4c87ed3b55b6af1b"),
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
r: name.MustParseReference("example.org/image"),
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
h: ociv1.Hash{
|
||||||
|
Algorithm: "sha256",
|
||||||
|
Hex: "c34045c1a1db8d1b3fca8a692198466952daae07eaf6104b4c87ed3b55b6af1b",
|
||||||
|
},
|
||||||
|
err: nil,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
tmp, err := os.MkdirTemp(os.TempDir(), strings.ReplaceAll(t.Name(), string(os.PathSeparator), "_"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err.Error())
|
||||||
|
}
|
||||||
|
t.Cleanup(func() {
|
||||||
|
os.RemoveAll(tmp)
|
||||||
|
})
|
||||||
|
|
||||||
|
for name, data := range tc.files {
|
||||||
|
path := filepath.Join(tmp, DirDigests, "sha256", name)
|
||||||
|
_ = os.MkdirAll(filepath.Dir(path), 0700)
|
||||||
|
_ = os.WriteFile(path, data, 0600)
|
||||||
|
}
|
||||||
|
|
||||||
|
c, err := NewDigest(tmp)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
h, err := c.Hash(tc.args.r)
|
||||||
|
if diff := cmp.Diff(tc.want.h, h); diff != "" {
|
||||||
|
t.Errorf("\n%s\nHash(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
// Note cmpopts.EquateErrors, not the usual testing.EquateErrors
|
||||||
|
// from crossplane-runtime. We need this to support cmpopts.AnyError.
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, cmpopts.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nHash(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWriteImage(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
i ociv1.Image
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
files map[string][]byte
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"DigestError": {
|
||||||
|
reason: "We should return an error if we can't get the image's digest.",
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{}, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errGetDigest),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"RawConfigFileError": {
|
||||||
|
reason: "We should return an error if we can't access the image's raw config file.",
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{Hex: "cool"}, nil },
|
||||||
|
MockRawConfigFile: func() ([]byte, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errGetRawConfigFile),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"WriteLayerError": {
|
||||||
|
reason: "We should return an error if we can't write a layer to the store.",
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{Hex: "cool"}, nil },
|
||||||
|
MockRawConfigFile: func() ([]byte, error) { return nil, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) {
|
||||||
|
return []ociv1.Layer{
|
||||||
|
&MockLayer{
|
||||||
|
// To cause WriteLayer to fail.
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) { return ociv1.Hash{}, errBoom },
|
||||||
|
},
|
||||||
|
}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errors.Wrap(errBoom, errGetDigest), errWriteLayers),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessfulWrite": {
|
||||||
|
reason: "We should not return an error if we successfully wrote an image to the store.",
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{Hex: "cool"}, nil },
|
||||||
|
MockRawConfigFile: func() ([]byte, error) { return []byte(`{"variant":"cool"}`), nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) { return nil, nil },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: nil,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessfulNoOp": {
|
||||||
|
reason: "We should return early if the supplied image is already stored.",
|
||||||
|
files: map[string][]byte{
|
||||||
|
// The minimum valid config file required by validate.Image.
|
||||||
|
"cool": []byte(`{"rootfs":{"type":"layers"}}`),
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockDigest: func() (ociv1.Hash, error) { return ociv1.Hash{Hex: "cool"}, nil },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: nil,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
tmp, err := os.MkdirTemp(os.TempDir(), strings.ReplaceAll(t.Name(), string(os.PathSeparator), "_"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err.Error())
|
||||||
|
}
|
||||||
|
t.Cleanup(func() {
|
||||||
|
os.RemoveAll(tmp)
|
||||||
|
})
|
||||||
|
|
||||||
|
for name, data := range tc.files {
|
||||||
|
path := filepath.Join(tmp, DirImages, name)
|
||||||
|
_ = os.MkdirAll(filepath.Dir(path), 0700)
|
||||||
|
_ = os.WriteFile(path, data, 0600)
|
||||||
|
}
|
||||||
|
|
||||||
|
c := NewImage(tmp)
|
||||||
|
err = c.WriteImage(tc.args.i)
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWriteImage(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestWriteLayer(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
|
||||||
|
type args struct {
|
||||||
|
l ociv1.Layer
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
files map[string][]byte
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"DiffIDError": {
|
||||||
|
reason: "We should return an error if we can't get the layer's (diff) digest.",
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) { return ociv1.Hash{}, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errGetDigest),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Uncompressed": {
|
||||||
|
reason: "We should return an error if we can't get the layer's uncompressed tarball reader.",
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) { return ociv1.Hash{}, nil },
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errReadLayer),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessfulWrite": {
|
||||||
|
reason: "We should not return an error if we successfully wrote a layer to the store.",
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) { return ociv1.Hash{Hex: "cool"}, nil },
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("")), nil },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: nil,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessfulNoOp": {
|
||||||
|
reason: "We should return early if the supplied layer is already stored.",
|
||||||
|
files: map[string][]byte{
|
||||||
|
"cool": nil, // This file just has to exist.
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
l: &MockLayer{
|
||||||
|
MockDiffID: func() (ociv1.Hash, error) { return ociv1.Hash{Hex: "cool"}, nil },
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("")), nil },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: nil,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
tmp, err := os.MkdirTemp(os.TempDir(), strings.ReplaceAll(t.Name(), string(os.PathSeparator), "_"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err.Error())
|
||||||
|
}
|
||||||
|
t.Cleanup(func() {
|
||||||
|
os.RemoveAll(tmp)
|
||||||
|
})
|
||||||
|
|
||||||
|
for name, data := range tc.files {
|
||||||
|
path := filepath.Join(tmp, DirImages, name)
|
||||||
|
_ = os.MkdirAll(filepath.Dir(path), 0700)
|
||||||
|
_ = os.WriteFile(path, data, 0600)
|
||||||
|
}
|
||||||
|
|
||||||
|
c := NewImage(tmp)
|
||||||
|
err = c.WriteLayer(tc.args.l)
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nWriteLayer(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,153 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package uncompressed implemented an uncompressed layer based container store.
|
||||||
|
package uncompressed
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/layer"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/spec"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/store"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Error strings
|
||||||
|
const (
|
||||||
|
errReadConfigFile = "cannot read image config file"
|
||||||
|
errGetLayers = "cannot get image layers"
|
||||||
|
errMkRootFS = "cannot make rootfs directory"
|
||||||
|
errOpenLayer = "cannot open layer tarball"
|
||||||
|
errApplyLayer = "cannot extract layer tarball"
|
||||||
|
errCloseLayer = "cannot close layer tarball"
|
||||||
|
errWriteRuntimeSpec = "cannot write OCI runtime spec"
|
||||||
|
errCleanupBundle = "cannot cleanup OCI runtime bundle"
|
||||||
|
)
|
||||||
|
|
||||||
|
// A TarballApplicator applies (i.e. extracts) an OCI layer tarball.
|
||||||
|
// https://github.com/opencontainers/image-spec/blob/v1.0/layer.md
|
||||||
|
type TarballApplicator interface {
|
||||||
|
// Apply the supplied tarball - an OCI filesystem layer - to the supplied
|
||||||
|
// root directory. Applying all of an image's layers, in the correct order,
|
||||||
|
// should produce the image's "flattened" filesystem.
|
||||||
|
Apply(ctx context.Context, tb io.Reader, root string) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RuntimeSpecWriter writes an OCI runtime spec to the supplied path.
|
||||||
|
type RuntimeSpecWriter interface {
|
||||||
|
// Write and write an OCI runtime spec to the supplied path.
|
||||||
|
Write(path string, o ...spec.Option) error
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RuntimeSpecWriterFn allows a function to satisfy RuntimeSpecCreator.
|
||||||
|
type RuntimeSpecWriterFn func(path string, o ...spec.Option) error
|
||||||
|
|
||||||
|
// Write an OCI runtime spec to the supplied path.
|
||||||
|
func (fn RuntimeSpecWriterFn) Write(path string, o ...spec.Option) error { return fn(path, o...) }
|
||||||
|
|
||||||
|
// A Bundler prepares OCI runtime bundles for use by an OCI runtime. It creates
|
||||||
|
// the bundle's rootfs by extracting the supplied image's uncompressed layer
|
||||||
|
// tarballs.
|
||||||
|
type Bundler struct {
|
||||||
|
root string
|
||||||
|
tarball TarballApplicator
|
||||||
|
spec RuntimeSpecWriter
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewBundler returns a an OCI runtime bundler that creates a bundle's rootfs by
|
||||||
|
// extracting uncompressed layer tarballs.
|
||||||
|
func NewBundler(root string) *Bundler {
|
||||||
|
s := &Bundler{
|
||||||
|
root: filepath.Join(root, store.DirContainers),
|
||||||
|
tarball: layer.NewStackingExtractor(layer.NewWhiteoutHandler(layer.NewExtractHandler())),
|
||||||
|
spec: RuntimeSpecWriterFn(spec.Write),
|
||||||
|
}
|
||||||
|
return s
|
||||||
|
}
|
||||||
|
|
||||||
|
// Bundle returns an OCI bundle ready for use by an OCI runtime.
