server

package
v3.9.0-alpha.3+incompa... Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 17, 2018 License: Apache-2.0 Imports: 52 Imported by: 1

Documentation

Overview

Package server wraps repository and blob store objects of docker/distribution upstream. Most significantly, the wrappers cause manifests to be stored in OpenShift's etcd store instead of registry's storage. Registry's middleware API is utilized to register the object factories.

Module with quotaRestrictedBlobStore defines a wrapper for upstream blob store that does an image quota and limits check before committing image layer to a registry. Master server contains admission check that will refuse the manifest if the image exceeds whatever quota or limit set. But the check occurs too late (after the layers are written). This addition allows us to refuse the layers and thus keep the storage clean.

*Note*: Here, we take into account just a single layer, not the image as a whole because the layers are uploaded before the manifest. This leads to a situation where several layers can be written until a big enough layer will be received that exceeds the limit.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// Challenging errors
	ErrTokenRequired         = errors.New("authorization header required")
	ErrTokenInvalid          = errors.New("failed to decode credentials")
	ErrOpenShiftAccessDenied = errors.New("access denied")

	// Non-challenging errors
	ErrNamespaceRequired   = errors.New("repository namespace required")
	ErrUnsupportedAction   = errors.New("unsupported action")
	ErrUnsupportedResource = errors.New("unsupported resource")
)

Errors used and exported by this package.

View Source 
var (
	ErrorCodeSignatureInvalid = errcode.Register(errGroup, errcode.ErrorDescriptor{
		Value:          "SIGNATURE_INVALID",
		Message:        "invalid image signature",
		HTTPStatusCode: http.StatusBadRequest,
	})

	ErrorCodeSignatureAlreadyExists = errcode.Register(errGroup, errcode.ErrorDescriptor{
		Value:          "SIGNATURE_EXISTS",
		Message:        "image signature already exists",
		HTTPStatusCode: http.StatusConflict,
	})
)

Functions

func NewApp 

func NewApp(ctx context.Context, registryClient client.RegistryClient, dockerConfig *configuration.Configuration, extraConfig *registryconfig.Configuration, writeLimiter maxconnections.Limiter) http.Handler

NewApp configures the registry application and returns http.Handler for it. The program will be terminated if an error happens.

func NewManifestFromImage 

func NewManifestFromImage(image *imageapiv1.Image) (distribution.Manifest, error)

NewManifestFromImage creates a manifest for a manifest stored in the given image.

func NewSignatureDispatcher 

func NewSignatureDispatcher(isImageClient client.ImageStreamImagesNamespacer) func(*handlers.Context, *http.Request) http.Handler

NewSignatureDispatcher provides a function that handles the GET and PUT requests for signature endpoint.

func NewTokenHandler 

func NewTokenHandler(ctx context.Context, client client.RegistryClient) http.Handler

NewTokenHandler returns a handler that implements the docker token protocol

func RegisterMetricHandler 

func RegisterMetricHandler(app *handlers.App)

func RegisterSignatureHandler 

func RegisterSignatureHandler(app *handlers.App, isImageClient client.ImageStreamImagesNamespacer)

RegisterSignatureHandler registers the Docker image signature extension to Docker registry.

func WithUserInfoLogger 

func WithUserInfoLogger(ctx context.Context, username, userid string) context.Context

WithUserInfoLogger creates a new context with provided user infomation.

Types

type AccessController 

type AccessController struct {
	// contains filtered or unexported fields
}

func (*AccessController) Authorized 

func (ac *AccessController) Authorized(ctx context.Context, accessRecords ...registryauth.Access) (context.Context, error)

Authorized handles checking whether the given request is authorized for actions on resources allowed by openshift. Sources of access records: 

origin/pkg/cmd/dockerregistry/dockerregistry.go#Execute
docker/distribution/registry/handlers/app.go#appendAccessRecords

type App 

type App struct {
	// contains filtered or unexported fields
}

App is a global registry application object. Shared resources can be placed on this object that will be accessible from all requests.

