github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-08-20 00:48:04 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #5680 from stevenhorsman/authenticated-registry

Browse Source 
CC | agent: Add auth reg support to the agent
This commit is contained in:
Fabiano Fidêncio 2022-11-30 11:17:17 +01:00 committed by GitHub
commit e922c73f0c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 59 additions and 195 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

238
src/agent/Cargo.lock generated
View File

@ -274,7 +274,7 @@ dependencies = [
"serde_json", "serde_json",
"sha2 0.10.5", "sha2 0.10.5",
"shadow-rs 0.16.3", "shadow-rs 0.16.3",
"strum 0.24.1", "strum",
"tonic-build 0.8.0", "tonic-build 0.8.0",
] ]
@ -322,7 +322,7 @@ dependencies = [
"matchit", "matchit",
"memchr", "memchr",
"mime", "mime",
"percent-encoding 2.1.0", "percent-encoding",
"pin-project-lite", "pin-project-lite",
"serde", "serde",
"sync_wrapper", "sync_wrapper",
@ -1247,7 +1247,7 @@ dependencies = [
"der 0.3.5", "der 0.3.5",
"elliptic-curve", "elliptic-curve",
"hmac 0.11.0", "hmac 0.11.0",
"signature 1.3.2", "signature",
] ]
[[package]] [[package]]
@ -1256,7 +1256,7 @@ version = "1.5.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1e9c280362032ea4203659fc489832d0204ef09f247a0506f170dafcac08c369" checksum = "1e9c280362032ea4203659fc489832d0204ef09f247a0506f170dafcac08c369"
dependencies = [ dependencies = [
"signature 1.3.2", "signature",
] ]
[[package]] [[package]]
@ -1466,7 +1466,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5fc25a87fa4fd2094bffb06925852034d90a17f0d1e05197d4956d3555752191" checksum = "5fc25a87fa4fd2094bffb06925852034d90a17f0d1e05197d4956d3555752191"
dependencies = [ dependencies = [
"matches", "matches",
"percent-encoding 2.1.0", "percent-encoding",
] ]
[[package]] [[package]]
@ -1577,7 +1577,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9" checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
dependencies = [ dependencies = [
"typenum", "typenum",
"version_check 0.9.4", "version_check",
] ]
[[package]] [[package]]
@ -1648,7 +1648,7 @@ dependencies = [
"libc", "libc",
"libgit2-sys", "libgit2-sys",
"log", "log",
"url 2.2.2", "url",
] ]
[[package]] [[package]]
@ -1859,22 +1859,6 @@ dependencies = [
"tokio-native-tls", "tokio-native-tls",
] ]
[[package]]
name = "hyperx"
version = "1.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5617e92fc2f2501c3e2bc6ce547cad841adba2bae5b921c7e52510beca6d084c"
dependencies = [
"base64",
"bytes 1.1.0",
"http",
"httpdate",
"language-tags",
"mime",
"percent-encoding 2.1.0",
"unicase 2.6.0",
]
[[package]] [[package]]
name = "iana-time-zone" name = "iana-time-zone"
version = "0.1.47" version = "0.1.47"
@ -1905,17 +1889,6 @@ version = "1.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39" checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
[[package]]
name = "idna"
version = "0.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "38f09e0f0b1fb55fdee1f17470ad800da77af5186a1a76c026b679358b7e844e"
dependencies = [
"matches",
"unicode-bidi",
"unicode-normalization",
]
[[package]] [[package]]
name = "idna" name = "idna"