|
||||||
|
func (c *Bundler) Bundle(ctx context.Context, i ociv1.Image, id string, o ...spec.Option) (store.Bundle, error) {
|
||||||
|
cfg, err := i.ConfigFile()
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errReadConfigFile)
|
||||||
|
}
|
||||||
|
|
||||||
|
layers, err := i.Layers()
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.Wrap(err, errGetLayers)
|
||||||
|
}
|
||||||
|
|
||||||
|
path := filepath.Join(c.root, id)
|
||||||
|
rootfs := filepath.Join(path, store.DirRootFS)
|
||||||
|
if err := os.MkdirAll(rootfs, 0700); err != nil {
|
||||||
|
return nil, errors.Wrap(err, errMkRootFS)
|
||||||
|
}
|
||||||
|
b := Bundle{path: path}
|
||||||
|
|
||||||
|
if err := store.Validate(i); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, l := range layers {
|
||||||
|
tb, err := l.Uncompressed()
|
||||||
|
if err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return nil, errors.Wrap(err, errOpenLayer)
|
||||||
|
}
|
||||||
|
if err := c.tarball.Apply(ctx, tb, rootfs); err != nil {
|
||||||
|
_ = tb.Close()
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return nil, errors.Wrap(err, errApplyLayer)
|
||||||
|
}
|
||||||
|
if err := tb.Close(); err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return nil, errors.Wrap(err, errCloseLayer)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Inject config derived from the image first, so that any options passed in
|
||||||
|
// by the caller will override it.
|
||||||
|
p, g := filepath.Join(rootfs, "etc", "passwd"), filepath.Join(rootfs, "etc", "group")
|
||||||
|
opts := append([]spec.Option{spec.WithImageConfig(cfg, p, g), spec.WithRootFS(store.DirRootFS, true)}, o...)
|
||||||
|
|
||||||
|
if err = c.spec.Write(filepath.Join(path, store.FileSpec), opts...); err != nil {
|
||||||
|
_ = b.Cleanup()
|
||||||
|
return nil, errors.Wrap(err, errWriteRuntimeSpec)
|
||||||
|
}
|
||||||
|
|
||||||
|
return b, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// An Bundle is an OCI runtime bundle. Its root filesystem is a temporary
|
||||||
|
// extraction of its image's cached layers.
|
||||||
|
type Bundle struct {
|
||||||
|
path string
|
||||||
|
}
|
||||||
|
|
||||||
|
// Path to the OCI bundle.
|
||||||
|
func (b Bundle) Path() string { return b.path }
|
||||||
|
|
||||||
|
// Cleanup the OCI bundle.
|
||||||
|
func (b Bundle) Cleanup() error {
|
||||||
|
return errors.Wrap(os.RemoveAll(b.path), errCleanupBundle)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,247 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package uncompressed
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/google/go-cmp/cmp"
|
||||||
|
"github.com/google/go-cmp/cmp/cmpopts"
|
||||||
|
ociv1 "github.com/google/go-containerregistry/pkg/v1"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/errors"
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/test"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/spec"
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/oci/store"
|
||||||
|
)
|
||||||
|
|
||||||
|
type MockImage struct {
|
||||||
|
ociv1.Image
|
||||||
|
|
||||||
|
MockDigest func() (ociv1.Hash, error)
|
||||||
|
MockConfigFile func() (*ociv1.ConfigFile, error)
|
||||||
|
MockLayers func() ([]ociv1.Layer, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (i *MockImage) Digest() (ociv1.Hash, error) { return i.MockDigest() }
|
||||||
|
func (i *MockImage) ConfigFile() (*ociv1.ConfigFile, error) { return i.MockConfigFile() }
|
||||||
|
func (i *MockImage) Layers() ([]ociv1.Layer, error) { return i.MockLayers() }
|
||||||
|
|
||||||
|
type MockLayer struct {
|
||||||
|
ociv1.Layer
|
||||||
|
|
||||||
|
MockDigest func() (ociv1.Hash, error)
|
||||||
|
MockUncompressed func() (io.ReadCloser, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (l *MockLayer) Digest() (ociv1.Hash, error) { return l.MockDigest() }
|
||||||
|
func (l *MockLayer) Uncompressed() (io.ReadCloser, error) { return l.MockUncompressed() }
|
||||||
|
|
||||||
|
type MockTarballApplicator struct{ err error }
|
||||||
|
|
||||||
|
func (a *MockTarballApplicator) Apply(_ context.Context, _ io.Reader, _ string) error { return a.err }
|
||||||
|
|
||||||
|
type MockRuntimeSpecWriter struct{ err error }
|
||||||
|
|
||||||
|
func (c *MockRuntimeSpecWriter) Write(_ string, _ ...spec.Option) error { return c.err }
|
||||||
|
|
||||||
|
type MockCloser struct {
|
||||||
|
io.Reader
|
||||||
|
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *MockCloser) Close() error { return c.err }
|
||||||
|
|
||||||
|
func TestBundle(t *testing.T) {
|
||||||
|
errBoom := errors.New("boom")
|
||||||
|
|
||||||
|
type params struct {
|
||||||
|
tarball TarballApplicator
|
||||||
|
spec RuntimeSpecWriter
|
||||||
|
}
|
||||||
|
type args struct {
|
||||||
|
ctx context.Context
|
||||||
|
i ociv1.Image
|
||||||
|
id string
|
||||||
|
o []spec.Option
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
b store.Bundle
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
params params
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"ReadConfigFileError": {
|
||||||
|
reason: "We should return any error encountered reading the image's config file.",
|
||||||
|
params: params{},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errReadConfigFile),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"GetLayersError": {
|
||||||
|
reason: "We should return any error encountered reading the image's layers.",
|
||||||
|
params: params{},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return &ociv1.ConfigFile{}, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) { return nil, errBoom },
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errGetLayers),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"UncompressedLayerError": {
|
||||||
|
reason: "We should return any error encountered opening an image's uncompressed layers.",
|
||||||
|
params: params{},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return &ociv1.ConfigFile{}, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) {
|
||||||
|
return []ociv1.Layer{&MockLayer{
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return nil, errBoom },
|
||||||
|
}}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errOpenLayer),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ApplyLayerTarballError": {
|
||||||
|
reason: "We should return any error encountered applying an image's layer tarball.",
|
||||||
|
params: params{
|
||||||
|
tarball: &MockTarballApplicator{err: errBoom},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return &ociv1.ConfigFile{}, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) {
|
||||||
|
return []ociv1.Layer{&MockLayer{
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("")), nil },
|
||||||
|
}}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errApplyLayer),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"CloseLayerError": {
|
||||||
|
reason: "We should return any error encountered closing an image's layer tarball.",
|
||||||
|
params: params{
|
||||||
|
tarball: &MockTarballApplicator{},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return &ociv1.ConfigFile{}, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) {
|
||||||
|
return []ociv1.Layer{&MockLayer{
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return &MockCloser{err: errBoom}, nil },
|
||||||
|
}}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errCloseLayer),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"WriteRuntimeSpecError": {
|
||||||
|
reason: "We should return any error encountered creating the bundle's OCI runtime spec.",
|
||||||
|
params: params{
|
||||||
|
tarball: &MockTarballApplicator{},
|
||||||
|
spec: &MockRuntimeSpecWriter{err: errBoom},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return &ociv1.ConfigFile{}, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) {
|
||||||
|
return []ociv1.Layer{&MockLayer{
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("")), nil },
|
||||||
|
}}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.Wrap(errBoom, errWriteRuntimeSpec),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"SuccessfulBundle": {
|
||||||
|
reason: "We should create and return an OCI bundle.",
|
||||||
|
params: params{
|
||||||
|
tarball: &MockTarballApplicator{},
|
||||||
|
spec: &MockRuntimeSpecWriter{},
|
||||||
|
},
|
||||||
|
args: args{
|
||||||
|
i: &MockImage{
|
||||||
|
MockConfigFile: func() (*ociv1.ConfigFile, error) { return &ociv1.ConfigFile{}, nil },
|
||||||
|
MockLayers: func() ([]ociv1.Layer, error) {
|
||||||
|
return []ociv1.Layer{&MockLayer{
|
||||||
|
MockUncompressed: func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("")), nil },
|
||||||
|
}}, nil
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
// NOTE(negz): We cmpopts.IngoreUnexported this type below, so
|
||||||
|
// we're really only testing that a non-nil bundle was returned.
|
||||||
|
b: Bundle{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
tmp, err := os.MkdirTemp(os.TempDir(), strings.ReplaceAll(t.Name(), string(os.PathSeparator), "_"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err.Error())
|
||||||
|
}
|
||||||
|
defer os.RemoveAll(tmp)
|
||||||
|
|
||||||
|
c := &Bundler{
|
||||||
|
root: tmp,
|
||||||
|
tarball: tc.params.tarball,
|
||||||
|
spec: tc.params.spec,
|
||||||
|
}
|
||||||
|
|
||||||
|
got, err := c.Bundle(tc.args.ctx, tc.args.i, tc.args.id, tc.args.o...)
