0c5d9ed0d2
This change refactors the way Kubelet's DockerPuller handles the docker config credentials to utilize a new credentialprovider library. The credentialprovider library is based on several of the files from the Kubelet's dockertools directory, but supports a new pluggable model for retrieving a .dockercfg-compatible JSON blob with credentials. With this change, the Kubelet will lazily ask for the docker config from a set of DockerConfigProvider extensions each time it needs a credential. This change provides common implementations of DockerConfigProvider for: - "Default": load .dockercfg from disk - "Caching": wraps another provider in a cache that expires after a pre-specified lifetime. GCP-only: - "google-dockercfg": reads a .dockercfg from a GCE instance's metadata - "google-dockercfg-url": reads a .dockercfg from a URL specified in a GCE instance's metadata. - "google-container-registry": reads an access token from GCE metadata into a password field.
96 lines
2.6 KiB
Go
96 lines
2.6 KiB
Go
/*
|
|
Copyright 2014 Google Inc. All rights reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package credentialprovider
|
|
|
|
import (
|
|
"os"
|
|
"reflect"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/golang/glog"
|
|
)
|
|
|
|
// DockerConfigProvider is the interface that registered extensions implement
|
|
// to materialize 'dockercfg' credentials.
|
|
type DockerConfigProvider interface {
|
|
Enabled() bool
|
|
Provide() DockerConfig
|
|
}
|
|
|
|
// A DockerConfigProvider that simply reads the .dockersfg file
|
|
type defaultDockerConfigProvider struct{}
|
|
|
|
// init registers our default provider, which simply reads the .dockercfg file.
|
|
func init() {
|
|
RegisterCredentialProvider(".dockercfg",
|
|
&CachingDockerConfigProvider{
|
|
Provider: &defaultDockerConfigProvider{},
|
|
Lifetime: 5 * time.Minute,
|
|
})
|
|
}
|
|
|
|
// CachingDockerConfigProvider implements DockerConfigProvider by composing
|
|
// with another DockerConfigProvider and caching the DockerConfig it provides
|
|
// for a pre-specified lifetime.
|
|
type CachingDockerConfigProvider struct {
|
|
Provider DockerConfigProvider
|
|
Lifetime time.Duration
|
|
|
|
// cache fields
|
|
cacheDockerConfig DockerConfig
|
|
expiration time.Time
|
|
mu sync.Mutex
|
|
}
|
|
|
|
// Enabled implements dockerConfigProvider
|
|
func (d *defaultDockerConfigProvider) Enabled() bool {
|
|
return true
|
|
}
|
|
|
|
// Provide implements dockerConfigProvider
|
|
func (d *defaultDockerConfigProvider) Provide() DockerConfig {
|
|
// Read the standard Docker credentials from .dockercfg
|
|
if cfg, err := ReadDockerConfigFile(); err == nil {
|
|
return cfg
|
|
} else if !os.IsNotExist(err) {
|
|
glog.V(1).Infof("Unable to parse Docker config file: %v", err)
|
|
}
|
|
return DockerConfig{}
|
|
}
|
|
|
|
// Enabled implements dockerConfigProvider
|
|
func (d *CachingDockerConfigProvider) Enabled() bool {
|
|
return d.Provider.Enabled()
|
|
}
|
|
|
|
// Provide implements dockerConfigProvider
|
|
func (d *CachingDockerConfigProvider) Provide() DockerConfig {
|
|
d.mu.Lock()
|
|
defer d.mu.Unlock()
|
|
|
|
// If the cache hasn't expired, return our cache
|
|
if time.Now().Before(d.expiration) {
|
|
return d.cacheDockerConfig
|
|
}
|
|
|
|
glog.Infof("Refreshing cache for provider: %v", reflect.TypeOf(d.Provider).String())
|
|
d.cacheDockerConfig = d.Provider.Provide()
|
|
d.expiration = time.Now().Add(d.Lifetime)
|
|
return d.cacheDockerConfig
|
|
}
|