-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request juju#13192 from ycliuhw/fix/lp-1935953
juju#13192 This PR introduces non-dockerhub/private OCI registry support for: - controller pods; - model operators; - application operators; - charm container's base image in sidecar pods; This PR currently enabled `basic` auth and `auth token` support. The [v2 bear token](https://docs.docker.com/registry/spec/auth/token/) is still a `TODO` and will be added in the following PRs. Note: this feature is currently hidden under featureflag: `private-registry`, but it's not testable without some hack because [this bug(it will be fixed soon)](https://bugs.launchpad.net/juju/+bug/1941055). ## Checklist - [ ] ~Requires a [pylibjuju](https://github.com/juju/python-libjuju) change~ - [ ] ~Added [integration tests](https://github.com/juju/juju/tree/develop/tests) for the PR~ - [ ] ~Added or updated [doc.go](https://discourse.jujucharms.com/t/readme-in-packages/451) related to packages changed~ - [x] Comments answer the question of why design decisions were made ## QA steps ### private repo on non dockerhub ```console $ cat tttt.json { "serveraddress": "quay.io", "auth": "xxxxxx==", // "username": "a", // "password": "pwd", "repository": "quay.io/ycliuhw" } $ JUJU_DEV_FEATURE_FLAGS=private-registry juju bootstrap microk8s k1 --config "features=[private-registry]" --config caas-image-repo="'$(cat tttt.json)'" $ mkubectl get all,pv,pvc,ing -o wide -ncontroller-k1 NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES pod/modeloperator-687cb75dd8-c5p8c 1/1 Running 0 2m51s 10.1.97.208 kelvinliu-m15-ryzen <none> <none> pod/controller-0 2/2 Running 2 3m48s 10.1.97.207 kelvinliu-m15-ryzen <none> <none> NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR service/controller-service ClusterIP 10.152.183.22 <none> 17070/TCP 3m51s app.kubernetes.io/name=controller service/modeloperator ClusterIP 10.152.183.161 <none> 17071/TCP 2m51s operator.juju.is/name=modeloperator,operator.juju.is/target=model NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR deployment.apps/modeloperator 1/1 1 1 2m51s juju-operator quay.io/ycliuhw/jujud-operator:2.9.10.1 operator.juju.is/name=modeloperator,operator.juju.is/target=model NAME DESIRED CURRENT READY AGE CONTAINERS IMAGES SELECTOR replicaset.apps/modeloperator-687cb75dd8 1 1 1 2m51s juju-operator quay.io/ycliuhw/jujud-operator:2.9.10.1 operator.juju.is/name=modeloperator,operator.juju.is/target=model,pod-template-hash=687cb75dd8 NAME READY AGE CONTAINERS IMAGES statefulset.apps/controller 1/1 3m48s mongodb,api-server quay.io/ycliuhw/juju-db:4.0,quay.io/ycliuhw/jujud-operator:2.9.10.1 NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE VOLUMEMODE persistentvolume/pvc-30c9754b-9b51-4182-bb14-0ebca15a49f5 20Gi RWO Delete Bound controller-k1/storage-controller-0 microk8s-hostpath 3m48s Filesystem NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE VOLUMEMODE persistentvolumeclaim/storage-controller-0 Bound pvc-30c9754b-9b51-4182-bb14-0ebca15a49f5 20Gi RWO microk8s-hostpath 3m48s Filesystem $ juju add-model t1 $ juju deploy snappass-test $ juju deploy cs:~juju/mariadb-k8s-3 $ mkubectl -ncontroller-k1 get pod/controller-0 -o json | jq .spec.imagePullSecrets [ { "name": "juju-image-pull-secret" } ] $ mkubectl -ncontroller-k1 