version = "0.2.3" version = "0.2.3"
@ -1930,27 +1903,38 @@ dependencies = [
[[package]] [[package]]
name = "image-rs" name = "image-rs"
version = "0.1.0" version = "0.1.0"
source = "git+https://github.com/confidential-containers/image-rs?tag=v0.2.0#3aca6fd576f50b9e960309caddeb9d91573d4e69" source = "git+https://github.com/confidential-containers/image-rs?rev=76e6abed950152f000d8f70026d11a86cf95fb0c#76e6abed950152f000d8f70026d11a86cf95fb0c"
dependencies = [ dependencies = [
"anyhow", "anyhow",
"async-trait",
"attestation_agent",
"base64",
"dircpy", "dircpy",
"flate2", "flate2",
"fs_extra", "fs_extra",
"futures-util", "futures-util",
"hex",
"libc", "libc",
"log", "log",
"nix 0.23.1", "nix 0.23.1",
"oci-distribution 0.9.3", "oci-distribution",
"oci-spec", "oci-spec",
"ocicrypt-rs", "ocicrypt-rs",
"prost 0.8.0", "prost 0.8.0",
"sequoia-openpgp",
"serde", "serde",
"serde_json", "serde_json",
"serde_yaml",
"sha2 0.10.5", "sha2 0.10.5",
"signature 0.1.0", "shadow-rs 0.17.1",
"strum 0.23.0", "sigstore",
"strum",
"strum_macros",
"tar", "tar",
"tokio", "tokio",
"tonic 0.5.2",
"tonic-build 0.5.2",
"url",
"walkdir", "walkdir",
"zstd", "zstd",
] ]
@ -2102,21 +2086,6 @@ dependencies = [
"rayon", "rayon",
] ]
[[package]]
name = "jwt"
version = "0.15.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "98328bb4f360e6b2ceb1f95645602c7014000ef0c3809963df8ad3a3a09f8d99"
dependencies = [
"base64",
"crypto-mac 0.11.1",
"digest 0.9.0",
"hmac 0.11.0",
"serde",
"serde_json",
"sha2 0.9.9",
]
[[package]] [[package]]
name = "jwt" name = "jwt"
version = "0.16.0" version = "0.16.0"
@ -2183,7 +2152,7 @@ dependencies = [
"tracing-opentelemetry", "tracing-opentelemetry",
"tracing-subscriber", "tracing-subscriber",
"ttrpc", "ttrpc",
"url 2.2.2", "url",
"vsock-exporter", "vsock-exporter",
] ]
@ -2265,12 +2234,6 @@ version = "0.19.8"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bcf796c978e9b4d983414f4caedc9273aa33ee214c5b887bd55fde84c85d2dc4" checksum = "bcf796c978e9b4d983414f4caedc9273aa33ee214c5b887bd55fde84c85d2dc4"
[[package]]
name = "language-tags"
version = "0.3.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d4345964bb142484797b161f473a503a434de77149dd8c7427788c6e13379388"
[[package]] [[package]]
name = "lazy_static" name = "lazy_static"
version = "1.4.0" version = "1.4.0"
@ -2749,7 +2712,7 @@ dependencies = [
"serde_path_to_error", "serde_path_to_error",
"sha2 0.10.5", "sha2 0.10.5",
"thiserror", "thiserror",
"url 2.2.2", "url",
] ]
[[package]] [[package]]
@ -2762,29 +2725,6 @@ dependencies = [
"serde_json", "serde_json",
] ]
[[package]]
name = "oci-distribution"
version = "0.8.1"
source = "git+https://github.com/krustlet/oci-distribution?rev=1ba0d94a900a97aa1bcac032a67ea23766bcfdef#1ba0d94a900a97aa1bcac032a67ea23766bcfdef"
dependencies = [
"anyhow",
"futures-util",
"hyperx",
"jwt 0.15.0",
"lazy_static",
"olpc-cjson",
"regex",
"reqwest",
"serde",
"serde_json",
"sha2 0.9.9",
"tokio",
"tracing",
"unicase 1.4.2",
"url 1.7.2",
"www-authenticate",
]
[[package]] [[package]]
name = "oci-distribution" name = "oci-distribution"
version = "0.9.3" version = "0.9.3"
@ -2794,7 +2734,7 @@ dependencies = [
"futures-util", "futures-util",