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.b, got, cmpopts.IgnoreUnexported(Bundle{})); diff != "" {
|
||||||
|
t.Errorf("\n%s\nBundle(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nBundle(...): -want error, +got error:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
# This file contains configuration for the `buf generate` command.
|
||||||
|
# See generate.go for more details.
|
||||||
|
version: v1
|
||||||
|
plugins:
|
||||||
|
- plugin: go
|
||||||
|
out: .
|
||||||
|
opt: paths=source_relative
|
||||||
|
- plugin: go-grpc
|
||||||
|
out: .
|
||||||
|
opt: paths=source_relative
|
||||||
|
|
@ -0,0 +1,31 @@
|
||||||
|
//go:build generate
|
||||||
|
// +build generate
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2019 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
//go:generate go install google.golang.org/protobuf/cmd/protoc-gen-go google.golang.org/grpc/cmd/protoc-gen-go-grpc
|
||||||
|
//go:generate go run github.com/bufbuild/buf/cmd/buf generate
|
||||||
|
|
||||||
|
// Package proto contains protocol buffer definitions.
|
||||||
|
package proto
|
||||||
|
|
||||||
|
import (
|
||||||
|
_ "github.com/bufbuild/buf/cmd/buf" //nolint:typecheck
|
||||||
|
_ "google.golang.org/grpc/cmd/protoc-gen-go-grpc" //nolint:typecheck
|
||||||
|
_ "google.golang.org/protobuf/cmd/protoc-gen-go" //nolint:typecheck
|
||||||
|
_ "k8s.io/code-generator" //nolint:typecheck
|
||||||
|
)
|
||||||
|
|
@ -0,0 +1,920 @@
|
||||||
|
//
|
||||||
|
//Copyright 2022 The Crossplane Authors.
|
||||||
|
//
|
||||||
|
//Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
//you may not use this file except in compliance with the License.
|
||||||
|
//You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
//http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
//Unless required by applicable law or agreed to in writing, software
|
||||||
|
//distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
//See the License for the specific language governing permissions and
|
||||||
|
//limitations under the License.
|
||||||
|
|
||||||
|
// TODO(negz): Add a make target such that `make lint` runs `buf lint`.
|
||||||
|
|
||||||
|
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||||
|
// versions:
|
||||||
|
// protoc-gen-go v1.31.0
|
||||||
|
// protoc (unknown)
|
||||||
|
// source: v1alpha1/run_function.proto
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
|
||||||
|
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
|
||||||
|
durationpb "google.golang.org/protobuf/types/known/durationpb"
|
||||||
|
reflect "reflect"
|
||||||
|
sync "sync"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// Verify that this generated code is sufficiently up-to-date.
|
||||||
|
_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
|
||||||
|
// Verify that runtime/protoimpl is sufficiently up-to-date.
|
||||||
|
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
|
||||||
|
)
|
||||||
|
|
||||||
|
// ImagePullPolicy specifies when a Composition Function container should be
|
||||||
|
// pulled from a remote OCI registry.
|
||||||
|
type ImagePullPolicy int32
|
||||||
|
|
||||||
|
const (
|
||||||
|
ImagePullPolicy_IMAGE_PULL_POLICY_UNSPECIFIED ImagePullPolicy = 0
|
||||||
|
ImagePullPolicy_IMAGE_PULL_POLICY_IF_NOT_PRESENT ImagePullPolicy = 1
|
||||||
|
ImagePullPolicy_IMAGE_PULL_POLICY_ALWAYS ImagePullPolicy = 2
|
||||||
|
ImagePullPolicy_IMAGE_PULL_POLICY_NEVER ImagePullPolicy = 3
|
||||||
|
)
|
||||||
|
|
||||||
|
// Enum value maps for ImagePullPolicy.
|
||||||
|
var (
|
||||||
|
ImagePullPolicy_name = map[int32]string{
|
||||||
|
0: "IMAGE_PULL_POLICY_UNSPECIFIED",
|
||||||
|
1: "IMAGE_PULL_POLICY_IF_NOT_PRESENT",
|
||||||
|
2: "IMAGE_PULL_POLICY_ALWAYS",
|
||||||
|
3: "IMAGE_PULL_POLICY_NEVER",
|
||||||
|
}
|
||||||
|
ImagePullPolicy_value = map[string]int32{
|
||||||
|
"IMAGE_PULL_POLICY_UNSPECIFIED": 0,
|
||||||
|
"IMAGE_PULL_POLICY_IF_NOT_PRESENT": 1,
|
||||||
|
"IMAGE_PULL_POLICY_ALWAYS": 2,
|
||||||
|
"IMAGE_PULL_POLICY_NEVER": 3,
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
func (x ImagePullPolicy) Enum() *ImagePullPolicy {
|
||||||
|
p := new(ImagePullPolicy)
|
||||||
|
*p = x
|
||||||
|
return p
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x ImagePullPolicy) String() string {
|
||||||
|
return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (ImagePullPolicy) Descriptor() protoreflect.EnumDescriptor {
|
||||||
|
return file_v1alpha1_run_function_proto_enumTypes[0].Descriptor()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (ImagePullPolicy) Type() protoreflect.EnumType {
|
||||||
|
return &file_v1alpha1_run_function_proto_enumTypes[0]
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x ImagePullPolicy) Number() protoreflect.EnumNumber {
|
||||||
|
return protoreflect.EnumNumber(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use ImagePullPolicy.Descriptor instead.
|
||||||
|
func (ImagePullPolicy) EnumDescriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{0}
|
||||||
|
}
|
||||||
|
|
||||||
|
// NetworkPolicy configures whether a container is isolated from the network.
|
||||||
|
type NetworkPolicy int32
|
||||||
|
|
||||||
|
const (
|
||||||
|
NetworkPolicy_NETWORK_POLICY_UNSPECIFIED NetworkPolicy = 0
|
||||||
|
// Run the container without network access. The default.
|
||||||
|
NetworkPolicy_NETWORK_POLICY_ISOLATED NetworkPolicy = 1
|
||||||
|
// Allow the container to access the same network as the function runner.
|
||||||
|
NetworkPolicy_NETWORK_POLICY_RUNNER NetworkPolicy = 2
|
||||||
|
)
|
||||||
|
|
||||||
|
// Enum value maps for NetworkPolicy.
|
||||||
|
var (
|
||||||
|
NetworkPolicy_name = map[int32]string{
|
||||||
|
0: "NETWORK_POLICY_UNSPECIFIED",
|
||||||
|
1: "NETWORK_POLICY_ISOLATED",
|
||||||
|
2: "NETWORK_POLICY_RUNNER",
|
||||||
|
}
|
||||||
|
NetworkPolicy_value = map[string]int32{
|
||||||
|
"NETWORK_POLICY_UNSPECIFIED": 0,
|
||||||
|
"NETWORK_POLICY_ISOLATED": 1,
|
||||||
|
"NETWORK_POLICY_RUNNER": 2,
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
func (x NetworkPolicy) Enum() *NetworkPolicy {
|
||||||
|
p := new(NetworkPolicy)
|
||||||
|
*p = x
|
||||||
|
return p
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x NetworkPolicy) String() string {
|
||||||
|
return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (NetworkPolicy) Descriptor() protoreflect.EnumDescriptor {
|
||||||
|
return file_v1alpha1_run_function_proto_enumTypes[1].Descriptor()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (NetworkPolicy) Type() protoreflect.EnumType {
|
||||||
|
return &file_v1alpha1_run_function_proto_enumTypes[1]
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x NetworkPolicy) Number() protoreflect.EnumNumber {
|
||||||
|
return protoreflect.EnumNumber(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use NetworkPolicy.Descriptor instead.
|
||||||
|
func (NetworkPolicy) EnumDescriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{1}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ImagePullAuth configures authentication to a remote OCI registry.
|
||||||
|
// It corresponds to go-containerregistry's AuthConfig type.
|
||||||
|
// https://pkg.go.dev/github.com/google/go-containerregistry@v0.11.0/pkg/authn#AuthConfig
|
||||||
|
type ImagePullAuth struct {
|
||||||
|
state protoimpl.MessageState
|
||||||
|
sizeCache protoimpl.SizeCache
|
||||||
|
unknownFields protoimpl.UnknownFields
|
||||||
|
|
||||||
|
Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
|
||||||
|
Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
|
||||||
|
Auth string `protobuf:"bytes,3,opt,name=auth,proto3" json:"auth,omitempty"`
|
||||||
|
IdentityToken string `protobuf:"bytes,4,opt,name=identity_token,json=identityToken,proto3" json:"identity_token,omitempty"`
|
||||||
|
RegistryToken string `protobuf:"bytes,5,opt,name=registry_token,json=registryToken,proto3" json:"registry_token,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullAuth) Reset() {
|
||||||
|
*x = ImagePullAuth{}
|
||||||
|
if protoimpl.UnsafeEnabled {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[0]
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullAuth) String() string {
|
||||||
|
return protoimpl.X.MessageStringOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (*ImagePullAuth) ProtoMessage() {}
|
||||||
|
|
||||||
|
func (x *ImagePullAuth) ProtoReflect() protoreflect.Message {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[0]
|
||||||
|
if protoimpl.UnsafeEnabled && x != nil {
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
if ms.LoadMessageInfo() == nil {
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
return ms
|
||||||
|
}
|
||||||
|
return mi.MessageOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use ImagePullAuth.ProtoReflect.Descriptor instead.
|
||||||
|
func (*ImagePullAuth) Descriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{0}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullAuth) GetUsername() string {
|
||||||
|
if x != nil {
|
||||||
|
return x.Username
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullAuth) GetPassword() string {
|
||||||
|
if x != nil {
|
||||||
|
return x.Password
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullAuth) GetAuth() string {
|
||||||
|
if x != nil {
|
||||||
|
return x.Auth
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullAuth) GetIdentityToken() string {
|
||||||
|
if x != nil {
|
||||||
|
return x.IdentityToken
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullAuth) GetRegistryToken() string {
|
||||||
|
if x != nil {
|
||||||
|
return x.RegistryToken
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
// ImagePullConfig configures how a Composition Function container should be
|
||||||
|
// pulled from a remote OCI registry.
|
||||||
|
type ImagePullConfig struct {
|
||||||
|
state protoimpl.MessageState
|
||||||
|
sizeCache protoimpl.SizeCache
|
||||||
|
unknownFields protoimpl.UnknownFields
|
||||||
|
|
||||||
|
PullPolicy ImagePullPolicy `protobuf:"varint,1,opt,name=pull_policy,json=pullPolicy,proto3,enum=apiextensions.fn.proto.v1alpha1.ImagePullPolicy" json:"pull_policy,omitempty"`
|
||||||
|
Auth *ImagePullAuth `protobuf:"bytes,2,opt,name=auth,proto3" json:"auth,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullConfig) Reset() {
|
||||||
|
*x = ImagePullConfig{}
|
||||||
|
if protoimpl.UnsafeEnabled {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[1]
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullConfig) String() string {
|
||||||
|
return protoimpl.X.MessageStringOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (*ImagePullConfig) ProtoMessage() {}
|
||||||
|
|
||||||
|
func (x *ImagePullConfig) ProtoReflect() protoreflect.Message {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[1]
|
||||||
|
if protoimpl.UnsafeEnabled && x != nil {
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
if ms.LoadMessageInfo() == nil {
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
return ms
|
||||||
|
}
|
||||||
|
return mi.MessageOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use ImagePullConfig.ProtoReflect.Descriptor instead.
