Documentation
¶
Overview ¶
Package imagelife builds the image inventory of a node, decides which images retention may free, and verifies image signatures. Nothing here talks to Docker: callers pass records in and execute the plans.
Index ¶
- Constants
- Variables
- func DigestOfRecord(r docker.ImageRecord) string
- func ParsePublicKey(pemData []byte) (*ecdsa.PublicKey, error)
- func Reclaimable(e Entry) int64
- func RemovalBlock(e Entry) string
- func RemoveRefs(e Entry) []string
- func SignPayload(priv *ecdsa.PrivateKey, repo, digest string) (payload []byte, sigB64 string, err error)
- type AppState
- type AppUse
- type Attempt
- type Credentials
- type Entry
- type Pin
- type Plan
- type Verifier
Constants ¶
const ( RoleLive = "live" RoleRollbackTarget = "rollback_target" RoleRecent = "recent" RoleHistory = "history" )
Roles an app can have for an image.
Variables ¶
var ErrNoSignature = errors.New("no signature found for this image")
ErrNoSignature means the registry holds no signature for the image.
Functions ¶
func DigestOfRecord ¶
func DigestOfRecord(r docker.ImageRecord) string
DigestOfRecord returns the registry digest of r, or "" for a local build.
func ParsePublicKey ¶
ParsePublicKey reads a PEM encoded ECDSA public key.
func Reclaimable ¶
Reclaimable is the space freeing e returns, net of layers other images share.
func RemovalBlock ¶
RemovalBlock returns why an explicit removal of e must be refused, or "" when it may go. Unlike retention it lets the user remove unmanaged and old deploy images on purpose, but never one a container or a rollback needs.
func RemoveRefs ¶
RemoveRefs returns the references to delete, in order, to free e: each tag, or the ID for an untagged image.
func SignPayload ¶
func SignPayload(priv *ecdsa.PrivateKey, repo, digest string) (payload []byte, sigB64 string, err error)
SignPayload builds the signed payload and signature for digest. It exists so tests and tooling can produce what Verify consumes.
Types ¶
type AppState ¶
type AppState struct {
Name string
LiveImage string
LiveImageID string
// Attempts is newest first.
Attempts []Attempt
Pins []Pin
}
AppState is what one app contributes to the inventory.
type AppUse ¶
type AppUse struct {
App string `json:"app"`
Role string `json:"role"`
DeployID string `json:"deploy_id,omitempty"`
Source string `json:"source,omitempty"`
CommitSHA string `json:"commit_sha,omitempty"`
Branch string `json:"branch,omitempty"`
At time.Time `json:"at,omitempty"`
}
AppUse says how an app relates to one image.
type Attempt ¶
type Attempt struct {
ID string
Image string
Digest string
Source string
CommitSHA string
Branch string
Status string
StartedAt time.Time
}
Attempt is the slice of a deploy attempt the inventory needs.
type Credentials ¶
type Credentials struct{ Username, Password string }
Credentials authenticate registry reads.
type Entry ¶
type Entry struct {
ID string `json:"id"`
Digest string `json:"digest,omitempty"`
Tags []string `json:"tags"`
SizeBytes int64 `json:"size_bytes"`
Containers int64 `json:"containers"`
CreatedAt time.Time `json:"created_at"`
Apps []AppUse `json:"apps"`
Protected bool `json:"protected"`
ProtectReason string `json:"protect_reason,omitempty"`
// Unmanaged is true when no app of this platform owns the image.
Unmanaged bool `json:"unmanaged"`
// InUse is true when any container, running or stopped, uses the image.
InUse bool `json:"in_use"`
// Removable says an explicit user removal is allowed right now.
Removable bool `json:"removable"`
RemovableReason string `json:"removable_reason,omitempty"`
BlockedReason string `json:"blocked_reason,omitempty"`
}
Entry is one image with its owners and retention status.
func Build ¶
func Build(records []docker.ImageRecord, apps []AppState, keepPerApp int, minAge time.Duration, now time.Time) []Entry
Build joins image records with app deploy history. keepPerApp is how many newest succeeded deploys per app count as "recent" and stay protected. Entries come back biggest first.
func UnmanagedUnused ¶
UnmanagedUnused lists the entries an include_unmanaged_unused request removes.
type Plan ¶
type Plan struct {
Remove []Entry `json:"remove"`
ReclaimBytes int64 `json:"reclaim_bytes"`
KeptCount int `json:"kept_count"`
}
Plan is the outcome of retention: what would be freed and what is kept.
type Verifier ¶
Verifier checks cosign key-based signatures (ECDSA P-256) stored beside the image in its registry as a sha256-<digest>.sig tag.
func NewVerifier ¶
func NewVerifier() *Verifier
NewVerifier returns a Verifier with a bounded HTTP timeout.
Source Files