"http", "http",
"http-auth", "http-auth",
"jwt 0.16.0", "jwt",
"lazy_static", "lazy_static",
"olpc-cjson", "olpc-cjson",
"regex", "regex",
@ -2805,7 +2745,7 @@ dependencies = [
"thiserror", "thiserror",
"tokio", "tokio",
"tracing", "tracing",
"unicase 2.6.0", "unicase",
] ]
[[package]] [[package]]
@ -2836,7 +2776,7 @@ dependencies = [
"hmac 0.12.1", "hmac 0.12.1",
"josekit", "josekit",
"lazy_static", "lazy_static",
"oci-distribution 0.9.3", "oci-distribution",
"openssl", "openssl",
"pin-project-lite", "pin-project-lite",
"prost 0.11.0", "prost 0.11.0",
@ -2920,7 +2860,7 @@ dependencies = [
"serde_json", "serde_json",
"serde_path_to_error", "serde_path_to_error",
"thiserror", "thiserror",
"url 2.2.2", "url",
] ]
[[package]] [[package]]
@ -2989,7 +2929,7 @@ dependencies = [
"futures", "futures",
"js-sys", "js-sys",
"lazy_static", "lazy_static",
"percent-encoding 2.1.0", "percent-encoding",
"pin-project", "pin-project",
"rand 0.8.5", "rand 0.8.5",
"serde", "serde",
@ -3150,12 +3090,6 @@ dependencies = [
"base64ct", "base64ct",
] ]
[[package]]
name = "percent-encoding"
version = "1.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "31010dd2e1ac33d5b46a5b413495239882813e0369f8ed8a5e266f173602f831"
[[package]] [[package]]
name = "percent-encoding" name = "percent-encoding"
version = "2.1.0" version = "2.1.0"
@ -3390,7 +3324,7 @@ dependencies = [
"proc-macro2", "proc-macro2",
"quote", "quote",
"syn", "syn",
"version_check 0.9.4", "version_check",
] ]
[[package]] [[package]]
@ -3401,7 +3335,7 @@ checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
dependencies = [ dependencies = [
"proc-macro2", "proc-macro2",
"quote", "quote",
"version_check 0.9.4", "version_check",
] ]
[[package]] [[package]]
@ -3776,7 +3710,7 @@ dependencies = [
"log", "log",
"mime", "mime",
"native-tls", "native-tls",
"percent-encoding 2.1.0", "percent-encoding",
"pin-project-lite", "pin-project-lite",
"serde", "serde",
"serde_json", "serde_json",
@ -3785,7 +3719,7 @@ dependencies = [
"tokio-native-tls", "tokio-native-tls",
"tokio-util 0.7.3", "tokio-util 0.7.3",
"tower-service", "tower-service",
"url 2.2.2", "url",
"wasm-bindgen", "wasm-bindgen",
"wasm-bindgen-futures", "wasm-bindgen-futures",
"web-sys", "web-sys",
@ -4038,7 +3972,7 @@ dependencies = [
"generic-array", "generic-array",
"getrandom 0.2.7", "getrandom 0.2.7",
"idea", "idea",
"idna 0.2.3", "idna",
"lalrpop", "lalrpop",
"lalrpop-util", "lalrpop-util",
"lazy_static", "lazy_static",
@ -4290,31 +4224,6 @@ dependencies = [
"libc", "libc",
] ]
[[package]]
name = "signature"
version = "0.1.0"
source = "git+https://github.com/confidential-containers/image-rs?tag=v0.2.0#3aca6fd576f50b9e960309caddeb9d91573d4e69"
dependencies = [
"anyhow",
"async-trait",
"base64",
"hex",
"oci-distribution 0.8.1",
"prost 0.8.0",
"sequoia-openpgp",
"serde",
"serde_json",
"serde_yaml",
"shadow-rs 0.17.1",
"sigstore",
"strum 0.23.0",
"strum_macros 0.24.3",
"tokio",
"tonic 0.5.2",
"tonic-build 0.5.2",
"url 2.2.2",
]
[[package]] [[package]]
name = "signature" name = "signature"
version = "1.3.2" version = "1.3.2"
@ -4334,7 +4243,7 @@ dependencies = [
"base64", "base64",
"cached", "cached",