|
||||||
|
func (*ImagePullConfig) Descriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{1}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullConfig) GetPullPolicy() ImagePullPolicy {
|
||||||
|
if x != nil {
|
||||||
|
return x.PullPolicy
|
||||||
|
}
|
||||||
|
return ImagePullPolicy_IMAGE_PULL_POLICY_UNSPECIFIED
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ImagePullConfig) GetAuth() *ImagePullAuth {
|
||||||
|
if x != nil {
|
||||||
|
return x.Auth
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// NetworkConfig configures whether and how a Composition Function container may
|
||||||
|
// access the network.
|
||||||
|
type NetworkConfig struct {
|
||||||
|
state protoimpl.MessageState
|
||||||
|
sizeCache protoimpl.SizeCache
|
||||||
|
unknownFields protoimpl.UnknownFields
|
||||||
|
|
||||||
|
// Whether or not the container can access the network.
|
||||||
|
Policy NetworkPolicy `protobuf:"varint,1,opt,name=policy,proto3,enum=apiextensions.fn.proto.v1alpha1.NetworkPolicy" json:"policy,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *NetworkConfig) Reset() {
|
||||||
|
*x = NetworkConfig{}
|
||||||
|
if protoimpl.UnsafeEnabled {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[2]
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *NetworkConfig) String() string {
|
||||||
|
return protoimpl.X.MessageStringOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (*NetworkConfig) ProtoMessage() {}
|
||||||
|
|
||||||
|
func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[2]
|
||||||
|
if protoimpl.UnsafeEnabled && x != nil {
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
if ms.LoadMessageInfo() == nil {
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
return ms
|
||||||
|
}
|
||||||
|
return mi.MessageOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use NetworkConfig.ProtoReflect.Descriptor instead.
|
||||||
|
func (*NetworkConfig) Descriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{2}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *NetworkConfig) GetPolicy() NetworkPolicy {
|
||||||
|
if x != nil {
|
||||||
|
return x.Policy
|
||||||
|
}
|
||||||
|
return NetworkPolicy_NETWORK_POLICY_UNSPECIFIED
|
||||||
|
}
|
||||||
|
|
||||||
|
// Resources configures what compute resources should be available to a
|
||||||
|
// Composition Function container.
|
||||||
|
type ResourceConfig struct {
|
||||||
|
state protoimpl.MessageState
|
||||||
|
sizeCache protoimpl.SizeCache
|
||||||
|
unknownFields protoimpl.UnknownFields
|
||||||
|
|
||||||
|
Limits *ResourceLimits `protobuf:"bytes,1,opt,name=limits,proto3" json:"limits,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ResourceConfig) Reset() {
|
||||||
|
*x = ResourceConfig{}
|
||||||
|
if protoimpl.UnsafeEnabled {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[3]
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ResourceConfig) String() string {
|
||||||
|
return protoimpl.X.MessageStringOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (*ResourceConfig) ProtoMessage() {}
|
||||||
|
|
||||||
|
func (x *ResourceConfig) ProtoReflect() protoreflect.Message {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[3]
|
||||||
|
if protoimpl.UnsafeEnabled && x != nil {
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
if ms.LoadMessageInfo() == nil {
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
return ms
|
||||||
|
}
|
||||||
|
return mi.MessageOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use ResourceConfig.ProtoReflect.Descriptor instead.
|
||||||
|
func (*ResourceConfig) Descriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{3}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ResourceConfig) GetLimits() *ResourceLimits {
|
||||||
|
if x != nil {
|
||||||
|
return x.Limits
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ResourceLimits configures the maximum compute resources that will be
|
||||||
|
// available to a Composition Function container.
|
||||||
|
type ResourceLimits struct {
|
||||||
|
state protoimpl.MessageState
|
||||||
|
sizeCache protoimpl.SizeCache
|
||||||
|
unknownFields protoimpl.UnknownFields
|
||||||
|
|
||||||
|
// CPU, in cores. (500m = .5 cores)
|
||||||
|
// Specified in Kubernetes-style resource.Quantity form.
|
||||||
|
Memory string `protobuf:"bytes,1,opt,name=memory,proto3" json:"memory,omitempty"`
|
||||||
|
// Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
|
||||||
|
// Specified in Kubernetes-style resource.Quantity form.
|
||||||
|
Cpu string `protobuf:"bytes,2,opt,name=cpu,proto3" json:"cpu,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ResourceLimits) Reset() {
|
||||||
|
*x = ResourceLimits{}
|
||||||
|
if protoimpl.UnsafeEnabled {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[4]
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ResourceLimits) String() string {
|
||||||
|
return protoimpl.X.MessageStringOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (*ResourceLimits) ProtoMessage() {}
|
||||||
|
|
||||||
|
func (x *ResourceLimits) ProtoReflect() protoreflect.Message {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[4]
|
||||||
|
if protoimpl.UnsafeEnabled && x != nil {
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
if ms.LoadMessageInfo() == nil {
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
return ms
|
||||||
|
}
|
||||||
|
return mi.MessageOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use ResourceLimits.ProtoReflect.Descriptor instead.
|
||||||
|
func (*ResourceLimits) Descriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{4}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ResourceLimits) GetMemory() string {
|
||||||
|
if x != nil {
|
||||||
|
return x.Memory
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *ResourceLimits) GetCpu() string {
|
||||||
|
if x != nil {
|
||||||
|
return x.Cpu
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
// RunFunctionConfig configures how a Composition Function container is run.
|
||||||
|
type RunFunctionConfig struct {
|
||||||
|
state protoimpl.MessageState
|
||||||
|
sizeCache protoimpl.SizeCache
|
||||||
|
unknownFields protoimpl.UnknownFields
|
||||||
|
|
||||||
|
// Resources available to the container.
|
||||||
|
Resources *ResourceConfig `protobuf:"bytes,1,opt,name=resources,proto3" json:"resources,omitempty"`
|
||||||
|
// Network configuration for the container.
|
||||||
|
Network *NetworkConfig `protobuf:"bytes,2,opt,name=network,proto3" json:"network,omitempty"`
|
||||||
|
// Timeout after which the container will be killed.
|
||||||
|
Timeout *durationpb.Duration `protobuf:"bytes,3,opt,name=timeout,proto3" json:"timeout,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionConfig) Reset() {
|
||||||
|
*x = RunFunctionConfig{}
|
||||||
|
if protoimpl.UnsafeEnabled {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[5]
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionConfig) String() string {
|
||||||
|
return protoimpl.X.MessageStringOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (*RunFunctionConfig) ProtoMessage() {}
|
||||||
|
|
||||||
|
func (x *RunFunctionConfig) ProtoReflect() protoreflect.Message {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[5]
|
||||||
|
if protoimpl.UnsafeEnabled && x != nil {
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
if ms.LoadMessageInfo() == nil {
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
return ms
|
||||||
|
}
|
||||||
|
return mi.MessageOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use RunFunctionConfig.ProtoReflect.Descriptor instead.
|
||||||
|
func (*RunFunctionConfig) Descriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{5}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionConfig) GetResources() *ResourceConfig {
|
||||||
|
if x != nil {
|
||||||
|
return x.Resources
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionConfig) GetNetwork() *NetworkConfig {
|
||||||
|
if x != nil {
|
||||||
|
return x.Network
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionConfig) GetTimeout() *durationpb.Duration {
|
||||||
|
if x != nil {
|
||||||
|
return x.Timeout
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RunFunctionRequest requests that a Composition Function be run.
|
||||||
|
type RunFunctionRequest struct {
|
||||||
|
state protoimpl.MessageState
|
||||||
|
sizeCache protoimpl.SizeCache
|
||||||
|
unknownFields protoimpl.UnknownFields
|
||||||
|
|
||||||
|
// OCI image of the Composition Function.
|
||||||
|
Image string `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
|
||||||
|
// A FunctionIO serialized as YAML.
|
||||||
|
Input []byte `protobuf:"bytes,2,opt,name=input,proto3" json:"input,omitempty"`
|
||||||
|
// Configures how the function image is pulled.
|
||||||
|
ImagePullConfig *ImagePullConfig `protobuf:"bytes,3,opt,name=image_pull_config,json=imagePullConfig,proto3" json:"image_pull_config,omitempty"`
|
||||||
|
// Configures how the function container is run.
|
||||||
|
RunFunctionConfig *RunFunctionConfig `protobuf:"bytes,4,opt,name=run_function_config,json=runFunctionConfig,proto3" json:"run_function_config,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionRequest) Reset() {
|
||||||
|
*x = RunFunctionRequest{}
|
||||||
|
if protoimpl.UnsafeEnabled {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[6]
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionRequest) String() string {
|
||||||
|
return protoimpl.X.MessageStringOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (*RunFunctionRequest) ProtoMessage() {}
|
||||||
|
|
||||||
|
func (x *RunFunctionRequest) ProtoReflect() protoreflect.Message {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[6]
|
||||||
|
if protoimpl.UnsafeEnabled && x != nil {
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
if ms.LoadMessageInfo() == nil {
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
return ms
|
||||||
|
}
|
||||||
|
return mi.MessageOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use RunFunctionRequest.ProtoReflect.Descriptor instead.
