github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-08-17 07:27:22 +00:00
Code Issues Projects Releases Wiki Activity

agent: Set image_client security_validate

Browse Source 
Replace hard-coded aa_kbc_param check to set the image_client's
security_validate, with reading the setting from the agent config

Fixes: #4888
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
This commit is contained in:
stevenhorsman 2022-10-11 14:39:15 +01:00
parent 9aa4afee63
commit 360e01c0f4
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/agent/src/image_rpc.rs
View File

@ -35,7 +35,6 @@ const OCICRYPT_CONFIG_PATH: &str = "/tmp/ocicrypt_config.json";
const KATA_CC_IMAGE_WORK_DIR: &str = "/run/image/"; const KATA_CC_IMAGE_WORK_DIR: &str = "/run/image/";
const KATA_CC_PAUSE_BUNDLE: &str = "/pause_bundle"; const KATA_CC_PAUSE_BUNDLE: &str = "/pause_bundle";
const CONFIG_JSON: &str = "config.json"; const CONFIG_JSON: &str = "config.json";
const OFFLINE_FS_KBC_RESOURCE_PATH: &str = "/etc/aa-offline_fs_kbc-resources.json";
// Convenience macro to obtain the scope logger // Convenience macro to obtain the scope logger
macro_rules! sl { macro_rules! sl {
@ -268,13 +267,15 @@ impl ImageService {
Self::pull_image_from_registry(image, &cid, source_creds, policy_path, aa_kbc_params)?; Self::pull_image_from_registry(image, &cid, source_creds, policy_path, aa_kbc_params)?;
Self::unpack_image(&cid)?; Self::unpack_image(&cid)?;
} else { } else {
// TODO #4888 - Create a better way to enable signature verification. This is temporary for the PoC // Read enable signature verification from the agent config and set it in the image_client
if aa_kbc_params.eq("offline_fs_kbc::null") let enable_signature_verification =
&& Path::new(OFFLINE_FS_KBC_RESOURCE_PATH).exists() &AGENT_CONFIG.read().await.enable_signature_verification;
{ info!(
info!(sl!(), "Enabling security_validate on image_client"); sl!(),
self.image_client.lock().await.config.security_validate = true; "enable_signature_verification set to: {}", enable_signature_verification
} );
self.image_client.lock().await.config.security_validate =
*enable_signature_verification;
let bundle_path = Path::new(CONTAINER_BASE).join(&cid); let bundle_path = Path::new(CONTAINER_BASE).join(&cid);
fs::create_dir_all(&bundle_path)?; fs::create_dir_all(&bundle_path)?;