add credential-spec to compose

cli/compose/convert/service.go

@@ -98,6 +98,12 @@ func convertService(
 		return swarm.ServiceSpec{}, err
 	}
 
+	var privileges swarm.Privileges
+	privileges.CredentialSpec, err = convertCredentialSpec(service.CredentialSpec)
+	if err != nil {
+		return swarm.ServiceSpec{}, err
+	}
+
 	var logDriver *swarm.Driver
 	if service.Logging != nil {
 		logDriver = &swarm.Driver{
@@ -130,6 +136,7 @@ func convertService(
 				OpenStdin:       service.StdinOpen,
 				Secrets:         secrets,
 				ReadOnly:        service.ReadOnly,
+				Privileges:      &privileges,
 			},
 			LogDriver:     logDriver,
 			Resources:     resources,
@@ -477,3 +484,17 @@ func convertDNSConfig(DNS []string, DNSSearch []string) (*swarm.DNSConfig, error
 	}
 	return nil, nil
 }
+
+func convertCredentialSpec(spec composetypes.CredentialSpecConfig) (*swarm.CredentialSpec, error) {
+	if spec.File == "" && spec.Registry == "" {
+		return nil, nil
+	}
+	if spec.File != "" && spec.Registry != "" {
+		return nil, errors.New("Invalid credential spec - must provide one of `File` or `Registry`")
+	}
+
+	return &swarm.CredentialSpec{
+		File:     spec.File,
+		Registry: spec.Registry,
+	}, nil
+}

cli/compose/convert/service_test.go

@@ -316,3 +316,30 @@ func TestConvertDNSConfigSearch(t *testing.T) {
 		Search:      search,
 	}, dnsConfig)
 }
+
+func TestConvertCredentialSpec(t *testing.T) {
+	swarmSpec, err := convertCredentialSpec(composetypes.CredentialSpecConfig{})
+	assert.NoError(t, err)
+	assert.Nil(t, swarmSpec)
+
+	swarmSpec, err = convertCredentialSpec(composetypes.CredentialSpecConfig{
+		File: "/foo",
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, swarmSpec.File, "/foo")
+	assert.Equal(t, swarmSpec.Registry, "")
+
+	swarmSpec, err = convertCredentialSpec(composetypes.CredentialSpecConfig{
+		Registry: "foo",
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, swarmSpec.File, "")
+	assert.Equal(t, swarmSpec.Registry, "foo")
+
+	swarmSpec, err = convertCredentialSpec(composetypes.CredentialSpecConfig{
+		File:     "/asdf",
+		Registry: "foo",
+	})
+	assert.Error(t, err)
+	assert.Nil(t, swarmSpec)
+}

cli/compose/loader/loader_test.go

@@ -198,6 +198,22 @@ secrets:
 	assert.Equal(t, len(actual.Secrets), 1)
 }
 
+func TestLoadV33(t *testing.T) {
+	actual, err := loadYAML(`
+version: "3.3"
+services:
+  foo:
+    image: busybox
+    credential_spec:
+      File: "/foo"
+`)
+	if !assert.NoError(t, err) {
+		return
+	}
+	assert.Equal(t, len(actual.Services), 1)
+	assert.Equal(t, actual.Services[0].CredentialSpec.File, "/foo")
+}
+
 func TestParseAndLoad(t *testing.T) {
 	actual, err := loadYAML(sampleYAML)
 	if !assert.NoError(t, err) {

cli/compose/schema/data/config_schema_v3.3.json

@@ -89,6 +89,10 @@
           ]
         },
         "container_name": {"type": "string"},
+        "credential_spec": {"type": "object", "properties": {
+          "file": {"type": "string"},
+          "registry": {"type": "string"}
+        }},
         "depends_on": {"$ref": "#/definitions/list_of_strings"},
         "devices": {"type": "array", "items": {"type": "string"}, "uniqueItems": true},
         "dns": {"$ref": "#/definitions/string_or_list"},

cli/compose/types/types.go

@@ -76,8 +76,9 @@ type ServiceConfig struct {
 	CapDrop         []string `mapstructure:"cap_drop"`
 	CgroupParent    string   `mapstructure:"cgroup_parent"`
 	Command         ShellCommand
-	ContainerName   string   `mapstructure:"container_name"`
-	DependsOn       []string `mapstructure:"depends_on"`
+	ContainerName   string               `mapstructure:"container_name"`
+	CredentialSpec  CredentialSpecConfig `mapstructure:"credential_spec"`
+	DependsOn       []string             `mapstructure:"depends_on"`
 	Deploy          DeployConfig
 	Devices         []string
 	DNS             StringList
@@ -310,3 +311,9 @@ type SecretConfig struct {
 	External External
 	Labels   Labels
 }
+
+// CredentialSpecConfig for credential spec on Windows
+type CredentialSpecConfig struct {
+	File     string
+	Registry string
+}