func (*App) Auth 

func (app *App) Auth(options map[string]interface{}) (registryauth.AccessController, error)

func (*App) BlobStatter 

func (app *App) BlobStatter() distribution.BlobStatter

func (*App) Registry 

func (app *App) Registry(registry distribution.Namespace, options map[string]interface{}) (distribution.Namespace, error)

func (*App) Repository 

func (app *App) Repository(ctx context.Context, repo distribution.Repository, crossmount bool) (distribution.Repository, distribution.BlobDescriptorServiceFactory, error)

Repository returns a new repository middleware.

func (*App) Storage 

func (app *App) Storage(driver storagedriver.StorageDriver, options map[string]interface{}) (storagedriver.StorageDriver, error)

type BlobGetterService 

type BlobGetterService interface {
	distribution.BlobStatter
	distribution.BlobProvider
	distribution.BlobServer
}

BlobGetterService combines the operations to access and read blobs.

func NewBlobGetterService 

func NewBlobGetterService(
	namespace, name string,
	imageStreamGetter ImageStreamGetter,
	isSecretsNamespacer client.ImageStreamSecretsNamespacer,
	cache cache.RepositoryDigest,
) BlobGetterService

NewBlobGetterService returns a getter for remote blobs. Its cache will be shared among different middleware wrappers, which is a must at least for stat calls made on manifest's dependencies during its verification.

type ByGeneration 

type ByGeneration []*imageapiv1.TagEvent

ByGeneration allows for sorting tag events from latest to oldest.

func (ByGeneration) Len 

func (b ByGeneration) Len() int

func (ByGeneration) Less 

func (b ByGeneration) Less(i, j int) bool

func (ByGeneration) Swap 

func (b ByGeneration) Swap(i, j int)

type ErrManifestBlobBadSize 

type ErrManifestBlobBadSize struct {
	Digest         digest.Digest
	ActualSize     int64
	SizeInManifest int64
}

ErrManifestBlobBadSize is returned when the blob size in a manifest does not match the actual size. The docker/distribution does not check this and therefore does not provide an error for this.

func (ErrManifestBlobBadSize) Error 

func (err ErrManifestBlobBadSize) Error() string

type ImageStreamGetter 

type ImageStreamGetter func() (*imageapiv1.ImageStream, error)

type ManifestHandler 

type ManifestHandler interface {
	// Config returns a blob with image configuration associated with the manifest. This applies only to
	// manifet schema 2.
	Config(ctx context.Context) ([]byte, error)

	// Digest returns manifest's digest.
	Digest() (manifestDigest digest.Digest, err error)

	// Manifest returns a deserialized manifest object.
	Manifest() distribution.Manifest

	// Layers returns image layers and a value for the dockerLayersOrder annotation.
	Layers(ctx context.Context) (order string, layers []imageapiv1.ImageLayer, err error)

	// Payload returns manifest's media type, complete payload with signatures and canonical payload without
	// signatures or an error if the information could not be fetched.
	Payload() (mediaType string, payload []byte, canonical []byte, err error)

	// Verify returns an error if the contained manifest is not valid or has missing dependencies.
	Verify(ctx context.Context, skipDependencyVerification bool) error
}

A ManifestHandler defines a common set of operations on all versions of manifest schema.

func NewManifestHandler 

func NewManifestHandler(serverAddr string, blobStore distribution.BlobStore, manifest distribution.Manifest) (ManifestHandler, error)

NewManifestHandler creates a manifest handler for the given manifest.

Source Files

View all Source files

Directories

Path Synopsis
Package api describes routes and urls that extends the Registry JSON HTTP API.
 Package api describes routes and urls that extends the Registry JSON HTTP API.
Package audit log the beginning and end of each API request to different logger.
 Package audit log the beginning and end of each API request to different logger.
Package auth provides functions for token authentication specification
 Package auth provides functions for token authentication specification
Package cache provides facilities to speed up access to the storage backend.
 Package cache provides facilities to speed up access to the storage backend.
Package client provides functions to make requests to external APIs.
 Package client provides functions to make requests to external APIs.
Package metrics provides functions to collect runtime registry statistics and expose the registered metrics via HTTP.
 Package metrics provides functions to collect runtime registry statistics and expose the registered metrics via HTTP.
Package supermiddleware provides helpers to run the Docker registry with middlewares without having to register them globally.
 Package supermiddleware provides helpers to run the Docker registry with middlewares without having to register them globally.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.