Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixes #22951 - support docker v2 api #7249

Merged
merged 1 commit into from
Jun 1, 2018

Conversation

thomasmckay
Copy link
Member

@thomasmckay thomasmckay commented Mar 20, 2018

This feature is not enabled unless the following is in config/settings.plugins.d/katello.yml

:katello:
   :registry:
     :url: https://devel.example.com:5000
     :ca_cert_file: /etc/pki/katello/certs/katello-default-ca.crt

To test, create a docker repository. The source url and upstream name can be garbage values since this is just a placeholder repo to push new images to. In my example I made a repo with label "builds" in org with label "examplecorp". Some commands I ran during devel are below.

To test permission scoping, users must have personal access token permissions (view_personal_access_tokens, create_personal_access_tokens, revoke_personal_access_tokens). Limiting the user to a specific lifecycle environment will also reduce their scope of search and pulling images.


sudo yum install -y skopeo

# Copy an image from remote registry to foreman
skopeo copy --dest-creds admin:changeme docker://registry-1.docker.io/alpine:latest docker://devel.example.com/examplecorp-builds-alpine:latest

# Get image info
skopeo inspect --creds admin:changeme docker://devel.example.com/examplecorp-builds-alpine

# Copy image from foreman to local docker daemon
sudo skopeo copy --src-creds admin:changeme docker://devel.example.com/examplecorp-builds-alpine:latest docker-daemon:pulled-alpine:latest

# Copy image from foreman to foreman
sudo skopeo copy --src-creds admin:changeme --dest-creds admin:changeme docker://devel.example.com/examplecorp-builds-alpine:latest docker://devel.example.com/examplecorp-builds-alpine:pushed

# Docker commands
docker login -u admin -p changeme devel.example.com
docker search devel.example.com/builds

@theforeman-bot
Copy link

There were the following issues with the commit message:

  • 3755459 must be in the format fixes #redmine_number - brief description

If you don't have a ticket number, please create an issue in Redmine.

More guidelines are available in Coding Standards or on the Foreman wiki.


This message was auto-generated by Foreman's prprocessor

@thomasmckay thomasmckay changed the title fixes #____ - support docker v2 api [WIP] fixes #____ - support docker v2 api Mar 20, 2018
@repository, [upload_id], :unit_type_id => unit_type_id,
:unit_keys => unit_keys,
:generate_metadata => true, :sync_capsule => true)
rescue

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid rescuing without specifying an error class.

:generate_metadata => true, :sync_capsule => true)
digest = task.output['upload_results'][0]['digest']
end
rescue

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid rescuing without specifying an error class.

render json: r
end

def push_manifest

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assignment Branch Condition size for push_manifest is too high. [78.01/63]
Method has too many lines. [84/30]

@thomasmckay thomasmckay changed the title [WIP] fixes #____ - support docker v2 api [WIP] fixes #22951 - support docker v2 api Mar 20, 2018
@Katello Katello deleted a comment from theforeman-bot Mar 20, 2018
@Katello Katello deleted a comment from theforeman-bot Mar 20, 2018
end

describe "docker push" do

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extra empty line detected at block body beginning.

generate_metadata: true, sync_capsule: true})
.returns(stub('task', {
:output => {'upload_results' => [{ 'digest' => 'sha256:1234' }]}
}))

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indent the right brace the same as the first position after the preceding left parenthesis.

unit_keys: unit_keys,
generate_metadata: true, sync_capsule: true})
.returns(stub('task', {
:output => {'upload_results' => [{ 'digest' => 'sha256:1234' }]}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use 2 spaces for indentation in a hash, relative to the first position after the preceding left parenthesis.

nil, [123], {unit_type_id: 'docker_manifest',
unit_keys: unit_keys,
generate_metadata: true, sync_capsule: true})
.returns(stub('task', {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant curly braces around a hash parameter.

.with(::Actions::Katello::Repository::ImportUpload,
nil, [123], {unit_type_id: 'docker_manifest',
unit_keys: unit_keys,
generate_metadata: true, sync_capsule: true})

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Align the elements of a hash literal if they span more than one line.

@controller.expects(:sync_task)
.with(::Actions::Katello::Repository::ImportUpload,
nil, [123], {unit_type_id: 'docker_manifest',
unit_keys: unit_keys,

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Align the elements of a hash literal if they span more than one line.

# }]
unit_keys = [{
name: "/home/vagrant/code/foreman/tmp/registry_upload/repository_tag.tar",
size: 10240,

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use underscores(_) as decimal mark and separate every 3 digits with them.

# checksum: Digest::SHA256.hexdigest(content)
# }]
unit_keys = [{
name: "/home/vagrant/code/foreman/tmp/registry_upload/repository_tag.tar",

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use 2 spaces for indentation in a hash, relative to the start of the line where the left curly brace is.

result: true,
count: 1
}])
unit_keys = ['repository']

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Useless assignment to variable - unit_keys.

name: :create_upload_request,
result: { 'upload_id' => 123 },
count: 2
}, {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indent the right brace the same as the first position after the preceding left parenthesis.

it "push manifest - success" do
@repository = katello_repositories(:busybox)
mock_pulp_server([{
name: :create_upload_request,

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use 2 spaces for indentation in a hash, relative to the first position after the preceding left parenthesis.

@thomasmckay thomasmckay force-pushed the registry branch 2 times, most recently from 015160a to 76a2449 Compare March 23, 2018 13:08
file.write manifest
end
manifest = JSON.parse(manifest)
rescue

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid rescuing without specifying an error class.

