Add client config option + registry auth e2e tests

.semaphore/semaphore.yml

@@ -11,7 +11,7 @@ blocks:
  task:
  env_vars:
  - name: GIMME_GO_VERSION
- value: "1.14.2"
+ value: "1.16.3"
  jobs:
  - name: Tests
  commands:

cmd/ignite/cmd/cmdutil/flags.go

@@ -35,3 +35,7 @@ func AddSSHFlags(fs *pflag.FlagSet, identityFile *string, timeout *uint32) {
  fs.StringVarP(identityFile, "identity", "i", "", "Override the vm's default identity file")
  fs.Uint32Var(timeout, "timeout", constants.SSH_DEFAULT_TIMEOUT_SECONDS, "Timeout waiting for connection in seconds")
 }
+
+func AddRegistryConfigDirFlag(fs *pflag.FlagSet, dir *string) {
+ fs.StringVar(dir, "registry-config-dir", "", "Directory containing the registry configuration (default ~/.docker/)")
+}

cmd/ignite/cmd/cmdutil/providers.go

@@ -0,0 +1,22 @@
+package cmdutil
+
+import (
+ log "github.com/sirupsen/logrus"
+
+ "github.com/weaveworks/ignite/pkg/providers"
+)
+
+// ResolveRegistryConfigDir reads various configuration to resolve the registry
+// configuration directory.
+func ResolveRegistryConfigDir() {
+ if providers.ComponentConfig != nil {
+ // Set the providers registry config dir from ignite configuration if
+ // it's empty. When it's set in the providers and in the ignite
+ // configuration, log about the override.
+ if providers.RegistryConfigDir == "" {
+ providers.RegistryConfigDir = providers.ComponentConfig.Spec.RegistryConfigDir
+ } else if providers.ComponentConfig.Spec.RegistryConfigDir != "" {
+ log.Debug("registry-config-dir flag overriding the ignite configuration")
+ }
+ }
+}

cmd/ignite/cmd/imgcmd/import.go

@@ -38,4 +38,5 @@ func NewCmdImport(out io.Writer) *cobra.Command {
 
 func addImportFlags(fs *pflag.FlagSet) {
  runtimeflag.RuntimeVar(fs, &providers.RuntimeName)
+ cmdutil.AddRegistryConfigDirFlag(fs, &providers.RegistryConfigDir)
 }

cmd/ignite/cmd/kerncmd/import.go

@@ -38,4 +38,5 @@ func NewCmdImport(out io.Writer) *cobra.Command {
 
 func addImportFlags(fs *pflag.FlagSet) {
  runtimeflag.RuntimeVar(fs, &providers.RuntimeName)
+ cmdutil.AddRegistryConfigDirFlag(fs, &providers.RegistryConfigDir)
 }

cmd/ignite/cmd/vmcmd/create.go

@@ -88,4 +88,5 @@ func addCreateFlags(fs *pflag.FlagSet, cf *run.CreateFlags) {
  runtimeflag.RuntimeVar(fs, &providers.RuntimeName)
  networkflag.NetworkPluginVar(fs, &providers.NetworkPluginName)
  cmdutil.AddIDPrefixFlag(fs, &providers.IDPrefix)
+ cmdutil.AddRegistryConfigDirFlag(fs, &providers.RegistryConfigDir)
 }

cmd/ignite/run/create.go

@@ -6,6 +6,7 @@ import (
  "path"
  "strings"
 
+ "github.com/weaveworks/ignite/cmd/ignite/cmd/cmdutil"
  api "github.com/weaveworks/ignite/pkg/apis/ignite"
  "github.com/weaveworks/ignite/pkg/apis/ignite/scheme"
  "github.com/weaveworks/ignite/pkg/apis/ignite/validation"
@@ -58,6 +59,9 @@ func (cf *CreateFlags) NewCreateOptions(args []string, fs *flag.FlagSet) (*Creat
  baseVM.Spec = providers.ComponentConfig.Spec.VMDefaults
  }
 
+ // Resolve registry configuration used for pulling image if required.
+ cmdutil.ResolveRegistryConfigDir()
+
  // Initialize the VM's Prefixer
  baseVM.Status.IDPrefix = providers.IDPrefix
  // Set the runtime and network-plugin on the VM, then override the global config.

cmd/ignite/run/import.go

@@ -1,6 +1,7 @@
 package run
 
 import (
+ "github.com/weaveworks/ignite/cmd/ignite/cmd/cmdutil"
  api "github.com/weaveworks/ignite/pkg/apis/ignite"
  meta "github.com/weaveworks/ignite/pkg/apis/meta/v1alpha1"
  "github.com/weaveworks/ignite/pkg/config"
@@ -16,6 +17,8 @@ func ImportImage(source string) (image *api.Image, err error) {
  return nil, err
  }
 
