Documentation
¶
Overview ¶
Package regauth turns an application's registry credential into the encoded auth the moby client sends when it creates or updates a service.
The credential is a docker config.json ({"auths": {...}}) — the same file an operator gets from `docker login` — delivered to the controller as a Docker secret, per the seam-vs-configuration line drawn in package secrets. It is scoped per application: the reconciler hands each application only the resolver built from its own secret, so one application's manifest cannot borrow another's credential to pull a private image.
The parsing, the Docker Hub index-key special-casing and the auths → header transform are docker/cli's own (config.LoadFromReader plus command.RetrieveAuthTokenFromImage), not reimplemented here.
Index ¶
Constants ¶
const DefaultSecretsDir = "/run/secrets"
DefaultSecretsDir is where Swarm mounts a service's secrets. An application's registryAuth names a secret, and the controller reads it from here.
Variables ¶
This section is empty.
Functions ¶
func Load ¶
func Load(apps []application.Spec, secretsDir string, readFile func(string) ([]byte, error)) (map[string]Resolver, error)
Load builds a resolver for every application that declares registryAuth, reading each named secret from secretsDir through readFile (os.ReadFile in production, a fake in tests). An application without registryAuth gets no entry and its pulls stay anonymous.
A named secret that is missing or unparseable is fatal. A controller that started anyway would fail every deploy of that application with an unauthenticated pull — the convergence timeout naming nothing that #30 exists to eliminate — so the failure is named here, before the loop starts.
Types ¶
type Resolver ¶
Resolver returns the base64 X-Registry-Auth value for an image, as swarm.ServiceCreateOptions.EncodedRegistryAuth expects it. An image whose registry has no entry in the config resolves to an anonymous credential, which is the same thing an unauthenticated pull sends.
func FromConfig ¶
FromConfig builds a Resolver from the bytes of a docker config.json.
A credsStore or credHelpers entry is rejected rather than honoured: resolving it would exec a docker credential helper, and the controller image ships none. Failing here names that limitation at startup instead of surfacing it as an exec error mid-deploy — which matters most for exactly the short-lived cloud-registry tokens (ECR, GCR) a helper would refresh.
Source Files