@thomasmckay
Copy link
Member Author

thomasmckay commented Mar 23, 2018

@parthaa @jlsherrill @JacobCallahan - Let the reviews begin!

I added a check to see if the registry is config in katello.yml so all the registry routes return 404 if missing. I think there will be enough cases of upload format causing errors that it should be opt-in (aka tech preview) in first pass. Even perhaps in foreman-1.18.

Simultaneous uploads are determined by checking for the presence of manifest.json file. I am cleaning up the blob tar files until I can confirm tmp dir will get cleaned out.

All the routes require create_personal_access_tokens permissions. Further checks (readable repo, etc.) happen once the user has passed that for the route.

I'll continue to write tests.

@thomasmckay thomasmckay changed the title [WIP] fixes #22951 - support docker v2 api fixes #22951 - support docker v2 api Apr 5, 2018
@theforeman-bot
Copy link

There were the following issues with the commit message:

  • e10b450 must be in the format fixes #redmine_number - brief description

If you don't have a ticket number, please create an issue in Redmine.

More guidelines are available in Coding Standards or on the Foreman wiki.


This message was auto-generated by Foreman's prprocessor

render json: r
end

#rubocop:disable Metrics/AbcSize

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lint/UnneededCopDisableDirective: Unnecessary disabling of Metrics/AbcSize.

@thomasmckay
Copy link
Member Author

@parthaa @jlsherrill @JacobCallahan - This is ready for testing and code review. The docker push functionality will continue to be a find-and-fix effort but it's time to get more users involved in the "find" part of that. There is an upcoming pulp feature that will greatly simplify the push logic https://pulp.plan.io/issues/3497 .

If you find issues with push let me know tooling version (either docker or skopeo) as well as the image used so I can repro and work on. Let's not hold up the PR for failed pushes, though.

@thomasmckay
Copy link
Member Author

thomasmckay commented May 21, 2018

test fix incoming

@thomasmckay
Copy link
Member Author

@parthaa @jlsherrill - ack?

@parthaa
Copy link
Contributor

parthaa commented Jun 1, 2018

@thomasmckay few things worked well and few didnt.

The following worked great

$ docker login -u admin -p changeme  alpha.partello.example.com```
Login Succeeded

$ skopeo copy --dest-creds admin:changeme docker://docker.io/busybox:latest docker://alpha.partello.example.com/default_organization-aaa-kd
Getting image source signatures
Copying blob sha256:07a152489297fc2bca20be96fab3527ceac5668328a30fd543a160cd689ee548
 706.20 KB / 706.20 KB [====================================================] 1s
Copying config sha256:8c811b4aec35f259572d0f79207bc0678df4c736eeec50bc9fec37ed936a472a
 1.46 KB / 1.46 KB [========================================================] 1s
Writing manifest to image destination
Storing signatures

$ hammer repository info --id=6
ID:                        6
Name:                      kd
Label:                     kd
Organization:              Default Organization
.....
Published At:              alpha.partello.example.com:5000/default_organization-aaa-kd
Relative Path:             default_organization-aaa-kd
Container Repository Name: default_organization-aaa-kd
Product:                   
    ID:   1
......
Content Counts:            
    Container Image Manifest Lists: 0
    Container Image Manifests:      1
    Container Image Tags:           1

$ docker search alpha.partello.example.com/default_organization-aaa-kd
INDEX         NAME                                                     DESCRIPTION   STARS     OFFICIAL   AUTOMATED
example.com   alpha.partello.example.com/default_organization-aaa-kd                 0                    

What did not work well for me

$ docker pull alpha.partello.example.com/default_organization-aaa-kd
Using default tag: latest
Trying to pull repository alpha.partello.example.com/default_organization-aaa-kd ... 
error parsing HTTP 404 response body: no error details found in HTTP response body: "{\"message\":\"sha256:b0528a860667c51e50a835570d6e30a7eac3443cd8b209b2f024abf5e6020e43\"}"

$ docker login -u admin -p changeme  alpha.partello.example.com
Login Succeeded

$ docker tag docker.io/busybox alpha.partello.example.com/default_organization-aaa-kd
$ docker push alpha.partello.example.com/default_organization-aaa-kd
The push refers to a repository [alpha.partello.example.com/default_organization-aaa-kd]
432b65032b94: Pushing [==================================================>]  1.36 MB

just waits for ever.....

Were the pull and push expected to work? I am ok acking this if you can create issues for push and pull specifically.

One last suggestion. Can you remove the use of pulp_docker_registry_port

"https://#{pulp_uri.host.downcase}:#{Setting['pulp_docker_registry_port']}"
and
"#{pulp_uri.host.downcase}:#{Setting['pulp_docker_registry_port']}/#{container_repository_name}"

I am guessing if docker pull direct will work, there is no need for the port.
Optionally you can add this to the above "pull" issue you might create.

Nice work!.

@thomasmckay
Copy link
Member Author

@parthaa - Thanks!
I'll open issues with reproducer steps for the things you've found.
I will take a look at the pulp_docker_registry_port. I updated an existing issue http://projects.theforeman.org/issues/17113

@parthaa
Copy link
Contributor

parthaa commented Jun 1, 2018

ack

@thomasmckay thomasmckay merged commit 989648b into Katello:master Jun 1, 2018
@thomasmckay thomasmckay deleted the registry branch June 1, 2018 14:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants