github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #5135 from AkihiroSuda/default-config-crypt

Browse Source 
add imgcrypt stream processors to the default config
This commit is contained in:
Fu, Wei 2021-03-25 14:31:38 +08:00 committed by GitHub
commit 80fa9fe32a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
13 changed files with 88 additions and 59 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
cmd/containerd/command/config.go
View File

@ -20,11 +20,15 @@ import (
gocontext "context"
"io"
"os"
"path/filepath"
"github.com/BurntSushi/toml"
"github.com/containerd/containerd/defaults"
"github.com/containerd/containerd/images"
"github.com/containerd/containerd/pkg/timeout"
"github.com/containerd/containerd/services/server"
srvconfig "github.com/containerd/containerd/services/server/config"
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
"github.com/urfave/cli"
)
@ -113,3 +117,49 @@ var configCommand = cli.Command{
},
},
}
func platformAgnosticDefaultConfig() *srvconfig.Config {
return &srvconfig.Config{
Version: 1,
Root: defaults.DefaultRootDir,
State: defaults.DefaultStateDir,
GRPC: srvconfig.GRPCConfig{
Address: defaults.DefaultAddress,
MaxRecvMsgSize: defaults.DefaultMaxRecvMsgSize,
MaxSendMsgSize: defaults.DefaultMaxSendMsgSize,
},
DisabledPlugins: []string{},
RequiredPlugins: []string{},
StreamProcessors: streamProcessors(),
}
}
func streamProcessors() map[string]srvconfig.StreamProcessor {
const (
ctdDecoder = "ctd-decoder"
basename = "io.containerd.ocicrypt.decoder.v1"
)
decryptionKeysPath := filepath.Join(defaults.DefaultConfigDir, "ocicrypt", "keys")
ctdDecoderArgs := []string{
"--decryption-keys-path", decryptionKeysPath,
}
ctdDecoderEnv := []string{
"OCICRYPT_KEYPROVIDER_CONFIG=" + filepath.Join(defaults.DefaultConfigDir, "ocicrypt", "ocicrypt_keyprovider.conf"),
}
return map[string]srvconfig.StreamProcessor{
basename + ".tar.gzip": {
Accepts: []string{images.MediaTypeImageLayerGzipEncrypted},
Returns: ocispec.MediaTypeImageLayerGzip,
Path: ctdDecoder,
Args: ctdDecoderArgs,
Env: ctdDecoderEnv,
},
basename + ".tar": {
Accepts: []string{images.MediaTypeImageLayerEncrypted},
Returns: ocispec.MediaTypeImageLayer,
Path: ctdDecoder,
Args: ctdDecoderArgs,
Env: ctdDecoderEnv,
},
}
}

14
cmd/containerd/command/config_linux.go
View File

@ -17,21 +17,9 @@
package command
import (
"github.com/containerd/containerd/defaults"
srvconfig "github.com/containerd/containerd/services/server/config"
)
func defaultConfig() *srvconfig.Config {
return &srvconfig.Config{
Version: 1,
Root: defaults.DefaultRootDir,
State: defaults.DefaultStateDir,
GRPC: srvconfig.GRPCConfig{
Address: defaults.DefaultAddress,
MaxRecvMsgSize: defaults.DefaultMaxRecvMsgSize,
MaxSendMsgSize: defaults.DefaultMaxSendMsgSize,
},
DisabledPlugins: []string{},
RequiredPlugins: []string{},
}
return platformAgnosticDefaultConfig()
}

18
cmd/containerd/command/config_unsupported.go
View File

@ -24,18 +24,10 @@ import (
)
func defaultConfig() *srvconfig.Config {
return &srvconfig.Config{
Version: 1,
Root: defaults.DefaultRootDir,
State: defaults.DefaultStateDir,
GRPC: srvconfig.GRPCConfig{
Address: defaults.DefaultAddress,
},
Debug: srvconfig.Debug{
Level: "info",
Address: defaults.DefaultDebugAddress,
},
DisabledPlugins: []string{},
RequiredPlugins: []string{},
cfg := platformAgnosticDefaultConfig()
cfg.Debug = srvconfig.Debug{
Level: "info",
Address: defaults.DefaultDebugAddress,
}
return cfg
}

14
cmd/containerd/command/config_windows.go
View File

@ -17,21 +17,9 @@
package command
import (
"github.com/containerd/containerd/defaults"
srvconfig "github.com/containerd/containerd/services/server/config"
)
func defaultConfig() *srvconfig.Config {
return &srvconfig.Config{
Version: 1,
Root: defaults.DefaultRootDir,
State: defaults.DefaultStateDir,
GRPC: srvconfig.GRPCConfig{
Address: defaults.DefaultAddress,
MaxRecvMsgSize: defaults.DefaultMaxRecvMsgSize,
MaxSendMsgSize: defaults.DefaultMaxSendMsgSize,
},
DisabledPlugins: []string{},
RequiredPlugins: []string{},
}
return platformAgnosticDefaultConfig()
}

3
cmd/containerd/command/main.go
View File

@ -27,6 +27,7 @@ import (
"runtime"
"time"
"github.com/containerd/containerd/defaults"
"github.com/containerd/containerd/errdefs"
"github.com/containerd/containerd/log"
"github.com/containerd/containerd/mount"
@ -80,7 +81,7 @@ can be used and modified as necessary as a custom configuration.`
cli.StringFlag{
Name: "config,c",
Usage: "path to the configuration file",
Value: defaultConfigPath,
Value: filepath.Join(defaults.DefaultConfigDir, "config.toml"),
},
cli.StringFlag{
Name: "log-level,l",

