Verify read access while selecting best `run-image` mirror #1024

pbusko · 2023-02-28T15:52:05Z

Instead of simply picking the first run-image, the lifecycle will select the first accessible reference, if there's no match by registry.

See buildpacks/spec#357

platform/files.go

cmd/lifecycle/analyzer.go

natalieparellano

@pbusko thanks for this! I think broadly this PR accomplishes what we want. I'm requesting changes to hopefully align the code with some recently introduced constructs (the image handler) and keep platform.LifecycleInputs scoped to only the things that a platform (operator) would provide. Feel free to offer other suggestions if you think there is a better way to do it.

natalieparellano · 2023-03-20T14:41:53Z

@c0d1ngm0nk3y @pbusko apologies for the slow reply (I've been out). I'll have a look at your changes soon.

we are using CheckReadAccess "only" on the run-image and the run-image-mirrors. So shouldn't the export target have nothing to do with that?

If the export target is the daemon, then we also expect to find the run image in a daemon. We don't allow "mixing and matching" although maybe (someday) we should.

natalieparellano · 2023-03-21T16:00:25Z

platform/testhelpers/image_strategy.go

+
+type SimpleImageStrategy struct{}
+
+var _ platform.ImageStrategy = &SimpleImageStrategy{}


I'm a bit confused - why do we need this global (and why do we override it since it lives on inputs.AccessChecker)?

cmd/lifecycle/analyzer.go

platform/files.go

natalieparellano · 2023-03-21T16:05:23Z

platform/files.go

+
+type RemoteImageStrategy struct{}
+
+var _ ImageStrategy = &RemoteImageStrategy{}


Curious why we need this global

@natalieparellano Actually, it is used in the main package as well (rebaser.go, analyzer.go)

c0d1ngm0nk3y · 2023-05-02T13:47:59Z

I'll have a look at your changes soon.

@natalieparellano Did you have a chance to have a closer look? Is something still missing from your side?

natalieparellano · 2023-05-02T14:38:37Z

@c0d1ngm0nk3y - many apologies, I missed your comment from 2 weeks ago prodding me to take another look 😞 I'll take a look today

platform/resolve_analyze_inputs_test.go

natalieparellano · 2023-05-02T20:22:27Z

Looks good @c0d1ngm0nk3y! I think you need to run make lint. The code looks solid - I'm going to follow up on the spec change at Working Group on Thursday (see comment).

Signed-off-by: Pavel Busko <pavel.busko@sap.com> Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com> Co-authored-by: Johannes Dillmann <j.dillmann@sap.com> Add unit tests for run image resolution Co-authored-by: Johannes Dillmann <j.dillmann@sap.com> Co-authored-by: Philipp Stehle <philipp.stehle@sap.com> Signed-off-by: Ralf Pannemans <ralf.pannemans@sap.com> Use ImageStrategy instead of AccessChecker to ease testing Signed-off-by: Johannes Dillmann <j.dillmann@sap.com> Signed-off-by: Ralf Pannemans <ralf.pannemans@sap.com>

Co-authored-by: Johannes Dillmann <j.dillmann@sap.com> Signed-off-by: Johannes Dillmann <j.dillmann@sap.com> Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com> Signed-off-by: Ralf Pannemans <ralf.pannemans@sap.com>

c0d1ngm0nk3y

The acceptance tests failed, so we had to make another small adjustment. Can you check and approve the workflow again?

platform/resolve_inputs.go

acceptance/analyzer_test.go

c0d1ngm0nk3y

The acceptance tests failed, so we had to make another small adjustment. Can you check and approve the workflow again?

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com> Signed-off-by: Ralf Pannemans <ralf.pannemans@sap.com>

acceptance/analyzer_test.go

natalieparellano · 2023-05-09T16:29:35Z

@c0d1ngm0nk3y @pbusko apologies for the extended back and forth on this one - if you could just pull in https://github.com/buildpacks/lifecycle/pull/1024/files#r1188710899, if the tests all pass then we will merge this in.

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Ralf Pannemans <ralf.pannemans@googlemail.com>

c0d1ngm0nk3y · 2023-05-11T14:37:29Z

@natalieparellano There was a small oversight in the test, I fixed that. Sorry. The tests should be fine now.

jabrown85 · 2023-05-11T15:42:13Z

platform/resolve_inputs.go

@@ -20,6 +20,12 @@ var (
 )

 func ResolveInputs(phase LifecyclePhase, i *LifecycleInputs, logger log.Logger) error {
+	if i.UseDaemon || i.UseLayout {


Is LocalimageStrategy correct for Daemon run images in all cases?

