/
util.go
292 lines (254 loc) · 9.7 KB
/
util.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
package strategy
import (
"fmt"
"path/filepath"
"strconv"
"strings"
"github.com/golang/glog"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
kvalidation "k8s.io/apimachinery/pkg/util/validation"
kapi "k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/api/v1"
"github.com/openshift/origin/pkg/api/apihelpers"
buildapi "github.com/openshift/origin/pkg/build/apis/build"
buildapiv1 "github.com/openshift/origin/pkg/build/apis/build/v1"
"github.com/openshift/origin/pkg/build/builder/cmd/dockercfg"
imageapi "github.com/openshift/origin/pkg/image/apis/image"
"github.com/openshift/origin/pkg/version"
)
const (
// dockerSocketPath is the default path for the Docker socket inside the builder container
dockerSocketPath = "/var/run/docker.sock"
crioSocketPath = "/var/run/crio.sock"
sourceSecretMountPath = "/var/run/secrets/openshift.io/source"
DockerPushSecretMountPath = "/var/run/secrets/openshift.io/push"
DockerPullSecretMountPath = "/var/run/secrets/openshift.io/pull"
SecretBuildSourceBaseMountPath = "/var/run/secrets/openshift.io/build"
SourceImagePullSecretMountPath = "/var/run/secrets/openshift.io/source-image"
// ExtractImageContentContainer is the name of the container that will
// pull down input images and extract their content for input to the build.
ExtractImageContentContainer = "extract-image-content"
// GitCloneContainer is the name of the container that will clone the
// build source repository and also handle binary input content.
GitCloneContainer = "git-clone"
)
var (
// BuildControllerRefKind contains the schema.GroupVersionKind for builds.
// This is used in the ownerRef of builder pods.
BuildControllerRefKind = buildapiv1.SchemeGroupVersion.WithKind("Build")
)
// FatalError is an error which can't be retried.
type FatalError struct {
// Reason the fatal error occurred
Reason string
}
// Error implements the error interface.
func (e *FatalError) Error() string {
return fmt.Sprintf("fatal error: %s", e.Reason)
}
// IsFatal returns true if the error is fatal
func IsFatal(err error) bool {
_, isFatal := err.(*FatalError)
return isFatal
}
// setupDockerSocket configures the pod to support the host's Docker socket
func setupDockerSocket(pod *v1.Pod) {
dockerSocketVolume := v1.Volume{
Name: "docker-socket",
VolumeSource: v1.VolumeSource{
HostPath: &v1.HostPathVolumeSource{
Path: dockerSocketPath,
},
},
}
dockerSocketVolumeMount := v1.VolumeMount{
Name: "docker-socket",
MountPath: dockerSocketPath,
}
pod.Spec.Volumes = append(pod.Spec.Volumes,
dockerSocketVolume)
pod.Spec.Containers[0].VolumeMounts =
append(pod.Spec.Containers[0].VolumeMounts,
dockerSocketVolumeMount)
for i, initContainer := range pod.Spec.InitContainers {
if initContainer.Name == ExtractImageContentContainer {
pod.Spec.InitContainers[i].VolumeMounts = append(pod.Spec.InitContainers[i].VolumeMounts, dockerSocketVolumeMount)
break
}
}
}
// setupCrioSocket configures the pod to support the host's Crio socket
func setupCrioSocket(pod *v1.Pod) {
crioSocketVolume := v1.Volume{
Name: "crio-socket",
VolumeSource: v1.VolumeSource{
HostPath: &v1.HostPathVolumeSource{
Path: crioSocketPath,
},
},
}
crioSocketVolumeMount := v1.VolumeMount{
Name: "crio-socket",
MountPath: crioSocketPath,
}
pod.Spec.Volumes = append(pod.Spec.Volumes,
crioSocketVolume)
pod.Spec.Containers[0].VolumeMounts =
append(pod.Spec.Containers[0].VolumeMounts,
crioSocketVolumeMount)
}
// mountSecretVolume is a helper method responsible for actual mounting secret
// volumes into a pod.
func mountSecretVolume(pod *v1.Pod, container *v1.Container, secretName, mountPath, volumeSuffix string) {
volumeName := apihelpers.GetName(secretName, volumeSuffix, kvalidation.DNS1123LabelMaxLength)
// coerce from RFC1123 subdomain to RFC1123 label.
volumeName = strings.Replace(volumeName, ".", "-", -1)
volumeExists := false
for _, v := range pod.Spec.Volumes {
if v.Name == volumeName {
volumeExists = true
break
}
}
mode := int32(0600)
if !volumeExists {
volume := v1.Volume{
Name: volumeName,
VolumeSource: v1.VolumeSource{
Secret: &v1.SecretVolumeSource{
SecretName: secretName,
DefaultMode: &mode,
},
},
}
pod.Spec.Volumes = append(pod.Spec.Volumes, volume)
}
volumeMount := v1.VolumeMount{
Name: volumeName,
MountPath: mountPath,
ReadOnly: true,
}
container.VolumeMounts = append(container.VolumeMounts, volumeMount)
}
// setupDockerSecrets mounts Docker Registry secrets into Pod running the build,
// allowing Docker to authenticate against private registries or Docker Hub.
func setupDockerSecrets(pod *v1.Pod, container *v1.Container, pushSecret, pullSecret *kapi.LocalObjectReference, imageSources []buildapi.ImageSource) {
if pushSecret != nil {
mountSecretVolume(pod, container, pushSecret.Name, DockerPushSecretMountPath, "push")
container.Env = append(container.Env, []v1.EnvVar{
{Name: dockercfg.PushAuthType, Value: DockerPushSecretMountPath},
}...)