+ cmdutil.ResolveRegistryConfigDir()
+
  ociRef, err := meta.NewOCIImageRef(source)
  if err != nil {
  return
@@ -38,6 +41,8 @@ func ImportKernel(source string) (kernel *api.Kernel, err error) {
  return nil, err
  }
 
+ cmdutil.ResolveRegistryConfigDir()
+
  ociRef, err := meta.NewOCIImageRef(source)
  if err != nil {
  return

docs/api/ignite_v1alpha3.md

@@ -15,6 +15,11 @@
 
  - [Constants](#pkg-constants)
  - [Variables](#pkg-variables)
+ - [func
+ Convert\_ignite\_ConfigurationSpec\_To\_v1alpha3\_ConfigurationSpec(in
+ *ignite.ConfigurationSpec, out *ConfigurationSpec, s
+ conversion.Scope)
+ error](#Convert_ignite_ConfigurationSpec_To_v1alpha3_ConfigurationSpec)
  - [func SetDefaults\_ConfigurationSpec(obj
  \*ConfigurationSpec)](#SetDefaults_ConfigurationSpec)
  - [func SetDefaults\_PoolSpec(obj \*PoolSpec)](#SetDefaults_PoolSpec)
@@ -60,6 +65,7 @@
 
 #### <a name="pkg-files">Package files</a>
 
+[conversion.go](https://github.com/weaveworks/ignite/tree/main/pkg/apis/ignite/v1alpha3/conversion.go)
 [defaults.go](https://github.com/weaveworks/ignite/tree/main/pkg/apis/ignite/v1alpha3/defaults.go)
 [doc.go](https://github.com/weaveworks/ignite/tree/main/pkg/apis/ignite/v1alpha3/doc.go)
 [json.go](https://github.com/weaveworks/ignite/tree/main/pkg/apis/ignite/v1alpha3/json.go)
@@ -106,6 +112,16 @@ var SchemeGroupVersion = schema.GroupVersion{
 
 SchemeGroupVersion is group version used to register these objects
 
+## <a name="Convert_ignite_ConfigurationSpec_To_v1alpha3_ConfigurationSpec">func</a> [Convert\_ignite\_ConfigurationSpec\_To\_v1alpha3\_ConfigurationSpec](https://github.com/weaveworks/ignite/tree/main/pkg/apis/ignite/v1alpha3/conversion.go?s=261:408#L9)
+
+``` go
+func Convert_ignite_ConfigurationSpec_To_v1alpha3_ConfigurationSpec(in *ignite.ConfigurationSpec, out *ConfigurationSpec, s conversion.Scope) error
+```
+
+Convert\_ignite\_ConfigurationSpec\_To\_v1alpha3\_ConfigurationSpec
+calls the autogenerated conversion function along with custom conversion
+logic
+
 ## <a name="SetDefaults_ConfigurationSpec">func</a> [SetDefaults\_ConfigurationSpec](https://github.com/weaveworks/ignite/tree/main/pkg/apis/ignite/v1alpha3/defaults.go?s=1785:1843#L71)
 
 ``` go

docs/api/ignite_v1alpha4.md

@@ -166,14 +166,15 @@ type Configuration struct {
 Configuration represents the ignite runtime configuration.
 +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
-## <a name="ConfigurationSpec">type</a> [ConfigurationSpec](https://github.com/weaveworks/ignite/tree/main/pkg/apis/ignite/v1alpha4/types.go?s=9475:9786#L261)
+## <a name="ConfigurationSpec">type</a> [ConfigurationSpec](https://github.com/weaveworks/ignite/tree/main/pkg/apis/ignite/v1alpha4/types.go?s=9475:9883#L261)
 
 ``` go
 type ConfigurationSpec struct {
- Runtime igniteRuntime.Name `json:"runtime,omitempty"`
- NetworkPlugin igniteNetwork.PluginName `json:"networkPlugin,omitempty"`
- VMDefaults VMSpec `json:"vmDefaults,omitempty"`
- IDPrefix string `json:"idPrefix,omitempty"`
+ Runtime igniteRuntime.Name `json:"runtime,omitempty"`
+ NetworkPlugin igniteNetwork.PluginName `json:"networkPlugin,omitempty"`
+ VMDefaults VMSpec `json:"vmDefaults,omitempty"`
+ IDPrefix string `json:"idPrefix,omitempty"`
+ RegistryConfigDir string `json:"registryConfigDir,omitempty"`
 }
 ```
 

docs/cli/ignite/ignite_create.md

@@ -34,24 +34,25 @@ ignite create <OCI image> [flags]
 ### Options
 