I thought pack build <blah> --publish , for instance, would read the run image from the target registry to place the app layers onto without pulling it down.

Ah yes, but in the --publish case i.UseDaemon would be false

According to this comment

If the export target is the daemon, then we also expect to find the run image in a daemon. We don't allow "mixing and matching" although maybe (someday) we should.

But does --publish not imply that you export to a registry and not the daemon?

As long as i.UseDaemon is false I think we are good.

natalieparellano · 2023-05-11T18:05:29Z

Green! Thanks for the PR @c0d1ngm0nk3y and @pbusko!

c0d1ngm0nk3y · 2023-07-28T12:05:22Z

@natalieparellano We would really like to consume this change. Do you know what the current plans for release 0.17.0 are?

natalieparellano · 2023-07-28T14:46:14Z

@c0d1ngm0nk3y we are getting really close - at this point, we need the specs to be finalized and shipped before we can ship the lifecycle. You can track the progress here: #1165

At this point, I am hoping for a lifecycle 0.17.0-rc.4 early next week, and a lifecycle 0.17.0 late next week. I have a record of being overly optimistic, but I think that's achievable 🙏🏼 🤞🏼

natalieparellano · 2023-08-04T14:52:33Z

I am hoping for a lifecycle 0.17.0-rc.4 early next week

I missed the mark by a couple of days, but 0.17.0-rc.4 is out now. If it's possible to try it out and verify that things are still working fine that will help us get the "real" one out sooner.

pbusko requested a review from a team as a code owner February 28, 2023 15:52

pbusko force-pushed the run-image-access-check branch 2 times, most recently from 8fc3d99 to 3c002fb Compare February 28, 2023 15:55

c0d1ngm0nk3y mentioned this pull request Mar 1, 2023

Enhanced run image resolution buildpacks/spec#357

Merged

jabrown85 reviewed Mar 1, 2023

View reviewed changes

platform/files.go Show resolved Hide resolved

platform/files.go Show resolved Hide resolved

modulo11 force-pushed the run-image-access-check branch from 9c0d441 to 3dc6f0a Compare March 1, 2023 15:27

c0d1ngm0nk3y force-pushed the run-image-access-check branch from 3dc6f0a to b358a97 Compare March 1, 2023 17:10

natalieparellano reviewed Mar 3, 2023

View reviewed changes

platform/files.go Show resolved Hide resolved

natalieparellano reviewed Mar 3, 2023

View reviewed changes

cmd/lifecycle/analyzer.go Outdated Show resolved Hide resolved

natalieparellano requested changes Mar 3, 2023

View reviewed changes

natalieparellano mentioned this pull request Mar 9, 2023

WIP: make image handler an access checker #1031

Closed

c0d1ngm0nk3y force-pushed the run-image-access-check branch from b358a97 to 615f926 Compare March 10, 2023 14:48

natalieparellano reviewed Mar 21, 2023

View reviewed changes

c0d1ngm0nk3y force-pushed the run-image-access-check branch 2 times, most recently from d4cf0e6 to 8742299 Compare April 17, 2023 15:09

natalieparellano reviewed May 2, 2023

View reviewed changes

platform/resolve_analyze_inputs_test.go Outdated Show resolved Hide resolved

c0d1ngm0nk3y force-pushed the run-image-access-check branch 2 times, most recently from fac4012 to c1256b4 Compare May 3, 2023 06:32

pbusko and others added 2 commits May 8, 2023 15:44

Move determining ImageStrategy to ResolveInputs

3274cc2

Co-authored-by: Johannes Dillmann <j.dillmann@sap.com> Signed-off-by: Johannes Dillmann <j.dillmann@sap.com> Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com> Signed-off-by: Ralf Pannemans <ralf.pannemans@sap.com>

c0d1ngm0nk3y force-pushed the run-image-access-check branch from eb27966 to 8778ef5 Compare May 8, 2023 13:45

c0d1ngm0nk3y reviewed May 8, 2023

View reviewed changes

platform/resolve_inputs.go Show resolved Hide resolved

acceptance/analyzer_test.go Show resolved Hide resolved

c0d1ngm0nk3y reviewed May 8, 2023

View reviewed changes

Adapt acceptance tests for checking read access on run images

96843c8

Co-authored-by: Ralf Pannemans <ralf.pannemans@sap.com> Signed-off-by: Ralf Pannemans <ralf.pannemans@sap.com>