2
cmd/containerd/command/main_unix.go
View File

@ -27,8 +27,6 @@ import (
"golang.org/x/sys/unix"
)
const defaultConfigPath = "/etc/containerd/config.toml"
var handledSignals = []os.Signal{
unix.SIGTERM,
unix.SIGINT,

4
cmd/containerd/command/main_windows.go
View File

@ -20,7 +20,6 @@ import (
"context"
"fmt"
"os"
"path/filepath"
"unsafe"
"github.com/Microsoft/go-winio/pkg/etw"
@ -33,8 +32,7 @@ import (
)
var (
defaultConfigPath = filepath.Join(os.Getenv("programfiles"), "containerd", "config.toml")
handledSignals = []os.Signal{
handledSignals = []os.Signal{
windows.SIGTERM,
windows.SIGINT,
}

2
defaults/defaults_unix.go
View File

@ -34,4 +34,6 @@ const (
DefaultFIFODir = "/run/containerd/fifo"
// DefaultRuntime is the default linux runtime
DefaultRuntime = "io.containerd.runc.v2"
// DefaultConfigDir is the default location for config files.
DefaultConfigDir = "/etc/containerd"
)

3
defaults/defaults_windows.go
View File

@ -30,6 +30,9 @@ var (
// DefaultStateDir is the default location used by containerd to store
// transient data
DefaultStateDir = filepath.Join(os.Getenv("ProgramData"), "containerd", "state")
// DefaultConfigDir is the default location for config files.
DefaultConfigDir = filepath.Join(os.Getenv("programfiles"), "containerd")
)
const (

27
docs/cri/decryption.md
View File

@ -15,32 +15,31 @@ In this model encryption is tied to worker nodes. The usecase here revolves arou
### Configuring image decryption for "node" key model
The default configuration does not handle decrypting encrypted container images.
This is the default model since containerd v1.5.
An example for configuring the "node" key model for container image decryption:
Configure `cri` to enable decryption with "node" key model
For containerd v1.4, you need to add the following configuration to `/etc/containerd/config.toml` and restart the `containerd` service manually.
```toml
version = 2
[plugins."io.containerd.grpc.v1.cri".image_decryption]
key_model = "node"
```
Configure `containerd` daemon [`stream_processors`](https://github.com/containerd/containerd/blob/master/docs/stream_processors.md) to handle the
encrypted mediatypes.
```toml
[stream_processors]
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
returns = "application/vnd.oci.image.layer.v1.tar+gzip"
path = "/usr/local/bin/ctd-decoder"
args = ["--decryption-keys-path", "/keys"]
path = "ctd-decoder"
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
env= ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
returns = "application/vnd.oci.image.layer.v1.tar"
path = "/usr/local/bin/ctd-decoder"
args = ["--decryption-keys-path", "/keys"]
path = "ctd-decoder"
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
env= ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
```
In this example, container image decryption is set to use the "node" key model. In addition, the decryption [`stream_processors`](https://github.com/containerd/containerd/blob/master/docs/stream_processors.md) are configured as specified in [containerd/imgcrypt project](https://github.com/containerd/imgcrypt), with the additional field `--decryption-keys-path` configured to specify where decryption keys are located locally in the node.
In this example, container image decryption is set to use the "node" key model.
In addition, the decryption [`stream_processors`](https://github.com/containerd/containerd/blob/master/docs/stream_processors.md) are configured as specified in [containerd/imgcrypt project](https://github.com/containerd/imgcrypt), with the additional field `--decryption-keys-path` configured to specify where decryption keys are located locally in the node.
After modify this config, you need restart the `containerd` service.
The `$OCICRYPT_KEYPROVIDER_CONFIG` environment variable is used for [ocicrypt keyprovider protocol](https://github.com/containers/ocicrypt/blob/master/docs/keyprovider.md).

3
images/mediatypes.go
View File

@ -49,6 +49,9 @@ const (
MediaTypeContainerd1CheckpointRuntimeOptions = "application/vnd.containerd.container.checkpoint.runtime.options+proto"
// Legacy Docker schema1 manifest
MediaTypeDockerSchema1Manifest = "application/vnd.docker.distribution.manifest.v1+prettyjws"
// Encypted media types
MediaTypeImageLayerEncrypted = ocispec.MediaTypeImageLayer + "+encrypted"
MediaTypeImageLayerGzipEncrypted = ocispec.MediaTypeImageLayerGzip + "+encrypted"
)
// DiffCompression returns the compression as defined by the layer diff media

3
pkg/cri/config/config_unix.go
View File

@ -72,5 +72,8 @@ func DefaultConfig() PluginConfig {
TolerateMissingHugetlbController: true,
DisableHugetlbController: true,
IgnoreImageDefinedVolumes: false,
ImageDecryption: ImageDecryption{
KeyModel: KeyModelNode,
},
}
}

4
pkg/cri/config/config_windows.go
View File

@ -67,5 +67,9 @@ func DefaultConfig() PluginConfig {
MaxConcurrentDownloads: 3,
IgnoreImageDefinedVolumes: false,
// TODO(windows): Add platform specific config, so that most common defaults can be shared.
ImageDecryption: ImageDecryption{
KeyModel: KeyModelNode,
},
}
}