Help us shape the future of Go! Take the 2026 Go Developer Survey

registry

package
v0.7.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 25, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	PlatformAMD64 = "linux/amd64"
	PlatformARM64 = "linux/arm64"
)
View Source 
const (
	ReasonNoLayerHashes      errx.Reason = "NoLayerHashes"
	ReasonLayerHashMismatch  errx.Reason = "LayerHashMismatch"
	ReasonImageRefInvalid    errx.Reason = "ImageRefInvalid"
	ReasonDigestResolve      errx.Reason = "DigestResolveFailed"
	ReasonImageRead          errx.Reason = "ImageReadFailed"
	ReasonConfigRead         errx.Reason = "ConfigReadFailed"
	ReasonNoValidRegistry    errx.Reason = "NoValidRegistry"
	ReasonRegistryHostDenied errx.Reason = "RegistryHostDenied"
	ReasonPullSecretRead     errx.Reason = "PullSecretReadFailed"
	ReasonPullSecretParse    errx.Reason = "PullSecretParseFailed"
)
View Source 
const (
	ReasonNoSelectedSource   errx.Reason = "NoSelectedSource"
	ReasonComponentInvalid   errx.Reason = "ComponentInvalid"
	ReasonCredentialRejected errx.Reason = "CredentialRejected"
)

Reason codes for logx log events emitted during component revalidation. Error-decoration reason codes live alongside their typed errors in errors.go.

View Source 
const (
	StrategyRandom     = "Random"
	StrategySequential = "Sequential"
)

Variables

This section is empty.

Functions

func KeychainFromPullSecrets added in v0.7.0 

func KeychainFromPullSecrets(ctx context.Context, c client.Client, namespace string, refs []corev1.LocalObjectReference) (authn.Keychain, error)

KeychainFromPullSecrets builds an authn.Keychain from the named Kubernetes image-pull secrets in namespace, so the OCIChecker can inspect and verify images in private registries — the same credentials the kubelet uses to pull them. Secret-derived credentials take precedence over ambient/host credentials (authn.DefaultKeychain), which remain as a fallback so public registries and host-configured logins keep working.

refs are resolved by name (spec.imagePullSecrets style). Missing secrets are skipped (best effort — a stale reference must not block verification), but an API error other than NotFound is returned. Only kubernetes.io/dockerconfigjson secrets contribute credentials; other secret types are ignored.

When refs is empty or yields no usable credentials, it returns authn.DefaultKeychain unchanged.

func RevalidateComponents 

func RevalidateComponents(
	ctx context.Context,
	checker ImageChecker,
	images operatorv1alpha1.UpgradeImagesSpec,
	selected operatorv1alpha1.SelectedSources,
	timeout time.Duration,
	rng *rand.Rand,
	strategyName string,
	skip map[operatorv1alpha1.ComponentName]bool,
	onFailover FailoverEvent,
	onInvalid InvalidEvent,
) (updated *operatorv1alpha1.SelectedSources, allSucceeded bool)

func SelectComponent added in v0.7.0 

func SelectComponent(
	ctx context.Context,
	checker ImageChecker,
	comp operatorv1alpha1.ImageComponentSpec,
	timeout time.Duration,
	rng *rand.Rand,
	fallbackStrategy string,
) (results []RegistryResult, winner RegistryResult, ok bool)

SelectComponent probes all of a component's registries (in the component's strategy order) and picks the winner per that strategy: Sequential selects the first valid registry in the declared order (deterministic preference), Random picks a valid one at random. It is the shared core of image selection: the same routine backs first-time capsule deployment and the network-upgrade Prepare phase, so install-time and upgrade-time select and verify identically.

It returns every registry's result (so callers can emit their own audit events/metrics over the full set), the selected winner, and whether any valid registry was found. It has no side effects of its own.

func SelectedSourceFromWinner added in v0.7.0 

func SelectedSourceFromWinner(comp operatorv1alpha1.ImageComponentSpec, winner RegistryResult) operatorv1alpha1.SelectedSource

SelectedSourceFromWinner maps a winning RegistryResult to the SelectedSource recorded in status, carrying the component's per-registry layer hashes so later revalidation need not re-scan comp.Registries. Shared by initial selection and failover so both persist the same shape.

func SpecForImage 

func SpecForImage(comp operatorv1alpha1.ImageComponentSpec, image string) operatorv1alpha1.ImageRegistrySpec

SpecForImage returns the registry spec for image, or a bare spec if not found.

