-
Notifications
You must be signed in to change notification settings - Fork 0
/
configs.go
88 lines (74 loc) · 2.15 KB
/
configs.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
package configs
import (
"fmt"
"sync"
"github.com/docker/swarmkit/agent/exec"
"github.com/docker/swarmkit/api"
)
// configs is a map that keeps all the currently available configs to the agent
// mapped by config ID.
type configs struct {
mu sync.RWMutex
m map[string]*api.Config
}
// NewManager returns a place to store configs.
func NewManager() exec.ConfigsManager {
return &configs{
m: make(map[string]*api.Config),
}
}
// Get returns a config by ID. If the config doesn't exist, returns nil.
func (r *configs) Get(configID string) (*api.Config, error) {
r.mu.RLock()
defer r.mu.RUnlock()
if r, ok := r.m[configID]; ok {
return r, nil
}
return nil, fmt.Errorf("config %s not found", configID)
}
// Add adds one or more configs to the config map.
func (r *configs) Add(configs ...api.Config) {
r.mu.Lock()
defer r.mu.Unlock()
for _, config := range configs {
r.m[config.ID] = config.Copy()
}
}
// Remove removes one or more configs by ID from the config map. Succeeds
// whether or not the given IDs are in the map.
func (r *configs) Remove(configs []string) {
r.mu.Lock()
defer r.mu.Unlock()
for _, config := range configs {
delete(r.m, config)
}
}
// Reset removes all the configs.
func (r *configs) Reset() {
r.mu.Lock()
defer r.mu.Unlock()
r.m = make(map[string]*api.Config)
}
// taskRestrictedConfigsProvider restricts the ids to the task.
type taskRestrictedConfigsProvider struct {
configs exec.ConfigGetter
configIDs map[string]struct{} // allow list of config ids
}
func (sp *taskRestrictedConfigsProvider) Get(configID string) (*api.Config, error) {
if _, ok := sp.configIDs[configID]; !ok {
return nil, fmt.Errorf("task not authorized to access config %s", configID)
}
return sp.configs.Get(configID)
}
// Restrict provides a getter that only allows access to the configs
// referenced by the task.
func Restrict(configs exec.ConfigGetter, t *api.Task) exec.ConfigGetter {
cids := map[string]struct{}{}
container := t.Spec.GetContainer()
if container != nil {
for _, configRef := range container.Configs {
cids[configRef.ConfigID] = struct{}{}
}
}
return &taskRestrictedConfigsProvider{configs: configs, configIDs: cids}
}