"lazy_static", "lazy_static",
"oci-distribution 0.9.3", "oci-distribution",
"olpc-cjson", "olpc-cjson",
"open", "open",
"openidconnect", "openidconnect",
@ -4349,7 +4258,7 @@ dependencies = [
"tokio", "tokio",
"tough", "tough",
"tracing", "tracing",
"url 2.2.2", "url",
"x509-parser", "x509-parser",
] ]
@ -4519,35 +4428,13 @@ version = "0.10.0"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623" checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
[[package]]
name = "strum"
version = "0.23.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cae14b91c7d11c9a851d3fbc80a963198998c2a64eec840477fa92d8ce9b70bb"
dependencies = [
"strum_macros 0.23.1",
]
[[package]] [[package]]
name = "strum" name = "strum"
version = "0.24.1" version = "0.24.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "063e6045c0e62079840579a7e47a355ae92f60eb74daaf156fb1e84ba164e63f" checksum = "063e6045c0e62079840579a7e47a355ae92f60eb74daaf156fb1e84ba164e63f"
dependencies = [ dependencies = [
"strum_macros 0.24.3", "strum_macros",
]
[[package]]
name = "strum_macros"
version = "0.23.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5bb0dc7ee9c15cea6199cde9a127fa16a4c5819af85395457ad72d68edc85a38"
dependencies = [
"heck 0.3.3",
"proc-macro2",
"quote",
"rustversion",
"syn",
] ]
[[package]] [[package]]
@ -4904,7 +4791,7 @@ dependencies = [
"http-body", "http-body",
"hyper", "hyper",
"hyper-timeout", "hyper-timeout",
"percent-encoding 2.1.0", "percent-encoding",
"pin-project", "pin-project",
"prost 0.8.0", "prost 0.8.0",
"prost-derive 0.8.0", "prost-derive 0.8.0",
@ -4936,7 +4823,7 @@ dependencies = [
"http-body", "http-body",
"hyper", "hyper",
"hyper-timeout", "hyper-timeout",
"percent-encoding 2.1.0", "percent-encoding",
"pin-project", "pin-project",
"prost 0.11.0", "prost 0.11.0",
"prost-derive 0.11.0", "prost-derive 0.11.0",
@ -4989,7 +4876,7 @@ dependencies = [
"olpc-cjson", "olpc-cjson",
"path-absolutize 3.0.14", "path-absolutize 3.0.14",
"pem 1.1.0", "pem 1.1.0",
"percent-encoding 2.1.0", "percent-encoding",
"reqwest", "reqwest",
"ring", "ring",
"serde", "serde",
@ -4998,7 +4885,7 @@ dependencies = [
"snafu", "snafu",
"tempfile", "tempfile",
"untrusted", "untrusted",
"url 2.2.2", "url",
"walkdir", "walkdir",
] ]
@ -5242,22 +5129,13 @@ dependencies = [
"utcnow", "utcnow",
] ]
[[package]]
name = "unicase"
version = "1.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7f4765f83163b74f957c797ad9253caf97f103fb064d3999aea9568d09fc8a33"
dependencies = [
"version_check 0.1.5",
]
[[package]] [[package]]
name = "unicase" name = "unicase"
version = "2.6.0" version = "2.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "50f37be617794602aabbeee0be4f259dc1778fabe05e2d67ee8f79326d5cb4f6" checksum = "50f37be617794602aabbeee0be4f259dc1778fabe05e2d67ee8f79326d5cb4f6"
dependencies = [ dependencies = [
"version_check 0.9.4", "version_check",
] ]
[[package]] [[package]]
@ -5319,17 +5197,6 @@ version = "0.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a" checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
[[package]]
name = "url"
version = "1.7.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dd4e7c0d531266369519a4aa4f399d748bd37043b00bde1e4ff1f60a120b355a"