 ```
- --config string Specify a path to a file with the API resources you want to pass
- -f, --copy-files strings Copy files/directories from the host to the created VM
- --cpus uint VM vCPU count, 1 or even numbers between 1 and 32 (default 1)
- -h, --help help for create
- --id-prefix string Prefix string for system identifiers (default ignite)
- --kernel-args string Set the command line for the kernel (default "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp")
- -k, --kernel-image oci-image Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules (default weaveworks/ignite-kernel:5.4.108)
- -l, --label stringArray Set a label (foo=bar)
- --memory size Amount of RAM to allocate for the VM (default 512.0 MB)
- -n, --name string Specify the name
- --network-plugin plugin Network plugin to use. Available options are: [cni docker-bridge] (default cni)
- -p, --ports strings Map host ports to VM ports
- --require-name Require VM name to be passed, no name generation
- --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
- --sandbox-image oci-image Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)
- -s, --size size VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
- --ssh[=<path>] Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
- -v, --volumes volume Expose block devices from the host inside the VM
+ --config string Specify a path to a file with the API resources you want to pass
+ -f, --copy-files strings Copy files/directories from the host to the created VM
+ --cpus uint VM vCPU count, 1 or even numbers between 1 and 32 (default 1)
+ -h, --help help for create
+ --id-prefix string Prefix string for system identifiers (default ignite)
+ --kernel-args string Set the command line for the kernel (default "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp")
+ -k, --kernel-image oci-image Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules (default weaveworks/ignite-kernel:5.4.108)
+ -l, --label stringArray Set a label (foo=bar)
+ --memory size Amount of RAM to allocate for the VM (default 512.0 MB)
+ -n, --name string Specify the name
+ --network-plugin plugin Network plugin to use. Available options are: [cni docker-bridge] (default cni)
+ -p, --ports strings Map host ports to VM ports
+ --registry-config-dir string Directory containing the registry configuration (default ~/.docker/)
+ --require-name Require VM name to be passed, no name generation
+ --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
+ --sandbox-image oci-image Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)
+ -s, --size size VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
+ --ssh[=<path>] Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
+ -v, --volumes volume Expose block devices from the host inside the VM
 ```
 
 ### Options inherited from parent commands

docs/cli/ignite/ignite_image_import.md

@@ -17,8 +17,9 @@ ignite image import <OCI image> [flags]
 ### Options
 
 ```
- -h, --help help for import
- --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
+ -h, --help help for import
+ --registry-config-dir string Directory containing the registry configuration (default ~/.docker/)
+ --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
 ```
 
 ### Options inherited from parent commands

docs/cli/ignite/ignite_kernel_import.md

@@ -17,8 +17,9 @@ ignite kernel import <OCI image> [flags]
 ### Options
 
 ```
- -h, --help help for import
- --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
+ -h, --help help for import
+ --registry-config-dir string Directory containing the registry configuration (default ~/.docker/)
+ --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
 ```
 
 ### Options inherited from parent commands

docs/cli/ignite/ignite_run.md

@@ -42,6 +42,7 @@ ignite run <OCI image> [flags]
  -n, --name string Specify the name
  --network-plugin plugin Network plugin to use. Available options are: [cni docker-bridge] (default cni)
  -p, --ports strings Map host ports to VM ports
+ --registry-config-dir string Directory containing the registry configuration (default ~/.docker/)
  --require-name Require VM name to be passed, no name generation
  --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
  --sandbox-image oci-image Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)

docs/cli/ignite/ignite_vm_create.md

@@ -34,24 +34,25 @@ ignite vm create <OCI image> [flags]
 ### Options
 