get secret/juju-image-pull-secret -o json | jq -r '.data[".dockerconfigjson"]' | base64 --decode | jq { "auths": { "quay.io": { "auth": "xxxxxx==", "serveraddress": "quay.io" } } } $ mkubectl -nt1 get pods snappass-test-0 mariadb-k8s-operator-0 modeloperator-56b469cd6-n8dxp -o json | jq '.items[].spec.imagePullSecrets' [ { "name": "juju-image-pull-secret" } ] [ { "name": "juju-image-pull-secret" } ] [ { "name": "juju-image-pull-secret" } ] $ mkubectl -nt1 get secret/juju-image-pull-secret -o json | jq -r '.data[".dockerconfigjson"]' | base64 --decode | jq { "auths": { "quay.io": { "auth": "xxxxxx==", "serveraddress": "quay.io" } } } $ mkubectl -nt1 get pod/snappass-test-0 -o json | jq '.spec.containers[].image' "quay.io/ycliuhw/charm-base:ubuntu-20.04" "registry.hub.docker.com/library/redis@sha256:27bea08330830c6e5efc456075d66eb1fb4b76e5518947e8c87556adf1df3e51" "registry.hub.docker.com/benhoyt/snappass-test@sha256:32506b5ac7bde75b7a76bee003cf8c77f30fc936f446c8c52d457b8fe6fce96f" $ mkubectl -nt1 get pod/mariadb-k8s-operator-0 -o json | jq '.spec.containers[].image' "quay.io/ycliuhw/jujud-operator:2.9.10" $ mkubectl -nt1 get pod/modeloperator-56b469cd6-n8dxp -o json | jq '.spec.containers[].image' "quay.io/ycliuhw/jujud-operator:2.9.10" $ mkubectl -ncontroller-k1 get pod/controller-0 -o json | jq '.spec.containers[].image' "quay.io/ycliuhw/juju-db:4.0" "quay.io/ycliuhw/jujud-operator:2.9.10" $ JUJU_DEV_FEATURE_FLAGS=private-registry juju upgrade-controller --agent-stream=develop ``` ### public repo on dockerhub ```console $ juju bootstrap microk8s k1 --config caas-image-repo=ycliuhw && juju add-model t1 $ mkubectl -ncontroller-k1 get pod/controller-0 -o json | jq .spec.imagePullSecrets null $ mkubectl -ncontroller-k1 get secret/juju-image-pull-secret Error from server (NotFound): secrets "juju-image-pull-secret" not found $ mkubectl -nt1 get pods snappass-test-0 mariadb-k8s-operator-0 modeloperator-84c9b5c68-9259k -o json | jq '.items[].spec.imagePullSecrets' null null null $ mkubectl -nt1 get secret/juju-image-pull-secret Error from server (NotFound): secrets "juju-image-pull-secret" not found $ mkubectl -nt1 get pod/snappass-test-0 -o json | jq '.spec.containers[].image' "ycliuhw/charm-base:ubuntu-20.04" "registry.hub.docker.com/library/redis@sha256:27bea08330830c6e5efc456075d66eb1fb4b76e5518947e8c87556adf1df3e51" "registry.hub.docker.com/benhoyt/snappass-test@sha256:32506b5ac7bde75b7a76bee003cf8c77f30fc936f446c8c52d457b8fe6fce96f" $ mkubectl -nt1 get pod/mariadb-k8s-operator-0 -o json | jq '.spec.containers[].image' "ycliuhw/jujud-operator:2.9.10" $ mkubectl -nt1 get pod/modeloperator-56b469cd6-n8dxp -o json | jq '.spec.containers[].image' Error from server (NotFound): pods "modeloperator-56b469cd6-n8dxp" not found $ mkubectl -nt1 get pod/modeloperator-84c9b5c68-9259k -o json | jq '.spec.containers[].image' "ycliuhw/jujud-operator:2.9.10" $ mkubectl -ncontroller-k1 get pod/controller-0 -o json | jq '.spec.containers[].image' "ycliuhw/juju-db:4.0" "ycliuhw/jujud-operator:2.9.10" ``` ## Documentation changes Yes ## Bug reference https://bugs.launchpad.net/juju/+bug/1935953 https://bugs.launchpad.net/juju/+bug/1935830
- Loading branch information
Showing
97 changed files
with
4,261 additions
and
922 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,30 @@ | ||
