Documentation
¶
Overview ¶
Package bundle packs, pushes, and stages compute service bundles: the OCI artifact shape the workerd data plane pulls (pkg/workerd/host). It is the single place where build (CLI) and serve agree on the wire format — an OCI image manifest whose config blob is the JSON BundleManifest and whose layers carry the modules as a gzip'd tar.
Index ¶
- Constants
- func IsInsecureRegistry(registry string) bool
- func LoadDir(dir string) (computev1alpha1.BundleManifest, map[string][]byte, error)
- func NewRepository(imageRef string, opts ...RepositoryOption) (*remote.Repository, error)
- func Push(ctx context.Context, repo *remote.Repository, tag string, ...) (string, error)
- func WriteDir(dir string, manifest computev1alpha1.BundleManifest, ...) error
- type RepositoryOption
Constants ¶
const ( // ManifestFile is the BundleManifest JSON at the root of a staging dir. ManifestFile = "manifest.json" // ModulesDir holds module files under their Module.Path. ModulesDir = "modules" )
const InsecureRegistriesEnv = "APOXY_INSECURE_BUNDLE_REGISTRIES"
InsecureRegistriesEnv lists registries (host[:port], comma-separated) that bundle pushes and pulls talk to over plain HTTP instead of HTTPS. It exists for `apoxy dev`, where bundles flow through a local insecure registry on the docker network — mirroring `oras --plain-http` and docker's insecure-registries. Unset in production, so every transfer stays HTTPS.
Variables ¶
This section is empty.
Functions ¶
func IsInsecureRegistry ¶
IsInsecureRegistry reports whether registry (host[:port]) is on the plain-HTTP allowlist.
func LoadDir ¶
func LoadDir(dir string) (computev1alpha1.BundleManifest, map[string][]byte, error)
LoadDir reads a staging directory produced by WriteDir (or authored by hand). Every module referenced by the manifest must exist; extra files under modules/ are ignored so editors' stray artifacts don't break a push.
func NewRepository ¶
func NewRepository(imageRef string, opts ...RepositoryOption) (*remote.Repository, error)
NewRepository builds the oras remote.Repository both the bundle pusher (CLI) and the bundle fetchers (workerd host) share, with PlainHTTP enabled only when the target registry is listed in APOXY_INSECURE_BUNDLE_REGISTRIES.
func Push ¶
func Push(ctx context.Context, repo *remote.Repository, tag string, manifest computev1alpha1.BundleManifest, modulesByPath map[string][]byte) (string, error)
Push packs manifest+modules as an OCI service bundle and pushes it to repo, addressed by its own manifest digest so the artifact is immutable end to end. If tag is non-empty the pushed manifest is additionally tagged, as a convenience for humans; controllers always pin the returned digest. The artifact matches what the workerd-manager pulls (pkg/workerd/host): an OCI image manifest whose config blob is the JSON-encoded BundleManifest and whose single layer is a gzip tar of the modules keyed by Module.Path.
func WriteDir ¶
func WriteDir(dir string, manifest computev1alpha1.BundleManifest, modulesByPath map[string][]byte) error
WriteDir lays manifest+modules out as a staging directory — the on-disk handoff between `apoxy build` and `apoxy bundle push`:
<dir>/manifest.json JSON BundleManifest <dir>/modules/<path...> one file per Module.Path
dir is replaced wholesale so stale modules from a previous build cannot leak into the next push.
Types ¶
type RepositoryOption ¶
type RepositoryOption func(*repositoryOptions)
RepositoryOption configures NewRepository.
func WithClientTLS ¶
func WithClientTLS(cfg *tls.Config) RepositoryOption
WithClientTLS sets the TLS client configuration for the registry transport — the transport-level counterpart of the credential options, used when the registry authenticates connections with client certificates (e.g. edge services pulling from the platform registry with their shard certs).
func WithCredential ¶
func WithCredential(cred auth.Credential) RepositoryOption
WithCredential authenticates with a fixed credential. The zero credential is anonymous.
func WithCredentialFunc ¶
func WithCredentialFunc(fn auth.CredentialFunc) RepositoryOption
WithCredentialFunc authenticates with a dynamic credential source (e.g. the docker credential store). Takes precedence over WithCredential.
func WithPreemptiveBasicAuth ¶
func WithPreemptiveBasicAuth() RepositoryOption
WithPreemptiveBasicAuth sends the resolved credential as a Basic Authorization header on every request instead of waiting for a 401 challenge. The platform registry needs this: its ext_authz maps anonymous reads to a shared read-only pull identity (in dev), so the standard probe-then-authenticate dance never sees a challenge and the client would be stuck with that identity's rights for the whole push.
Source Files