c0d1ngm0nk3y force-pushed the run-image-access-check branch from 8778ef5 to 96843c8 Compare May 9, 2023 06:53

natalieparellano reviewed May 9, 2023

View reviewed changes

acceptance/analyzer_test.go Outdated Show resolved Hide resolved

natalieparellano added this to the lifecycle 0.17.0 milestone May 9, 2023

Update acceptance/analyzer_test.go

c457a22

Co-authored-by: Natalie Arellano <narellano@vmware.com> Signed-off-by: Ralf Pannemans <ralf.pannemans@googlemail.com>

c0d1ngm0nk3y force-pushed the run-image-access-check branch from ab1dc96 to c457a22 Compare May 11, 2023 14:35

jabrown85 reviewed May 11, 2023

View reviewed changes

natalieparellano approved these changes May 11, 2023

View reviewed changes

natalieparellano merged commit a2dfc78 into buildpacks:main May 11, 2023
7 checks passed

pbusko deleted the run-image-access-check branch May 11, 2023 19:50

loewenstein mentioned this pull request Jun 13, 2023

RFC: Private Registry Mirrors buildpacks/rfcs#285

Open

pbusko mentioned this pull request Dec 14, 2023

Ensure read access when resolving run image location buildpacks/pack#2010

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Verify read access while selecting best `run-image` mirror #1024

Verify read access while selecting best `run-image` mirror #1024

pbusko commented Feb 28, 2023

natalieparellano left a comment

natalieparellano commented Mar 20, 2023

natalieparellano Mar 21, 2023 •

edited

natalieparellano Mar 21, 2023

c0d1ngm0nk3y Apr 17, 2023 •

edited

c0d1ngm0nk3y commented May 2, 2023

natalieparellano commented May 2, 2023

natalieparellano commented May 2, 2023

c0d1ngm0nk3y left a comment

c0d1ngm0nk3y left a comment

natalieparellano commented May 9, 2023

c0d1ngm0nk3y commented May 11, 2023

jabrown85 May 11, 2023

natalieparellano May 11, 2023

c0d1ngm0nk3y May 11, 2023

jabrown85 May 11, 2023

natalieparellano commented May 11, 2023

c0d1ngm0nk3y commented Jul 28, 2023

natalieparellano commented Jul 28, 2023

natalieparellano commented Aug 4, 2023


		type SimpleImageStrategy struct{}

		var _ platform.ImageStrategy = &SimpleImageStrategy{}


		type RemoteImageStrategy struct{}

		var _ ImageStrategy = &RemoteImageStrategy{}

Verify read access while selecting best run-image mirror #1024

Verify read access while selecting best run-image mirror #1024

Conversation

pbusko commented Feb 28, 2023

natalieparellano left a comment

Choose a reason for hiding this comment

natalieparellano commented Mar 20, 2023

natalieparellano Mar 21, 2023 • edited

Choose a reason for hiding this comment

natalieparellano Mar 21, 2023

Choose a reason for hiding this comment

c0d1ngm0nk3y Apr 17, 2023 • edited

Choose a reason for hiding this comment

c0d1ngm0nk3y commented May 2, 2023

natalieparellano commented May 2, 2023

natalieparellano commented May 2, 2023

c0d1ngm0nk3y left a comment

Choose a reason for hiding this comment

c0d1ngm0nk3y left a comment

Choose a reason for hiding this comment

natalieparellano commented May 9, 2023

c0d1ngm0nk3y commented May 11, 2023

jabrown85 May 11, 2023

Choose a reason for hiding this comment

natalieparellano May 11, 2023

Choose a reason for hiding this comment

c0d1ngm0nk3y May 11, 2023

Choose a reason for hiding this comment

jabrown85 May 11, 2023

Choose a reason for hiding this comment

natalieparellano commented May 11, 2023

c0d1ngm0nk3y commented Jul 28, 2023

natalieparellano commented Jul 28, 2023

natalieparellano commented Aug 4, 2023

Verify read access while selecting best `run-image` mirror #1024

Verify read access while selecting best `run-image` mirror #1024

natalieparellano Mar 21, 2023 •

edited

c0d1ngm0nk3y Apr 17, 2023 •

edited