|
||||||
|
func (*RunFunctionRequest) Descriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{6}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionRequest) GetImage() string {
|
||||||
|
if x != nil {
|
||||||
|
return x.Image
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionRequest) GetInput() []byte {
|
||||||
|
if x != nil {
|
||||||
|
return x.Input
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionRequest) GetImagePullConfig() *ImagePullConfig {
|
||||||
|
if x != nil {
|
||||||
|
return x.ImagePullConfig
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionRequest) GetRunFunctionConfig() *RunFunctionConfig {
|
||||||
|
if x != nil {
|
||||||
|
return x.RunFunctionConfig
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RunFunctionResponse contains the response from a Composition Function run.
|
||||||
|
// The output FunctionIO is returned as opaque bytes. Errors encountered while
|
||||||
|
// running a function (as opposed to errors returned _by_ a function) will be
|
||||||
|
// encapsulated as gRPC errors.
|
||||||
|
type RunFunctionResponse struct {
|
||||||
|
state protoimpl.MessageState
|
||||||
|
sizeCache protoimpl.SizeCache
|
||||||
|
unknownFields protoimpl.UnknownFields
|
||||||
|
|
||||||
|
Output []byte `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionResponse) Reset() {
|
||||||
|
*x = RunFunctionResponse{}
|
||||||
|
if protoimpl.UnsafeEnabled {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[7]
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionResponse) String() string {
|
||||||
|
return protoimpl.X.MessageStringOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (*RunFunctionResponse) ProtoMessage() {}
|
||||||
|
|
||||||
|
func (x *RunFunctionResponse) ProtoReflect() protoreflect.Message {
|
||||||
|
mi := &file_v1alpha1_run_function_proto_msgTypes[7]
|
||||||
|
if protoimpl.UnsafeEnabled && x != nil {
|
||||||
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||||
|
if ms.LoadMessageInfo() == nil {
|
||||||
|
ms.StoreMessageInfo(mi)
|
||||||
|
}
|
||||||
|
return ms
|
||||||
|
}
|
||||||
|
return mi.MessageOf(x)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Deprecated: Use RunFunctionResponse.ProtoReflect.Descriptor instead.
|
||||||
|
func (*RunFunctionResponse) Descriptor() ([]byte, []int) {
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescGZIP(), []int{7}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (x *RunFunctionResponse) GetOutput() []byte {
|
||||||
|
if x != nil {
|
||||||
|
return x.Output
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
var File_v1alpha1_run_function_proto protoreflect.FileDescriptor
|
||||||
|
|
||||||
|
var file_v1alpha1_run_function_proto_rawDesc = []byte{
|
||||||
|
0x0a, 0x1b, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x72, 0x75, 0x6e, 0x5f, 0x66,
|
||||||
|
0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1f, 0x61,
|
||||||
|
0x70, 0x69, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x6e, 0x2e,
|
||||||
|
0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1e,
|
||||||
|
0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
|
||||||
|
0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa9,
|
||||||
|
0x01, 0x0a, 0x0d, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x41, 0x75, 0x74, 0x68,
|
||||||
|
0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
|
||||||
|
0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08,
|
||||||
|
0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
|
||||||
|
0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68,
|
||||||
|
0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x25, 0x0a, 0x0e,
|
||||||
|
0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x04,
|
||||||
|
0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f,
|
||||||
|
0x6b, 0x65, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x5f,
|
||||||
|
0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x72, 0x65, 0x67,
|
||||||
|
0x69, 0x73, 0x74, 0x72, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xa8, 0x01, 0x0a, 0x0f, 0x49,
|
||||||
|
0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x51,
|
||||||
|
0x0a, 0x0b, 0x70, 0x75, 0x6c, 0x6c, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18, 0x01, 0x20,
|
||||||
|
0x01, 0x28, 0x0e, 0x32, 0x30, 0x2e, 0x61, 0x70, 0x69, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
|
||||||
|
0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x31, 0x61,
|
||||||
|
0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x50,
|
||||||
|
0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x0a, 0x70, 0x75, 0x6c, 0x6c, 0x50, 0x6f, 0x6c, 0x69, 0x63,
|
||||||
|
0x79, 0x12, 0x42, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
|
||||||
|
0x2e, 0x2e, 0x61, 0x70, 0x69, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
|
||||||
|
0x66, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
|
||||||
|
0x31, 0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x52,
|
||||||
|
0x04, 0x61, 0x75, 0x74, 0x68, 0x22, 0x57, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
|
||||||
|
0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x46, 0x0a, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
|
||||||
|
0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2e, 0x2e, 0x61, 0x70, 0x69, 0x65, 0x78, 0x74, 0x65,
|
||||||
|
0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
|
||||||
|
0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
|
||||||
|
0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x59,
|
||||||
|
0x0a, 0x0e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
|
||||||
|
0x12, 0x47, 0x0a, 0x06, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
|
||||||
|
0x32, 0x2f, 0x2e, 0x61, 0x70, 0x69, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73,
|
||||||
|
0x2e, 0x66, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
|
||||||
|
0x61, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4c, 0x69, 0x6d, 0x69, 0x74,
|
||||||
|
0x73, 0x52, 0x06, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x22, 0x3a, 0x0a, 0x0e, 0x52, 0x65, 0x73,
|
||||||
|
0x6f, 0x75, 0x72, 0x63, 0x65, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d,
|
||||||
|
0x65, 0x6d, 0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x6d,
|
||||||
|
0x6f, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x63, 0x70, 0x75, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
|
||||||
|
0x52, 0x03, 0x63, 0x70, 0x75, 0x22, 0xe1, 0x01, 0x0a, 0x11, 0x52, 0x75, 0x6e, 0x46, 0x75, 0x6e,
|
||||||
|
0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x4d, 0x0a, 0x09, 0x72,
|
||||||
|
0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f,
|
||||||
|
0x2e, 0x61, 0x70, 0x69, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66,
|
||||||
|
0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
|
||||||
|
0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
|
||||||
|
0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x48, 0x0a, 0x07, 0x6e, 0x65,
|
||||||
|
0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x61, 0x70,
|
||||||
|
0x69, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x6e, 0x2e, 0x70,
|
||||||
|
0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4e, 0x65,
|
||||||
|
0x74, 0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74,
|
||||||
|
0x77, 0x6f, 0x72, 0x6b, 0x12, 0x33, 0x0a, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18,
|
||||||
|
0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
|
||||||
|
0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
|
||||||
|
0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x22, 0x82, 0x02, 0x0a, 0x12, 0x52, 0x75,
|
||||||
|
0x6e, 0x46, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
|
||||||
|
0x12, 0x14, 0x0a, 0x05, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
|
||||||
|
0x05, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x18,
|
||||||
|
0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x5c, 0x0a, 0x11,
|
||||||
|
0x69, 0x6d, 0x61, 0x67, 0x65, 0x5f, 0x70, 0x75, 0x6c, 0x6c, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69,
|
||||||
|
0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x61, 0x70, 0x69, 0x65, 0x78, 0x74,
|
||||||
|
0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
|
||||||
|
0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x50,
|
||||||
|
0x75, 0x6c, 0x6c, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0f, 0x69, 0x6d, 0x61, 0x67, 0x65,
|
||||||
|
0x50, 0x75, 0x6c, 0x6c, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x62, 0x0a, 0x13, 0x72, 0x75,
|
||||||
|
0x6e, 0x5f, 0x66, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69,
|
||||||
|
0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x61, 0x70, 0x69, 0x65, 0x78, 0x74,
|
||||||
|
0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
|
||||||
|
0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x75, 0x6e, 0x46, 0x75, 0x6e,
|
||||||
|
0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x11, 0x72, 0x75, 0x6e,
|
||||||
|
0x46, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x2d,
|
||||||
|
0x0a, 0x13, 0x52, 0x75, 0x6e, 0x46, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
|
||||||
|
0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18,
|
||||||
|
0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x2a, 0x95, 0x01,
|
||||||
|
0x0a, 0x0f, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x50, 0x6f, 0x6c, 0x69, 0x63,
|
||||||
|
0x79, 0x12, 0x21, 0x0a, 0x1d, 0x49, 0x4d, 0x41, 0x47, 0x45, 0x5f, 0x50, 0x55, 0x4c, 0x4c, 0x5f,
|
||||||
|
0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
|
||||||
|
0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x49, 0x4d, 0x41, 0x47, 0x45, 0x5f, 0x50, 0x55,
|
||||||
|
0x4c, 0x4c, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f, 0x49, 0x46, 0x5f, 0x4e, 0x4f, 0x54,
|
||||||
|
0x5f, 0x50, 0x52, 0x45, 0x53, 0x45, 0x4e, 0x54, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x49, 0x4d,
|
||||||
|
0x41, 0x47, 0x45, 0x5f, 0x50, 0x55, 0x4c, 0x4c, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f,
|
||||||
|
0x41, 0x4c, 0x57, 0x41, 0x59, 0x53, 0x10, 0x02, 0x12, 0x1b, 0x0a, 0x17, 0x49, 0x4d, 0x41, 0x47,
|
||||||
|
