Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MoreSpecific ¶
MoreSpecific reports whether pattern a is a more specific match than b.
Types ¶
type Anonymous ¶
type Anonymous interface {
IsAnonymous() bool
}
Anonymous is an OPTIONAL capability marking a pattern as deliberately credential-free. Combined with most-specific-wins, a narrow anonymous entry overrides a broader credentialed one — how an operator says "this repo on my otherwise-private registry is public, never send a token for it".
type BasicTokenConfig ¶
type BasicTokenConfig struct {
Registry string
Username string
Password string
Token string
// AnonymousOnly marks this pattern as deliberately credential-free.
// Resolve returns no auth, so a narrow anonymous entry can override a
// broader credentialed one for a public repo on a private registry.
AnonymousOnly bool
}
type BasicTokenProvider ¶
type BasicTokenProvider struct {
// contains filtered or unexported fields
}
func NewBasicTokenProvider ¶
func NewBasicTokenProvider(cfg BasicTokenConfig) *BasicTokenProvider
func (*BasicTokenProvider) IsAnonymous ¶
func (p *BasicTokenProvider) IsAnonymous() bool
IsAnonymous implements Anonymous.
func (*BasicTokenProvider) Match ¶
func (p *BasicTokenProvider) Match(host, imageRef string) bool
func (*BasicTokenProvider) Pattern ¶
func (p *BasicTokenProvider) Pattern() string
Pattern implements Scoped so the resolver can rank this provider.
type DockerConfigFileProvider ¶
type DockerConfigFileProvider struct {
// contains filtered or unexported fields
}
DockerConfigFileProvider resolves credentials from the ambient docker CLI config of the user runed runs as ($DOCKER_CONFIG/config.json or $HOME/.docker/config.json), honoring inline auths as well as credHelpers/credsStore credential helpers. This is what makes a plain `docker login` on the node work for runed pulls — the Docker Go SDK does not read this file itself; populating RegistryAuth is the caller's job (issue #144).
The file is re-read on every Resolve so a fresh `docker login` takes effect without a runed restart. Pulls are rare enough that the extra stat/read is noise.
func NewDockerConfigFileProvider ¶
func NewDockerConfigFileProvider() *DockerConfigFileProvider
func (*DockerConfigFileProvider) Match ¶
func (p *DockerConfigFileProvider) Match(_, _ string) bool
Match is intentionally broad: this provider is appended after all configured providers as an ambient fallback, and Resolve returns "" (anonymous) when the config has no entry for the host.
Both parameters are ignored — required by the Provider interface, which passes the image reference so CONFIGURED patterns can scope by repository path (#178). Ambient credentials carry no pattern: the docker CLI config is host-keyed and the per-host lookup happens inside Resolve, and this provider ranks last in the resolver's ordering so it can never shadow a scoped entry.
type DockerConfigJSONProvider ¶
type DockerConfigJSONProvider struct {
// contains filtered or unexported fields
}
DockerConfigJSONProvider resolves credentials from a .dockerconfigjson blob
func NewDockerConfigJSONProvider ¶
func NewDockerConfigJSONProvider(registryPattern, raw string) *DockerConfigJSONProvider
func (*DockerConfigJSONProvider) Match ¶
func (p *DockerConfigJSONProvider) Match(host, imageRef string) bool
func (*DockerConfigJSONProvider) Pattern ¶
func (p *DockerConfigJSONProvider) Pattern() string
Pattern implements Scoped.
type ECRProvider ¶
type ECRProvider struct {
// contains filtered or unexported fields
}
func NewECRProvider ¶
func NewECRProvider(cfg ECRConfig) *ECRProvider
func (*ECRProvider) Match ¶
func (p *ECRProvider) Match(host, imageRef string) bool
type GCPConfig ¶
type GCPConfig struct {
Registry string
}
GCPConfig configures a GCPProvider. Registry is an optional host pattern (e.g. "*.pkg.dev"); when empty the provider matches the standard Google registry hosts (*.pkg.dev, gcr.io, *.gcr.io).
type GCPProvider ¶
type GCPProvider struct {
// contains filtered or unexported fields
}
GCPProvider resolves Artifact Registry / Container Registry credentials from the GCE metadata server: the instance service account's access token is used as the password for the "oauth2accesstoken" user — the documented Docker auth scheme for Google registries. This is what makes the Terraform module's enable_artifact_registry_access flag (roles/artifactregistry.reader on the instance SA) actually work for private pulls (issue #144).
Mirrors ECRProvider: the token is cached until shortly before expiry, and any fetch failure falls back to anonymous pulls.
func NewGCPProvider ¶
func NewGCPProvider(cfg GCPConfig) *GCPProvider
func (*GCPProvider) Match ¶
func (p *GCPProvider) Match(host, imageRef string) bool
func (*GCPProvider) Pattern ¶
func (p *GCPProvider) Pattern() string
Pattern implements Scoped. Empty when the provider is ambient (metadata credentials for any Google registry), which ranks it last.
type Provider ¶
type Provider interface {
Match(host string, imageRef string) bool
Resolve(ctx context.Context, host string, imageRef string) (string, error)
}
Provider supplies Docker RegistryAuth for a given image.
Match receives both the registry host and the full image reference so a provider can scope itself to a repository PATH, not just a host. That distinction matters on shared registries: a credential registered for ghcr.io used to be attached to every ghcr.io pull, including public repositories needing no auth at all — so an expired token broke images that would have pulled fine anonymously.
func AmbientProviders ¶
AmbientProviders returns providers derived from the node environment rather than explicit [[docker.registries]] config. They are appended after all configured providers, so explicit config always wins:
- on GCE, the instance service account for *.pkg.dev / gcr.io hosts (what enable_artifact_registry_access in the Terraform module implies — issue #144);
- the docker CLI config of the user runed runs as, so a plain `docker login` on the node works for any registry.
The GCP provider precedes the docker-config one deliberately: for Google hosts a metadata token is always fresh, while an on-disk `docker login` entry made with an SA token rots within the hour.
func BuildProviders ¶
BuildProviders constructs providers from normalized registries configuration. Each entry is expected to contain keys: name, registry, auth{type, username, password, token, region, dockerconfigjson}
Entries with no auth block, missing type, or an unknown type are skipped with a warn log so misconfigured registries don't silently disappear into anonymous-pull territory (see RUNE-? — the GHCR symptom that surfaced this).
type Scoped ¶
type Scoped interface {
Pattern() string
}
Scoped is an OPTIONAL capability. Providers built from an explicit registry pattern implement it so the resolver can rank candidates and prefer the most specific match (ghcr.io/myorg/app beats ghcr.io/myorg beats ghcr.io) — the same precedence Kubernetes' credential keyring applies. Providers with no configured pattern (ambient docker-config / metadata credentials) don't implement it and always rank last.
Source Files