dependencies = [
"idna 0.1.5",
"matches",
"percent-encoding 1.0.1",
]
[[package]] [[package]]
name = "url" name = "url"
version = "2.2.2" version = "2.2.2"
@ -5337,9 +5204,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a507c383b2d33b5fc35d1861e77e6b383d158b2da5e14fe51b83dfedf6fd578c" checksum = "a507c383b2d33b5fc35d1861e77e6b383d158b2da5e14fe51b83dfedf6fd578c"
dependencies = [ dependencies = [
"form_urlencoded", "form_urlencoded",
"idna 0.2.3", "idna",
"matches", "matches",
"percent-encoding 2.1.0", "percent-encoding",
"serde", "serde",
] ]
@ -5371,12 +5238,6 @@ version = "0.2.15"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
[[package]]
name = "version_check"
version = "0.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "914b1a6776c4c929a602fafd8bc742e06365d4bcbe48c30f9cca5824f70dc9dd"
[[package]] [[package]]
name = "version_check" name = "version_check"
version = "0.9.4" version = "0.9.4"
@ -5619,17 +5480,6 @@ dependencies = [
"winapi", "winapi",
] ]
[[package]]
name = "www-authenticate"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "02fd1970505d8d9842104b229ba0c6b6331c0897677d0fc0517ea657e77428d0"
dependencies = [
"hyperx",
"unicase 1.4.2",
"url 1.7.2",
]
[[package]] [[package]]
name = "wyz" name = "wyz"
version = "0.2.0" version = "0.2.0"

2
src/agent/Cargo.toml
View File

@ -68,7 +68,7 @@ toml = "0.5.8"
clap = { version = "3.0.1", features = ["derive"] } clap = { version = "3.0.1", features = ["derive"] }
# Image pull/decrypt # Image pull/decrypt
image-rs = { git = "https://github.com/confidential-containers/image-rs", tag = "v0.2.0" } image-rs = { git = "https://github.com/confidential-containers/image-rs", rev = "76e6abed950152f000d8f70026d11a86cf95fb0c" }
# "vendored" feature for openssl is required by musl build # "vendored" feature for openssl is required by musl build
openssl = { version = "0.10.38", features = ["vendored"] } openssl = { version = "0.10.38", features = ["vendored"] }

14
src/agent/src/image_rpc.rs
View File

@ -277,6 +277,15 @@ impl ImageService {
self.image_client.lock().await.config.security_validate = self.image_client.lock().await.config.security_validate =
*enable_signature_verification; *enable_signature_verification;
// If the attestation-agent is being used, then enable the authenticated credentials support
//TODO tidy logic once skopeo is removed to combine with aa_kbc_params check above
info!(
sl!(),
"image_client.config.auth set to: {}",
!aa_kbc_params.is_empty()
);
self.image_client.lock().await.config.auth = !aa_kbc_params.is_empty();
let bundle_path = Path::new(CONTAINER_BASE).join(&cid); let bundle_path = Path::new(CONTAINER_BASE).join(&cid);
fs::create_dir_all(&bundle_path)?; fs::create_dir_all(&bundle_path)?;
@ -290,6 +299,11 @@ impl ImageService {
.await .await
.pull_image(image, &bundle_path, &source_creds, &Some(&decrypt_config)) .pull_image(image, &bundle_path, &source_creds, &Some(&decrypt_config))
.await?; .await?;
info!(
sl!(),
"pull and unpack image {:?}, with image-rs succeeded ", cid
);
} }
let mut sandbox = self.sandbox.lock().await; let mut sandbox = self.sandbox.lock().await;