0x45, 0x5f, 0x50, 0x55, 0x4c, 0x4c, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f, 0x4e, 0x45,
|
||||||
|
0x56, 0x45, 0x52, 0x10, 0x03, 0x2a, 0x67, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
|
||||||
|
0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x1e, 0x0a, 0x1a, 0x4e, 0x45, 0x54, 0x57, 0x4f, 0x52,
|
||||||
|
0x4b, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
|
||||||
|
0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1b, 0x0a, 0x17, 0x4e, 0x45, 0x54, 0x57, 0x4f, 0x52,
|
||||||
|
0x4b, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f, 0x49, 0x53, 0x4f, 0x4c, 0x41, 0x54, 0x45,
|
||||||
|
0x44, 0x10, 0x01, 0x12, 0x19, 0x0a, 0x15, 0x4e, 0x45, 0x54, 0x57, 0x4f, 0x52, 0x4b, 0x5f, 0x50,
|
||||||
|
0x4f, 0x4c, 0x49, 0x43, 0x59, 0x5f, 0x52, 0x55, 0x4e, 0x4e, 0x45, 0x52, 0x10, 0x02, 0x32, 0xa0,
|
||||||
|
0x01, 0x0a, 0x22, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x69, 0x7a, 0x65, 0x64,
|
||||||
|
0x46, 0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x53, 0x65,
|
||||||
|
0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x7a, 0x0a, 0x0b, 0x52, 0x75, 0x6e, 0x46, 0x75, 0x6e, 0x63,
|
||||||
|
0x74, 0x69, 0x6f, 0x6e, 0x12, 0x33, 0x2e, 0x61, 0x70, 0x69, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73,
|
||||||
|
0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x31,
|
||||||
|
0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x75, 0x6e, 0x46, 0x75, 0x6e, 0x63, 0x74, 0x69,
|
||||||
|
0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x34, 0x2e, 0x61, 0x70, 0x69, 0x65,
|
||||||
|
0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x6e, 0x2e, 0x70, 0x72, 0x6f,
|
||||||
|
0x74, 0x6f, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x75, 0x6e, 0x46,
|
||||||
|
0x75, 0x6e, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
|
||||||
|
0x00, 0x42, 0x44, 0x5a, 0x42, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
|
||||||
|
0x63, 0x72, 0x6f, 0x73, 0x73, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x66, 0x75, 0x6e, 0x63, 0x74,
|
||||||
|
0x69, 0x6f, 0x6e, 0x2d, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2d, 0x6f, 0x63, 0x69, 0x2f,
|
||||||
|
0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x76,
|
||||||
|
0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
|
||||||
|
}
|
||||||
|
|
||||||
|
var (
|
||||||
|
file_v1alpha1_run_function_proto_rawDescOnce sync.Once
|
||||||
|
file_v1alpha1_run_function_proto_rawDescData = file_v1alpha1_run_function_proto_rawDesc
|
||||||
|
)
|
||||||
|
|
||||||
|
func file_v1alpha1_run_function_proto_rawDescGZIP() []byte {
|
||||||
|
file_v1alpha1_run_function_proto_rawDescOnce.Do(func() {
|
||||||
|
file_v1alpha1_run_function_proto_rawDescData = protoimpl.X.CompressGZIP(file_v1alpha1_run_function_proto_rawDescData)
|
||||||
|
})
|
||||||
|
return file_v1alpha1_run_function_proto_rawDescData
|
||||||
|
}
|
||||||
|
|
||||||
|
var file_v1alpha1_run_function_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
|
||||||
|
var file_v1alpha1_run_function_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
|
||||||
|
var file_v1alpha1_run_function_proto_goTypes = []interface{}{
|
||||||
|
(ImagePullPolicy)(0), // 0: apiextensions.fn.proto.v1alpha1.ImagePullPolicy
|
||||||
|
(NetworkPolicy)(0), // 1: apiextensions.fn.proto.v1alpha1.NetworkPolicy
|
||||||
|
(*ImagePullAuth)(nil), // 2: apiextensions.fn.proto.v1alpha1.ImagePullAuth
|
||||||
|
(*ImagePullConfig)(nil), // 3: apiextensions.fn.proto.v1alpha1.ImagePullConfig
|
||||||
|
(*NetworkConfig)(nil), // 4: apiextensions.fn.proto.v1alpha1.NetworkConfig
|
||||||
|
(*ResourceConfig)(nil), // 5: apiextensions.fn.proto.v1alpha1.ResourceConfig
|
||||||
|
(*ResourceLimits)(nil), // 6: apiextensions.fn.proto.v1alpha1.ResourceLimits
|
||||||
|
(*RunFunctionConfig)(nil), // 7: apiextensions.fn.proto.v1alpha1.RunFunctionConfig
|
||||||
|
(*RunFunctionRequest)(nil), // 8: apiextensions.fn.proto.v1alpha1.RunFunctionRequest
|
||||||
|
(*RunFunctionResponse)(nil), // 9: apiextensions.fn.proto.v1alpha1.RunFunctionResponse
|
||||||
|
(*durationpb.Duration)(nil), // 10: google.protobuf.Duration
|
||||||
|
}
|
||||||
|
var file_v1alpha1_run_function_proto_depIdxs = []int32{
|
||||||
|
0, // 0: apiextensions.fn.proto.v1alpha1.ImagePullConfig.pull_policy:type_name -> apiextensions.fn.proto.v1alpha1.ImagePullPolicy
|
||||||
|
2, // 1: apiextensions.fn.proto.v1alpha1.ImagePullConfig.auth:type_name -> apiextensions.fn.proto.v1alpha1.ImagePullAuth
|
||||||
|
1, // 2: apiextensions.fn.proto.v1alpha1.NetworkConfig.policy:type_name -> apiextensions.fn.proto.v1alpha1.NetworkPolicy
|
||||||
|
6, // 3: apiextensions.fn.proto.v1alpha1.ResourceConfig.limits:type_name -> apiextensions.fn.proto.v1alpha1.ResourceLimits
|
||||||
|
5, // 4: apiextensions.fn.proto.v1alpha1.RunFunctionConfig.resources:type_name -> apiextensions.fn.proto.v1alpha1.ResourceConfig
|
||||||
|
4, // 5: apiextensions.fn.proto.v1alpha1.RunFunctionConfig.network:type_name -> apiextensions.fn.proto.v1alpha1.NetworkConfig
|
||||||
|
10, // 6: apiextensions.fn.proto.v1alpha1.RunFunctionConfig.timeout:type_name -> google.protobuf.Duration
|
||||||
|
3, // 7: apiextensions.fn.proto.v1alpha1.RunFunctionRequest.image_pull_config:type_name -> apiextensions.fn.proto.v1alpha1.ImagePullConfig
|
||||||
|
7, // 8: apiextensions.fn.proto.v1alpha1.RunFunctionRequest.run_function_config:type_name -> apiextensions.fn.proto.v1alpha1.RunFunctionConfig
|
||||||
|
8, // 9: apiextensions.fn.proto.v1alpha1.ContainerizedFunctionRunnerService.RunFunction:input_type -> apiextensions.fn.proto.v1alpha1.RunFunctionRequest
|
||||||
|
9, // 10: apiextensions.fn.proto.v1alpha1.ContainerizedFunctionRunnerService.RunFunction:output_type -> apiextensions.fn.proto.v1alpha1.RunFunctionResponse
|
||||||
|
10, // [10:11] is the sub-list for method output_type
|
||||||
|
9, // [9:10] is the sub-list for method input_type
|
||||||
|
9, // [9:9] is the sub-list for extension type_name
|
||||||
|
9, // [9:9] is the sub-list for extension extendee
|
||||||
|
0, // [0:9] is the sub-list for field type_name
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() { file_v1alpha1_run_function_proto_init() }
|
||||||
|
func file_v1alpha1_run_function_proto_init() {
|
||||||
|
if File_v1alpha1_run_function_proto != nil {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if !protoimpl.UnsafeEnabled {
|
||||||
|
file_v1alpha1_run_function_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
|
||||||
|
switch v := v.(*ImagePullAuth); i {
|
||||||
|
case 0:
|
||||||
|
return &v.state
|
||||||
|
case 1:
|
||||||
|
return &v.sizeCache
|
||||||
|
case 2:
|
||||||
|
return &v.unknownFields
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
file_v1alpha1_run_function_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
|
||||||
|
switch v := v.(*ImagePullConfig); i {
|
||||||
|
case 0:
|
||||||
|
return &v.state
|
||||||
|
case 1:
|
||||||
|
return &v.sizeCache
|
||||||
|
case 2:
|
||||||
|
return &v.unknownFields
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
file_v1alpha1_run_function_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
|
||||||
|
switch v := v.(*NetworkConfig); i {
|
||||||
|
case 0:
|
||||||
|
return &v.state
|
||||||
|
case 1:
|
||||||
|
return &v.sizeCache
|
||||||
|
case 2:
|
||||||
|
return &v.unknownFields
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
file_v1alpha1_run_function_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
|
||||||
|
switch v := v.(*ResourceConfig); i {
|
||||||
|
case 0:
|
||||||
|
return &v.state
|
||||||
|
case 1:
|
||||||
|
return &v.sizeCache
|
||||||
|
case 2:
|
||||||
|
return &v.unknownFields
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
file_v1alpha1_run_function_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
|
||||||
|
switch v := v.(*ResourceLimits); i {
|
||||||
|
case 0:
|
||||||
|
return &v.state
|
||||||
|
case 1:
|
||||||
|
return &v.sizeCache
|
||||||
|
case 2:
|
||||||
|
return &v.unknownFields
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
file_v1alpha1_run_function_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
|
||||||
|
switch v := v.(*RunFunctionConfig); i {
|
||||||
|
case 0:
|
||||||
|
return &v.state
|
||||||
|
case 1:
|
||||||
|
return &v.sizeCache
|
||||||
|
case 2:
|
||||||
|
return &v.unknownFields
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
file_v1alpha1_run_function_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
|
||||||
|
switch v := v.(*RunFunctionRequest); i {
|
||||||
|
case 0:
|
||||||
|
return &v.state
|
||||||
|
case 1:
|
||||||
|
return &v.sizeCache
|
||||||
|
case 2:
|
||||||
|
return &v.unknownFields
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
file_v1alpha1_run_function_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
|
||||||
|
switch v := v.(*RunFunctionResponse); i {
|
||||||
|
case 0:
|
||||||
|
return &v.state
|
||||||
|
case 1:
|
||||||
|
return &v.sizeCache
|
||||||
|
case 2:
|
||||||
|
return &v.unknownFields
|
||||||
|
default:
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
type x struct{}
|
||||||
|
out := protoimpl.TypeBuilder{
|
||||||
|
File: protoimpl.DescBuilder{
|
||||||
|
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
|
||||||
|
RawDescriptor: file_v1alpha1_run_function_proto_rawDesc,
|
||||||
|
NumEnums: 2,
|
||||||
|
NumMessages: 8,
|
||||||
|
NumExtensions: 0,
|
||||||
|
NumServices: 1,
|
||||||
|
},
|
||||||
|
GoTypes: file_v1alpha1_run_function_proto_goTypes,
|
||||||
|
DependencyIndexes: file_v1alpha1_run_function_proto_depIdxs,
|
||||||
|
EnumInfos: file_v1alpha1_run_function_proto_enumTypes,
|
||||||
|
MessageInfos: file_v1alpha1_run_function_proto_msgTypes,
|
||||||
|
}.Build()
|
||||||
|
File_v1alpha1_run_function_proto = out.File
|
||||||
|
file_v1alpha1_run_function_proto_rawDesc = nil
|
||||||
|
file_v1alpha1_run_function_proto_goTypes = nil
|
||||||
|
file_v1alpha1_run_function_proto_depIdxs = nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,129 @@
|
||||||
|
/*
|
||||||
|
Copyright 2022 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// TODO(negz): Add a make target such that `make lint` runs `buf lint`.
