Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BasicTokenConfig ¶
type BasicTokenProvider ¶
type BasicTokenProvider struct {
// contains filtered or unexported fields
}
func NewBasicTokenProvider ¶
func NewBasicTokenProvider(cfg BasicTokenConfig) *BasicTokenProvider
func (*BasicTokenProvider) Match ¶
func (p *BasicTokenProvider) Match(host string) bool
type DockerConfigFileProvider ¶
type DockerConfigFileProvider struct {
// contains filtered or unexported fields
}
DockerConfigFileProvider resolves credentials from the ambient docker CLI config of the user runed runs as ($DOCKER_CONFIG/config.json or $HOME/.docker/config.json), honoring inline auths as well as credHelpers/credsStore credential helpers. This is what makes a plain `docker login` on the node work for runed pulls — the Docker Go SDK does not read this file itself; populating RegistryAuth is the caller's job (issue #144).
The file is re-read on every Resolve so a fresh `docker login` takes effect without a runed restart. Pulls are rare enough that the extra stat/read is noise.
func NewDockerConfigFileProvider ¶
func NewDockerConfigFileProvider() *DockerConfigFileProvider
func (*DockerConfigFileProvider) Match ¶
func (p *DockerConfigFileProvider) Match(host string) bool
Match is intentionally broad: this provider is appended after all configured providers as an ambient fallback, and Resolve returns "" (anonymous) when the config has no entry for the host.
type DockerConfigJSONProvider ¶
type DockerConfigJSONProvider struct {
// contains filtered or unexported fields
}
DockerConfigJSONProvider resolves credentials from a .dockerconfigjson blob
func NewDockerConfigJSONProvider ¶
func NewDockerConfigJSONProvider(registryPattern, raw string) *DockerConfigJSONProvider
func (*DockerConfigJSONProvider) Match ¶
func (p *DockerConfigJSONProvider) Match(host string) bool
type ECRProvider ¶
type ECRProvider struct {
// contains filtered or unexported fields
}
func NewECRProvider ¶
func NewECRProvider(cfg ECRConfig) *ECRProvider
func (*ECRProvider) Match ¶
func (p *ECRProvider) Match(host string) bool
type GCPConfig ¶
type GCPConfig struct {
Registry string
}
GCPConfig configures a GCPProvider. Registry is an optional host pattern (e.g. "*.pkg.dev"); when empty the provider matches the standard Google registry hosts (*.pkg.dev, gcr.io, *.gcr.io).
type GCPProvider ¶
type GCPProvider struct {
// contains filtered or unexported fields
}
GCPProvider resolves Artifact Registry / Container Registry credentials from the GCE metadata server: the instance service account's access token is used as the password for the "oauth2accesstoken" user — the documented Docker auth scheme for Google registries. This is what makes the Terraform module's enable_artifact_registry_access flag (roles/artifactregistry.reader on the instance SA) actually work for private pulls (issue #144).
Mirrors ECRProvider: the token is cached until shortly before expiry, and any fetch failure falls back to anonymous pulls.
func NewGCPProvider ¶
func NewGCPProvider(cfg GCPConfig) *GCPProvider
func (*GCPProvider) Match ¶
func (p *GCPProvider) Match(host string) bool
type Provider ¶
type Provider interface {
Match(host string) bool
Resolve(ctx context.Context, host string, imageRef string) (string, error)
}
Provider supplies Docker RegistryAuth for a given image host
func AmbientProviders ¶
AmbientProviders returns providers derived from the node environment rather than explicit [[docker.registries]] config. They are appended after all configured providers, so explicit config always wins:
- on GCE, the instance service account for *.pkg.dev / gcr.io hosts (what enable_artifact_registry_access in the Terraform module implies — issue #144);
- the docker CLI config of the user runed runs as, so a plain `docker login` on the node works for any registry.
The GCP provider precedes the docker-config one deliberately: for Google hosts a metadata token is always fresh, while an on-disk `docker login` entry made with an SA token rots within the hour.
func BuildProviders ¶
BuildProviders constructs providers from normalized registries configuration. Each entry is expected to contain keys: name, registry, auth{type, username, password, token, region, dockerconfigjson}
Entries with no auth block, missing type, or an unknown type are skipped with a warn log so misconfigured registries don't silently disappear into anonymous-pull territory (see RUNE-? — the GHCR symptom that surfaced this).
Source Files