glog.V(3).Infof("%s will be used for docker push in %s", DockerPushSecretMountPath, pod.Name)
}
if pullSecret != nil {
mountSecretVolume(pod, container, pullSecret.Name, DockerPullSecretMountPath, "pull")
container.Env = append(container.Env, []v1.EnvVar{
{Name: dockercfg.PullAuthType, Value: DockerPullSecretMountPath},
}...)
glog.V(3).Infof("%s will be used for docker pull in %s", DockerPullSecretMountPath, pod.Name)
}
for i, imageSource := range imageSources {
if imageSource.PullSecret == nil {
continue
}
mountPath := filepath.Join(SourceImagePullSecretMountPath, strconv.Itoa(i))
mountSecretVolume(pod, container, imageSource.PullSecret.Name, mountPath, fmt.Sprintf("%s%d", "source-image", i))
container.Env = append(container.Env, []v1.EnvVar{
{Name: fmt.Sprintf("%s%d", dockercfg.PullSourceAuthType, i), Value: mountPath},
}...)
glog.V(3).Infof("%s will be used for docker pull in %s", mountPath, pod.Name)
}
}
// setupSourceSecrets mounts SSH key used for accessing private SCM to clone
// application source code during build.
func setupSourceSecrets(pod *v1.Pod, container *v1.Container, sourceSecret *kapi.LocalObjectReference) {
if sourceSecret == nil {
return
}
mountSecretVolume(pod, container, sourceSecret.Name, sourceSecretMountPath, "source")
glog.V(3).Infof("Installed source secrets in %s, in Pod %s/%s", sourceSecretMountPath, pod.Namespace, pod.Name)
container.Env = append(container.Env, []v1.EnvVar{
{Name: "SOURCE_SECRET_PATH", Value: sourceSecretMountPath},
}...)
}
// setupInputSecrets mounts the secrets referenced by the SecretBuildSource
// into a builder container.
func setupInputSecrets(pod *v1.Pod, container *v1.Container, secrets []buildapi.SecretBuildSource) {
for _, s := range secrets {
mountSecretVolume(pod, container, s.Secret.Name, filepath.Join(SecretBuildSourceBaseMountPath, s.Secret.Name), "build")
glog.V(3).Infof("%s will be used as a build secret in %s", s.Secret.Name, SecretBuildSourceBaseMountPath)
}
}
// addSourceEnvVars adds environment variables related to the source code
// repository to builder container
func addSourceEnvVars(source buildapi.BuildSource, output *[]v1.EnvVar) {
sourceVars := []v1.EnvVar{}
if source.Git != nil {
sourceVars = append(sourceVars, v1.EnvVar{Name: "SOURCE_REPOSITORY", Value: source.Git.URI})
sourceVars = append(sourceVars, v1.EnvVar{Name: "SOURCE_URI", Value: source.Git.URI})
}
if len(source.ContextDir) > 0 {
sourceVars = append(sourceVars, v1.EnvVar{Name: "SOURCE_CONTEXT_DIR", Value: source.ContextDir})
}
if source.Git != nil && len(source.Git.Ref) > 0 {
sourceVars = append(sourceVars, v1.EnvVar{Name: "SOURCE_REF", Value: source.Git.Ref})
}
*output = append(*output, sourceVars...)
}
func addOriginVersionVar(output *[]v1.EnvVar) {
version := v1.EnvVar{Name: buildapi.OriginVersion, Value: version.Get().String()}
*output = append(*output, version)
}
// addOutputEnvVars adds env variables that provide information about the output
// target for the build
func addOutputEnvVars(buildOutput *kapi.ObjectReference, output *[]v1.EnvVar) error {
if buildOutput == nil {
return nil
}
// output must always be a DockerImage type reference at this point.
if buildOutput.Kind != "DockerImage" {
return fmt.Errorf("invalid build output kind %s, must be DockerImage", buildOutput.Kind)
}
ref, err := imageapi.ParseDockerImageReference(buildOutput.Name)
if err != nil {
return err
}
registry := ref.Registry
ref.Registry = ""
image := ref.String()
outputVars := []v1.EnvVar{
{Name: "OUTPUT_REGISTRY", Value: registry},
{Name: "OUTPUT_IMAGE", Value: image},
}
*output = append(*output, outputVars...)
return nil
}
// setupAdditionalSecrets creates secret volume mounts in the given pod for the given list of secrets
func setupAdditionalSecrets(pod *v1.Pod, container *v1.Container, secrets []buildapi.SecretSpec) {
for _, secretSpec := range secrets {
mountSecretVolume(pod, container, secretSpec.SecretSource.Name, secretSpec.MountPath, "secret")
glog.V(3).Infof("Installed additional secret in %s, in Pod %s/%s", secretSpec.MountPath, pod.Namespace, pod.Name)
}
}
// getPodLabels creates labels for the Build Pod
func getPodLabels(build *buildapi.Build) map[string]string {
return map[string]string{buildapi.BuildLabel: buildapi.LabelValue(build.Name)}
}
func setOwnerReference(pod *v1.Pod, build *buildapi.Build) {
t := true
pod.OwnerReferences = []metav1.OwnerReference{
{
APIVersion: BuildControllerRefKind.GroupVersion().String(),
Kind: BuildControllerRefKind.Kind,
Name: build.Name,
UID: build.UID,
Controller: &t,
},
}
}
// copyEnvVarSlice returns a copy of an []v1.EnvVar
func copyEnvVarSlice(in []v1.EnvVar) []v1.EnvVar {
out := make([]v1.EnvVar, len(in))
copy(out, in)
return out
}