Types

type FailoverEvent 

type FailoverEvent func(name operatorv1alpha1.ComponentName, result FailoverResult)

type FailoverResult 

type FailoverResult struct {
	Selected    operatorv1alpha1.SelectedSource
	DidFailover bool
	FailedImage string
}

func RevalidateAndFailover 

func RevalidateAndFailover(
	ctx context.Context,
	checker ImageChecker,
	comp operatorv1alpha1.ImageComponentSpec,
	current operatorv1alpha1.SelectedSource,
	timeout time.Duration,
	rng *rand.Rand,
	strategyName string,
) (FailoverResult, error)

type ImageChecker 

type ImageChecker interface {
	Check(ctx context.Context, spec operatorv1alpha1.ImageRegistrySpec, deterministic operatorv1alpha1.ImageDeterministicSpec) RegistryResult
}

type InvalidEvent 

type InvalidEvent func(name operatorv1alpha1.ComponentName, err error)

type IterationStrategy 

type IterationStrategy interface {
	Name() string
	// Order returns a new slice; the input is never mutated.
	Order(in []operatorv1alpha1.ImageRegistrySpec) []operatorv1alpha1.ImageRegistrySpec
}

IterationStrategy decides the order a component's registries are checked in.

func NewStrategy 

func NewStrategy(name string, rng *rand.Rand) IterationStrategy

NewStrategy maps a flag value to a strategy; unset or unknown → Random (case-insensitive).

type OCIChecker 

type OCIChecker struct {
	Keychain authn.Keychain // defaults to authn.DefaultKeychain

	AllowedHosts []string // SSRF allow-list; empty denies only private/loopback hosts
	// contains filtered or unexported fields
}

OCIChecker compares an image's per-platform layer hashes against the expected manifest values. It uses uncompressed diff_ids: deterministic builds produce identical diff_ids regardless of build environment, compressed digests do not.

func (OCIChecker) Check 

func (c OCIChecker) Check(ctx context.Context, spec operatorv1alpha1.ImageRegistrySpec, deterministic operatorv1alpha1.ImageDeterministicSpec) RegistryResult

type RandomStrategy 

type RandomStrategy struct {
	Rand *rand.Rand
}

RandomStrategy spreads pull traffic across registries. Rand must be non-nil.

func (RandomStrategy) Name 

func (RandomStrategy) Name() string

func (RandomStrategy) Order 

func (s RandomStrategy) Order(in []operatorv1alpha1.ImageRegistrySpec) []operatorv1alpha1.ImageRegistrySpec

type RegistryResult 

type RegistryResult struct {
	Image  string
	Digest operatorv1alpha1.Sha256Digest
	State  RegistryState
	// true when expected layer hashes were configured and matched the image
	LayerHashesVerified bool
	// recorded, never propagated, so one failure can't abort sibling checks
	Err error
}

func CheckAll 

func CheckAll(
	ctx context.Context,
	checker ImageChecker,
	comp operatorv1alpha1.ImageComponentSpec,
	timeout time.Duration,
	strategy IterationStrategy,
) []RegistryResult

CheckAll checks all of a component's registries in strategy order with no early exit, each under its own timeout. checker and strategy must be non-nil.

func SelectFirstValid added in v0.7.0 

func SelectFirstValid(results []RegistryResult) (RegistryResult, bool)

SelectFirstValid returns the first StateValid result in slice order. Used by the Sequential strategy: CheckAll returns results in the registries' declared order, so the first configured registry that verifies wins — a deterministic preference order (e.g. list a primary registry first and it is always chosen when reachable).

func SelectRandomValid added in v0.7.0 

func SelectRandomValid(results []RegistryResult, rng *rand.Rand) (RegistryResult, bool)

SelectRandomValid reservoir-samples one StateValid result uniformly at random. Used by the Random strategy to spread pull traffic across the valid registries.

type RegistryState 

type RegistryState string

RegistryState is the outcome of checking one registry entry. 

const (
	StateValid        RegistryState = "Valid"
	StateUnreachable  RegistryState = "Unreachable"
	StateHashMismatch RegistryState = "HashMismatch"
	StateNoHashes     RegistryState = "NoHashes"
	StateDenied       RegistryState = "Denied"
)

type SequentialStrategy 

type SequentialStrategy struct{}

func (SequentialStrategy) Name 

func (SequentialStrategy) Name() string

func (SequentialStrategy) Order 

func (SequentialStrategy) Order(in []operatorv1alpha1.ImageRegistrySpec) []operatorv1alpha1.ImageRegistrySpec

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.