github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Enable imgcrypt in cri pull

Browse Source 
Signed-off-by: Derek McGowan <derek@mcg.dev>
This commit is contained in:
Derek McGowan 2024-05-28 13:50:06 -07:00
parent 9857afda44
commit da1d9672f6
No known key found for this signature in database
GPG Key ID: F58C5D0A4405ACDB
2 changed files with 40 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
internal/cri/server/images/image_pull.go
View File

@ -32,6 +32,9 @@ import (
"sync/atomic" "sync/atomic"
"time" "time"
"github.com/containerd/errdefs"
"github.com/containerd/imgcrypt"
"github.com/containerd/imgcrypt/images/encryption"
"github.com/containerd/log" "github.com/containerd/log"
distribution "github.com/distribution/reference" distribution "github.com/distribution/reference"
imagedigest "github.com/opencontainers/go-digest" imagedigest "github.com/opencontainers/go-digest"
@ -48,7 +51,6 @@ import (
crilabels "github.com/containerd/containerd/v2/internal/cri/labels" crilabels "github.com/containerd/containerd/v2/internal/cri/labels"
snpkg "github.com/containerd/containerd/v2/pkg/snapshotters" snpkg "github.com/containerd/containerd/v2/pkg/snapshotters"
"github.com/containerd/containerd/v2/pkg/tracing" "github.com/containerd/containerd/v2/pkg/tracing"
"github.com/containerd/errdefs"
) )
// For image management: // For image management:
@ -583,15 +585,15 @@ func newTransport() *http.Transport {
// encryptedImagesPullOpts returns the necessary list of pull options required // encryptedImagesPullOpts returns the necessary list of pull options required
// for decryption of encrypted images based on the cri decryption configuration. // for decryption of encrypted images based on the cri decryption configuration.
// Temporarily removed for v2 upgrade // Temporarily removed for v2 upgrade
//func (c *CRIImageService) encryptedImagesPullOpts() []containerd.RemoteOpt { func (c *CRIImageService) encryptedImagesPullOpts() []containerd.RemoteOpt {
// if c.config.ImageDecryption.KeyModel == criconfig.KeyModelNode { if c.config.ImageDecryption.KeyModel == criconfig.KeyModelNode {
// ltdd := imgcrypt.Payload{} ltdd := imgcrypt.Payload{}
// decUnpackOpt := encryption.WithUnpackConfigApplyOpts(encryption.WithDecryptedUnpack(&ltdd)) decUnpackOpt := encryption.WithUnpackConfigApplyOpts(encryption.WithDecryptedUnpack(&ltdd))
// opt := containerd.WithUnpackOpts([]containerd.UnpackOpt{decUnpackOpt}) opt := containerd.WithUnpackOpts([]containerd.UnpackOpt{decUnpackOpt})
// return []containerd.RemoteOpt{opt} return []containerd.RemoteOpt{opt}
// } }
// return nil return nil
//} }
const ( const (
// defaultPullProgressReportInterval represents that how often the // defaultPullProgressReportInterval represents that how often the

55
internal/cri/server/images/image_pull_test.go
View File

@ -26,10 +26,11 @@ import (
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
runtime "k8s.io/cri-api/pkg/apis/runtime/v1" runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
"github.com/containerd/platforms"
"github.com/containerd/containerd/v2/internal/cri/annotations" "github.com/containerd/containerd/v2/internal/cri/annotations"
criconfig "github.com/containerd/containerd/v2/internal/cri/config" criconfig "github.com/containerd/containerd/v2/internal/cri/config"
"github.com/containerd/containerd/v2/internal/cri/labels" "github.com/containerd/containerd/v2/internal/cri/labels"
"github.com/containerd/platforms"
) )
func TestParseAuth(t *testing.T) { func TestParseAuth(t *testing.T) {
@ -350,32 +351,32 @@ func TestDefaultScheme(t *testing.T) {
} }
// Temporarily remove for v2 upgrade // Temporarily remove for v2 upgrade
//func TestEncryptedImagePullOpts(t *testing.T) { func TestEncryptedImagePullOpts(t *testing.T) {
// for _, test := range []struct { for _, test := range []struct {
// desc string desc string
// keyModel string keyModel string
// expectedOpts int expectedOpts int
// }{ }{
// { {
// desc: "node key model should return one unpack opt", desc: "node key model should return one unpack opt",
// keyModel: criconfig.KeyModelNode, keyModel: criconfig.KeyModelNode,
// expectedOpts: 1, expectedOpts: 1,
// }, },
// { {
// desc: "no key model selected should default to node key model", desc: "no key model selected should default to node key model",
// keyModel: "", keyModel: "",
// expectedOpts: 0, expectedOpts: 0,
// }, },
// } { } {
// test := test test := test
// t.Run(test.desc, func(t *testing.T) { t.Run(test.desc, func(t *testing.T) {
// c, _ := newTestCRIService() c, _ := newTestCRIService()
// c.config.ImageDecryption.KeyModel = test.keyModel c.config.ImageDecryption.KeyModel = test.keyModel
// got := len(c.encryptedImagesPullOpts()) got := len(c.encryptedImagesPullOpts())
// assert.Equal(t, test.expectedOpts, got) assert.Equal(t, test.expectedOpts, got)
// }) })
// } }
//} }
func TestSnapshotterFromPodSandboxConfig(t *testing.T) { func TestSnapshotterFromPodSandboxConfig(t *testing.T) {
defaultSnapshotter := "native" defaultSnapshotter := "native"