 ```
- --config string Specify a path to a file with the API resources you want to pass
- -f, --copy-files strings Copy files/directories from the host to the created VM
- --cpus uint VM vCPU count, 1 or even numbers between 1 and 32 (default 1)
- -h, --help help for create
- --id-prefix string Prefix string for system identifiers (default ignite)
- --kernel-args string Set the command line for the kernel (default "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp")
- -k, --kernel-image oci-image Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules (default weaveworks/ignite-kernel:5.4.108)
- -l, --label stringArray Set a label (foo=bar)
- --memory size Amount of RAM to allocate for the VM (default 512.0 MB)
- -n, --name string Specify the name
- --network-plugin plugin Network plugin to use. Available options are: [cni docker-bridge] (default cni)
- -p, --ports strings Map host ports to VM ports
- --require-name Require VM name to be passed, no name generation
- --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
- --sandbox-image oci-image Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)
- -s, --size size VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
- --ssh[=<path>] Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
- -v, --volumes volume Expose block devices from the host inside the VM
+ --config string Specify a path to a file with the API resources you want to pass
+ -f, --copy-files strings Copy files/directories from the host to the created VM
+ --cpus uint VM vCPU count, 1 or even numbers between 1 and 32 (default 1)
+ -h, --help help for create
+ --id-prefix string Prefix string for system identifiers (default ignite)
+ --kernel-args string Set the command line for the kernel (default "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp")
+ -k, --kernel-image oci-image Specify an OCI image containing the kernel at /boot/vmlinux and optionally, modules (default weaveworks/ignite-kernel:5.4.108)
+ -l, --label stringArray Set a label (foo=bar)
+ --memory size Amount of RAM to allocate for the VM (default 512.0 MB)
+ -n, --name string Specify the name
+ --network-plugin plugin Network plugin to use. Available options are: [cni docker-bridge] (default cni)
+ -p, --ports strings Map host ports to VM ports
+ --registry-config-dir string Directory containing the registry configuration (default ~/.docker/)
+ --require-name Require VM name to be passed, no name generation
+ --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
+ --sandbox-image oci-image Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)
+ -s, --size size VM filesystem size, for example 5GB or 2048MB (default 4.0 GB)
+ --ssh[=<path>] Enable SSH for the VM. If <path> is given, it will be imported as the public key. If just '--ssh' is specified, a new keypair will be generated. (default is unset, which disables SSH access to the VM)
+ -v, --volumes volume Expose block devices from the host inside the VM
 ```
 
 ### Options inherited from parent commands

docs/cli/ignite/ignite_vm_run.md

@@ -42,6 +42,7 @@ ignite vm run <OCI image> [flags]
  -n, --name string Specify the name
  --network-plugin plugin Network plugin to use. Available options are: [cni docker-bridge] (default cni)
  -p, --ports strings Map host ports to VM ports
+ --registry-config-dir string Directory containing the registry configuration (default ~/.docker/)
  --require-name Require VM name to be passed, no name generation
  --runtime runtime Container runtime to use. Available options are: [docker containerd] (default containerd)
  --sandbox-image oci-image Specify an OCI image for the VM sandbox (default weaveworks/ignite:dev)

docs/usage.md

@@ -64,14 +64,17 @@ Now the `weaveworks/ignite-ubuntu` image is imported and ready for VM use.
 
 ### Configuring image registries
 
-Ignite's runtime configuration for image registry uses the docker client
-configuration. To add a new registry to docker client configuration, run
+Ignite's runtime configuration for image registry uses the docker registry
+configuration. To add a new registry to docker registry configuration, run
 `docker login <registry-address>`. This will create `$HOME/.docker/config.json`
 in the user's home directory. When ignite runs, it'll check the user's home
-directory for docker client configuration file, load the registry configuration
+directory for docker registry configuration file, load the registry configuration
 if found and use it.
 
-An example of a docker client configuration file:
+!!! Note
+ On many systems, running `sudo ignite` will set the `$HOME` directory to `/root`.
+
+An example of a docker registry configuration file:
 
 ```json
 
@@ -80,6 +83,9 @@ An example of a docker client configuration file:
  "https://index.docker.io/v1/": {
  "auth": "<token>"
  },
+ "http://localhost:5000": {
+ "auth": "<token>"
+ },
  "gcr.io": {
  "auth": "<token>"
  }
@@ -92,12 +98,24 @@ the token is a base64 encoded value of `<username>:<auth-token>`. For `gcr.io`,
 it's a [json key][json-key] file. Using docker
 [credential helpers][credential-helpers] also works but please ensure that the
 required credential helper program is installed to handle the credentials. If
-the docker client configuration contains `"credHelpers"` block, but the
+the docker registry configuration contains `"credHelpers"` block, but the
 associated helper program isn't installed or not configured properly, ignite
 image pull will fail with errors related to the specific credential helper. In
 presence of both auth tokens and credential helpers in a configuration file,
 credential helper takes precedence.
 
+The `--registry-config-dir` flag can be used to override the default directory(`$HOME/.docker/`).
+This can also be done from the ignite [Configuration](./ignite-configuration).
+
+When using the `containerd` runtime to pull images, TLS verification can be disabled,
+and `http://` protocols can be specified by using the client-side `IGNITE_CONTAINERD_INSECURE_REGISTRIES`
+environment variable as a comma separate list.
+In this list, the protocol is completely ignored, because it's specified by the registry-configuration:
+
+```shell
+IGNITE_CONTAINERD_INSECURE_REGISTRIES="localhost:5000,localhost:5001,example.com,http://example.com"
+```
+
 [json-key]: https://cloud.google.com/container-registry/docs/advanced-authentication#json-key
 [credential-helpers]: https://docs.docker.com/engine/reference/commandline/login/#credential-helpers