// Copyright 2021 Canonical Ltd. | ||
// Licensed under the AGPLv3, see LICENCE file for details. | ||
|
||
package caasmodelconfigmanager | ||
|
||
import ( | ||
"github.com/juju/errors" | ||
|
||
"github.com/juju/juju/api/base" | ||
"github.com/juju/juju/api/common" | ||
) | ||
|
||
// Client allows access to the CAAS model config manager API endpoint. | ||
type Client struct { | ||
facade base.FacadeCaller | ||
*common.ControllerConfigAPI | ||
} | ||
|
||
// NewClient returns a client used to access the CAAS Application Provisioner API. | ||
func NewClient(caller base.APICaller) (*Client, error) { | ||
_, isModel := caller.ModelTag() | ||
if !isModel { | ||
return nil, errors.New("expected model specific API connection") | ||
} | ||
facadeCaller := base.NewFacadeCaller(caller, "CAASModelConfigManager") | ||
return &Client{ | ||
facade: facadeCaller, | ||
ControllerConfigAPI: common.NewControllerConfig(facadeCaller), | ||
}, nil | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
// Copyright 2021 Canonical Ltd. | ||
// Licensed under the AGPLv3, see LICENCE file for details. | ||
|
||
package caasmodelconfigmanager_test | ||
|
||
import ( | ||
"github.com/juju/testing" | ||
jc "github.com/juju/testing/checkers" | ||
gc "gopkg.in/check.v1" | ||
|
||
basetesting "github.com/juju/juju/api/base/testing" | ||
"github.com/juju/juju/api/caasmodelconfigmanager" | ||
"github.com/juju/juju/apiserver/params" | ||
"github.com/juju/juju/controller" | ||
) | ||
|
||
type caasmodelconfigmanagerSuite struct { | ||
testing.IsolationSuite | ||
} | ||
|
||
var _ = gc.Suite(&caasmodelconfigmanagerSuite{}) | ||
|
||
func newClient(f basetesting.APICallerFunc) (*caasmodelconfigmanager.Client, error) { | ||
return caasmodelconfigmanager.NewClient(basetesting.BestVersionCaller{APICallerFunc: f, BestVersion: 1}) | ||
} | ||
|
||
func (s *caasmodelconfigmanagerSuite) TestControllerConfig(c *gc.C) { | ||
client, err := newClient(func(objType string, version int, id, request string, arg, result interface{}) error { | ||
c.Check(objType, gc.Equals, "CAASModelConfigManager") | ||
c.Check(id, gc.Equals, "") | ||
c.Check(request, gc.Equals, "ControllerConfig") | ||
c.Assert(arg, gc.IsNil) | ||
c.Assert(result, gc.FitsTypeOf, ¶ms.ControllerConfigResult{}) | ||
*(result.(*params.ControllerConfigResult)) = params.ControllerConfigResult{ | ||
Config: params.ControllerConfig{ | ||
"caas-image-repo": ` | ||
{ | ||
"serveraddress": "quay.io", | ||
"auth": "xxxxx==", | ||
"repository": "test-account" | ||
} | ||
`[1:], | ||
}, | ||
} | ||
return nil | ||
}) | ||
c.Assert(err, jc.ErrorIsNil) | ||
|
||
cfg, err := client.ControllerConfig() | ||
c.Assert(err, jc.ErrorIsNil) | ||
c.Assert(cfg, jc.DeepEquals, controller.Config{ | ||
"caas-image-repo": ` | ||
{ | ||
"serveraddress": "quay.io", | ||
"auth": "xxxxx==", | ||
"repository": "test-account" | ||
} | ||
`[1:], | ||
}) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
// Copyright 2021 Canonical Ltd. | ||
// Licensed under the AGPLv3, see LICENCE file for details. | ||
|
||
package caasmodelconfigmanager | ||
|
||
import ( | ||
"testing" | ||
|
||
gc "gopkg.in/check.v1" | ||
) | ||
|
||
func TestAll(t *testing.T) { | ||
gc.TestingT(t) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.