|
||||||
|
|
||||||
|
syntax = "proto3";
|
||||||
|
|
||||||
|
import "google/protobuf/duration.proto";
|
||||||
|
|
||||||
|
package apiextensions.fn.proto.v1alpha1;
|
||||||
|
|
||||||
|
option go_package = "github.com/crossplane/function-runtime-oci/internal/proto/v1alpha1";
|
||||||
|
|
||||||
|
// A ContainerizedFunctionRunnerService runs containerized Composition Functions.
|
||||||
|
service ContainerizedFunctionRunnerService {
|
||||||
|
// RunFunction runs a containerized function.
|
||||||
|
rpc RunFunction(RunFunctionRequest) returns (RunFunctionResponse) {}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ImagePullPolicy specifies when a Composition Function container should be
|
||||||
|
// pulled from a remote OCI registry.
|
||||||
|
enum ImagePullPolicy {
|
||||||
|
IMAGE_PULL_POLICY_UNSPECIFIED = 0;
|
||||||
|
IMAGE_PULL_POLICY_IF_NOT_PRESENT = 1;
|
||||||
|
IMAGE_PULL_POLICY_ALWAYS = 2;
|
||||||
|
IMAGE_PULL_POLICY_NEVER = 3;
|
||||||
|
}
|
||||||
|
|
||||||
|
// ImagePullAuth configures authentication to a remote OCI registry.
|
||||||
|
// It corresponds to go-containerregistry's AuthConfig type.
|
||||||
|
// https://pkg.go.dev/github.com/google/go-containerregistry@v0.11.0/pkg/authn#AuthConfig
|
||||||
|
message ImagePullAuth {
|
||||||
|
string username = 1;
|
||||||
|
string password = 2;
|
||||||
|
string auth = 3;
|
||||||
|
string identity_token = 4;
|
||||||
|
string registry_token = 5;
|
||||||
|
}
|
||||||
|
|
||||||
|
// ImagePullConfig configures how a Composition Function container should be
|
||||||
|
// pulled from a remote OCI registry.
|
||||||
|
message ImagePullConfig {
|
||||||
|
ImagePullPolicy pull_policy = 1;
|
||||||
|
ImagePullAuth auth = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
// NetworkPolicy configures whether a container is isolated from the network.
|
||||||
|
enum NetworkPolicy {
|
||||||
|
NETWORK_POLICY_UNSPECIFIED = 0;
|
||||||
|
|
||||||
|
// Run the container without network access. The default.
|
||||||
|
NETWORK_POLICY_ISOLATED = 1;
|
||||||
|
|
||||||
|
// Allow the container to access the same network as the function runner.
|
||||||
|
NETWORK_POLICY_RUNNER = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
// NetworkConfig configures whether and how a Composition Function container may
|
||||||
|
// access the network.
|
||||||
|
message NetworkConfig {
|
||||||
|
// Whether or not the container can access the network.
|
||||||
|
NetworkPolicy policy = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Resources configures what compute resources should be available to a
|
||||||
|
// Composition Function container.
|
||||||
|
message ResourceConfig {
|
||||||
|
ResourceLimits limits = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
// ResourceLimits configures the maximum compute resources that will be
|
||||||
|
// available to a Composition Function container.
|
||||||
|
message ResourceLimits {
|
||||||
|
// CPU, in cores. (500m = .5 cores)
|
||||||
|
// Specified in Kubernetes-style resource.Quantity form.
|
||||||
|
string memory = 1;
|
||||||
|
|
||||||
|
// Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
|
||||||
|
// Specified in Kubernetes-style resource.Quantity form.
|
||||||
|
string cpu = 2;
|
||||||
|
}
|
||||||
|
|
||||||
|
// RunFunctionConfig configures how a Composition Function container is run.
|
||||||
|
message RunFunctionConfig {
|
||||||
|
// Resources available to the container.
|
||||||
|
ResourceConfig resources = 1;
|
||||||
|
|
||||||
|
// Network configuration for the container.
|
||||||
|
NetworkConfig network = 2;
|
||||||
|
|
||||||
|
// Timeout after which the container will be killed.
|
||||||
|
google.protobuf.Duration timeout = 3;
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RunFunctionRequest requests that a Composition Function be run.
|
||||||
|
message RunFunctionRequest {
|
||||||
|
// OCI image of the Composition Function.
|
||||||
|
string image = 1;
|
||||||
|
|
||||||
|
// A FunctionIO serialized as YAML.
|
||||||
|
bytes input = 2;
|
||||||
|
|
||||||
|
// Configures how the function image is pulled.
|
||||||
|
ImagePullConfig image_pull_config = 3;
|
||||||
|
|
||||||
|
// Configures how the function container is run.
|
||||||
|
RunFunctionConfig run_function_config = 4;
|
||||||
|
}
|
||||||
|
|
||||||
|
// A RunFunctionResponse contains the response from a Composition Function run.
|
||||||
|
// The output FunctionIO is returned as opaque bytes. Errors encountered while
|
||||||
|
// running a function (as opposed to errors returned _by_ a function) will be
|
||||||
|
// encapsulated as gRPC errors.
|
||||||
|
message RunFunctionResponse {
|
||||||
|
bytes output = 1;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,129 @@
|
||||||
|
//
|
||||||
|
//Copyright 2022 The Crossplane Authors.
|
||||||
|
//
|
||||||
|
//Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
//you may not use this file except in compliance with the License.
|
||||||
|
//You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
//http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
//Unless required by applicable law or agreed to in writing, software
|
||||||
|
//distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
//See the License for the specific language governing permissions and
|
||||||
|
//limitations under the License.
|
||||||
|
|
||||||
|
// TODO(negz): Add a make target such that `make lint` runs `buf lint`.
|
||||||
|
|
||||||
|
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
|
||||||
|
// versions:
|
||||||
|
// - protoc-gen-go-grpc v1.3.0
|
||||||
|
// - protoc (unknown)
|
||||||
|
// source: v1alpha1/run_function.proto
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
context "context"
|
||||||
|
grpc "google.golang.org/grpc"
|
||||||
|
codes "google.golang.org/grpc/codes"
|
||||||
|
status "google.golang.org/grpc/status"
|
||||||
|
)
|
||||||
|
|
||||||
|
// This is a compile-time assertion to ensure that this generated file
|
||||||
|
// is compatible with the grpc package it is being compiled against.
|
||||||
|
// Requires gRPC-Go v1.32.0 or later.
|
||||||
|
const _ = grpc.SupportPackageIsVersion7
|
||||||
|
|
||||||
|
const (
|
||||||
|
ContainerizedFunctionRunnerService_RunFunction_FullMethodName = "/apiextensions.fn.proto.v1alpha1.ContainerizedFunctionRunnerService/RunFunction"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ContainerizedFunctionRunnerServiceClient is the client API for ContainerizedFunctionRunnerService service.
|
||||||
|
//
|
||||||
|
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
|
||||||
|
type ContainerizedFunctionRunnerServiceClient interface {
|
||||||
|
// RunFunction runs a containerized function.
|
||||||
|
RunFunction(ctx context.Context, in *RunFunctionRequest, opts ...grpc.CallOption) (*RunFunctionResponse, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
type containerizedFunctionRunnerServiceClient struct {
|
||||||
|
cc grpc.ClientConnInterface
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewContainerizedFunctionRunnerServiceClient(cc grpc.ClientConnInterface) ContainerizedFunctionRunnerServiceClient {
|
||||||
|
return &containerizedFunctionRunnerServiceClient{cc}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *containerizedFunctionRunnerServiceClient) RunFunction(ctx context.Context, in *RunFunctionRequest, opts ...grpc.CallOption) (*RunFunctionResponse, error) {
|
||||||
|
out := new(RunFunctionResponse)
|
||||||
|
err := c.cc.Invoke(ctx, ContainerizedFunctionRunnerService_RunFunction_FullMethodName, in, out, opts...)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return out, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ContainerizedFunctionRunnerServiceServer is the server API for ContainerizedFunctionRunnerService service.
|
||||||
|
// All implementations must embed UnimplementedContainerizedFunctionRunnerServiceServer
|
||||||
|
// for forward compatibility
|
||||||
|
type ContainerizedFunctionRunnerServiceServer interface {
|
||||||
|
// RunFunction runs a containerized function.
|
||||||
|
RunFunction(context.Context, *RunFunctionRequest) (*RunFunctionResponse, error)
|
||||||
|
mustEmbedUnimplementedContainerizedFunctionRunnerServiceServer()
|
||||||
|
}
|
||||||
|
|
||||||
|
// UnimplementedContainerizedFunctionRunnerServiceServer must be embedded to have forward compatible implementations.
|
||||||
|
type UnimplementedContainerizedFunctionRunnerServiceServer struct {
|
||||||
|
}
|
||||||
|
|
||||||
|
func (UnimplementedContainerizedFunctionRunnerServiceServer) RunFunction(context.Context, *RunFunctionRequest) (*RunFunctionResponse, error) {
|
||||||
|
return nil, status.Errorf(codes.Unimplemented, "method RunFunction not implemented")
|
||||||
|
}
|
||||||
|
func (UnimplementedContainerizedFunctionRunnerServiceServer) mustEmbedUnimplementedContainerizedFunctionRunnerServiceServer() {
|
||||||
|
}
|
||||||
|
|
||||||
|
// UnsafeContainerizedFunctionRunnerServiceServer may be embedded to opt out of forward compatibility for this service.
|
||||||
|
// Use of this interface is not recommended, as added methods to ContainerizedFunctionRunnerServiceServer will
|
||||||
|
// result in compilation errors.
|
||||||
|
type UnsafeContainerizedFunctionRunnerServiceServer interface {
|
||||||
|
mustEmbedUnimplementedContainerizedFunctionRunnerServiceServer()
|
||||||
|
}
|
||||||
|
|
||||||
|
func RegisterContainerizedFunctionRunnerServiceServer(s grpc.ServiceRegistrar, srv ContainerizedFunctionRunnerServiceServer) {
|
||||||
|
s.RegisterService(&ContainerizedFunctionRunnerService_ServiceDesc, srv)
|
||||||
|
}
|
||||||
|
|
||||||
|
func _ContainerizedFunctionRunnerService_RunFunction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
|
||||||
|
in := new(RunFunctionRequest)
|
||||||
|
if err := dec(in); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if interceptor == nil {
|
||||||
|
return srv.(ContainerizedFunctionRunnerServiceServer).RunFunction(ctx, in)
|
||||||
|
}
|
||||||
|
info := &grpc.UnaryServerInfo{
|
||||||
|
Server: srv,
|
||||||
|
FullMethod: ContainerizedFunctionRunnerService_RunFunction_FullMethodName,
|
||||||
|
}
|
||||||
|
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||||
|
return srv.(ContainerizedFunctionRunnerServiceServer).RunFunction(ctx, req.(*RunFunctionRequest))
|
||||||
|
}
|
||||||
|
return interceptor(ctx, in, info, handler)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ContainerizedFunctionRunnerService_ServiceDesc is the grpc.ServiceDesc for ContainerizedFunctionRunnerService service.
|
||||||
|
// It's only intended for direct use with grpc.RegisterService,
|
||||||
|
// and not to be introspected or modified (even as a copy)
|
||||||
|
var ContainerizedFunctionRunnerService_ServiceDesc = grpc.ServiceDesc{
|
||||||
|
ServiceName: "apiextensions.fn.proto.v1alpha1.ContainerizedFunctionRunnerService",
|
||||||
|
HandlerType: (*ContainerizedFunctionRunnerServiceServer)(nil),
|
||||||
|
Methods: []grpc.MethodDesc{
|
||||||
|
{
|
||||||
|
MethodName: "RunFunction",
|
||||||
|
Handler: _ContainerizedFunctionRunnerService_RunFunction_Handler,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Streams: []grpc.StreamDesc{},
|
||||||
|
Metadata: "v1alpha1/run_function.proto",
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,63 @@
|
||||||
|
/*
|
||||||
|
Copyright 2020 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package fake contains semantic version mocks.
|
||||||
|
package fake
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/Masterminds/semver"
|
||||||
|
|
||||||
|
"github.com/crossplane/function-runtime-oci/internal/version"
|
||||||
|
)
|
||||||
|
|
||||||
|
var _ version.Operations = &MockVersioner{}
|
||||||
|
|
||||||
|
// MockVersioner provides mock version operations.
|
||||||
|
type MockVersioner struct {
|
||||||
|
MockGetVersionString func() string
|
||||||
|
MockGetSemVer func() (*semver.Version, error)
|
||||||
|
MockInConstraints func() (bool, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewMockGetVersionStringFn creates new MockGetVersionString function for MockVersioner.
|
||||||
|
func NewMockGetVersionStringFn(s string) func() string {
|
||||||
|
return func() string { return s }
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewMockGetSemVerFn creates new MockGetSemver function for MockVersioner.
|
||||||
|
func NewMockGetSemVerFn(s *semver.Version, err error) func() (*semver.Version, error) {
|
||||||
|
return func() (*semver.Version, error) { return s, err }
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewMockInConstraintsFn creates new MockInConstraintsString function for MockVersioner.
|
||||||
|
func NewMockInConstraintsFn(b bool, err error) func() (bool, error) {
|
||||||
|
return func() (bool, error) { return b, err }
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetVersionString calls the underlying MockGetVersionString.
|
||||||
|
func (m *MockVersioner) GetVersionString() string {
|
||||||
|
return m.MockGetVersionString()
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetSemVer calls the underlying MockGetSemVer.
|
||||||
|
func (m *MockVersioner) GetSemVer() (*semver.Version, error) {
|
||||||
|
return m.MockGetSemVer()
|
||||||
|
}
|
||||||
|
|
||||||
|
// InConstraints calls the underlying MockInConstraints.
|
||||||
|
func (m *MockVersioner) InConstraints(_ string) (bool, error) {
|
||||||
|
return m.MockInConstraints()
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,67 @@
|
||||||
|
/*
|
||||||
|
Copyright 2020 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package version contains utilities for working with semantic versions.
|
||||||
|
package version
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/Masterminds/semver"
|
||||||
|
)
|
||||||
|
|
||||||
|
var version string
|
||||||
|
|
||||||
|
// Operations provides semantic version operations.
|
||||||
|
type Operations interface {
|
||||||
|
GetVersionString() string
|
||||||
|
GetSemVer() (*semver.Version, error)
|
||||||
|
InConstraints(c string) (bool, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Versioner provides semantic version operations.
|
||||||
|
type Versioner struct {
|
||||||
|
version string
|
||||||
|
}
|
||||||
|
|
||||||
|
// New creates a new versioner.
|
||||||
|
func New() *Versioner {
|
||||||
|
return &Versioner{
|
||||||
|
version: version,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetVersionString returns the current Crossplane version as string.
|
||||||
|
func (v *Versioner) GetVersionString() string {
|
||||||
|
return v.version
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetSemVer returns the current Crossplane version as a semantic version.
|
||||||
|
func (v *Versioner) GetSemVer() (*semver.Version, error) {
|
||||||
|
return semver.NewVersion(v.version)
|
||||||
|
}
|
||||||
|
|
||||||
|
// InConstraints is a helper function that checks if the current Crossplane
|
||||||
|
// version is in the semantic version constraints.
|
||||||
|
func (v *Versioner) InConstraints(c string) (bool, error) {
|
||||||
|
ver, err := v.GetSemVer()
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
constraint, err := semver.NewConstraint(c)
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return constraint.Check(ver), nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,96 @@
|
||||||
|
/*
|
||||||
|
Copyright 2020 The Crossplane Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package version
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/google/go-cmp/cmp"
|
||||||
|
|
||||||
|
"github.com/crossplane/crossplane-runtime/pkg/test"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestInRange(t *testing.T) {
|
||||||
|
type args struct {
|
||||||
|
version string
|
||||||
|
r string
|
||||||
|
}
|
||||||
|
type want struct {
|
||||||
|
is bool
|
||||||
|
err error
|
||||||
|
}
|
||||||
|
cases := map[string]struct {
|
||||||
|
reason string
|
||||||
|
args args
|
||||||
|
want want
|
||||||
|
}{
|
||||||
|
"ValidInRange": {
|
||||||
|
reason: "Should return true when a valid semantic version is in a valid range.",
|
||||||
|
args: args{
|
||||||
|
version: "v0.13.0",
|
||||||
|
r: ">0.12.0",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
is: true,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"ValidNotInRange": {
|
||||||
|
reason: "Should return false when a valid semantic version is not in a valid range.",
|
||||||
|
args: args{
|
||||||
|
version: "v0.13.0",
|
||||||
|
r: ">0.13.0",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
is: false,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"InvalidVersion": {
|
||||||
|
reason: "Should return error when version is invalid.",
|
||||||
|
args: args{
|
||||||
|
version: "v0a.13.0",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.New("Invalid Semantic Version"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"InvalidRange": {
|
||||||
|
reason: "Should return error when range is invalid.",
|
||||||
|
args: args{
|
||||||
|
version: "v0.13.0",
|
||||||
|
r: ">a2",
|
||||||
|
},
|
||||||
|
want: want{
|
||||||
|
err: errors.New("improper constraint: >a2"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for name, tc := range cases {
|
||||||
|
t.Run(name, func(t *testing.T) {
|
||||||
|
version = tc.args.version
|
||||||
|
is, err := New().InConstraints(tc.args.r)
|
||||||
|
if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nInRange(...): -want err, +got err:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
|
||||||
|
if diff := cmp.Diff(tc.want.is, is, test.EquateErrors()); diff != "" {
|
||||||
|
t.Errorf("\n%s\nInRange(...): -want, +got:\n%s", tc.reason, diff)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue