Skip to content

Commit 1d74f8e

Browse files
qweeahqweeah
committed
feat: support ib-based image pull
Signed-off-by: Billy Zha <[email protected]>
1 parent 01ab164 commit 1d74f8e

File tree

14 files changed

+1269
-191
lines changed

14 files changed

+1269
-191
lines changed

‎aks-node-controller/parser/helper.go‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -810,3 +810,39 @@ func getLocalDnsMemoryLimitInMb(aksnodeconfig *aksnodeconfigv1.Configuration) st
810810
}
811811

812812
// ---------------------- End of localdns related helper code ----------------------//
813+
814+
// ---------------------- Image Pull Identity helper functions ----------------------//
815+
816+
// getImagePullIdentityBindingEnabled returns whether identity binding-based image pull is enabled.
817+
func getImagePullIdentityBindingEnabled(securityProfile *aksnodeconfigv1.SecurityProfile) bool {
818+
if securityProfile == nil || securityProfile.GetImagePullIdentityProfile() == nil {
819+
return false
820+
}
821+
return securityProfile.GetImagePullIdentityProfile().GetEnabled()
822+
}
823+
824+
// getImagePullIdentityDefaultClientID returns the default client ID for image pull identity binding.
825+
func getImagePullIdentityDefaultClientID(securityProfile *aksnodeconfigv1.SecurityProfile) string {
826+
if securityProfile == nil || securityProfile.GetImagePullIdentityProfile() == nil {
827+
return ""
828+
}
829+
return securityProfile.GetImagePullIdentityProfile().GetDefaultClientId()
830+
}
831+
832+
// getImagePullIdentityDefaultTenantID returns the default tenant ID for image pull identity binding.
833+
func getImagePullIdentityDefaultTenantID(securityProfile *aksnodeconfigv1.SecurityProfile) string {
834+
if securityProfile == nil || securityProfile.GetImagePullIdentityProfile() == nil {
835+
return ""
836+
}
837+
return securityProfile.GetImagePullIdentityProfile().GetDefaultTenantId()
838+
}
839+
840+
// getImagePullIdentityLocalAuthoritySNI returns the local authority SNI for identity bindings.
841+
func getImagePullIdentityLocalAuthoritySNI(securityProfile *aksnodeconfigv1.SecurityProfile) string {
842+
if securityProfile == nil || securityProfile.GetImagePullIdentityProfile() == nil {
843+
return ""
844+
}
845+
return securityProfile.GetImagePullIdentityProfile().GetLocalAuthoritySni()
846+
}
847+
848+
// ---------------------- End of Image Pull Identity helper functions ----------------------//

‎aks-node-controller/parser/helper_test.go‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1811,3 +1811,187 @@ func Test_getLocalDnsMemoryLimitInMb(t *testing.T) {
18111811
})
18121812
}
18131813
}
1814+
1815+
func Test_getImagePullIdentityBindingEnabled(t *testing.T) {
1816+
tests := []struct {
1817+
name string
1818+
securityProfile *aksnodeconfigv1.SecurityProfile
1819+
want bool
1820+
}{
1821+
{
1822+
name: "nil SecurityProfile",
1823+
securityProfile: nil,
1824+
want: false,
1825+
},
1826+
{
1827+
name: "nil ImagePullIdentityProfile",
1828+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1829+
ImagePullIdentityProfile: nil,
1830+
},
1831+
want: false,
1832+
},
1833+
{
1834+
name: "enabled true",
1835+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1836+
ImagePullIdentityProfile: &aksnodeconfigv1.ImagePullIdentityProfile{
1837+
Enabled: true,
1838+
},
1839+
},
1840+
want: true,
1841+
},
1842+
{
1843+
name: "enabled false",
1844+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1845+
ImagePullIdentityProfile: &aksnodeconfigv1.ImagePullIdentityProfile{
1846+
Enabled: false,
1847+
},
1848+
},
1849+
want: false,
1850+
},
1851+
}
1852+
for _, tt := range tests {
1853+
t.Run(tt.name, func(t *testing.T) {
1854+
if got := getImagePullIdentityBindingEnabled(tt.securityProfile); got != tt.want {
1855+
t.Errorf("getImagePullIdentityBindingEnabled() = %v, want %v", got, tt.want)
1856+
}
1857+
})
1858+
}
1859+
}
1860+
1861+
func Test_getImagePullIdentityDefaultClientID(t *testing.T) {
1862+
tests := []struct {
1863+
name string
1864+
securityProfile *aksnodeconfigv1.SecurityProfile
1865+
want string
1866+
}{
1867+
{
1868+
name: "nil SecurityProfile",
1869+
securityProfile: nil,
1870+
want: "",
1871+
},
1872+
{
1873+
name: "nil ImagePullIdentityProfile",
1874+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1875+
ImagePullIdentityProfile: nil,
1876+
},
1877+
want: "",
1878+
},
1879+
{
1880+
name: "with client ID",
1881+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1882+
ImagePullIdentityProfile: &aksnodeconfigv1.ImagePullIdentityProfile{
1883+
DefaultClientId: "test-client-id",
1884+
},
1885+
},
1886+
want: "test-client-id",
1887+
},
1888+
{
1889+
name: "empty client ID",
1890+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1891+
ImagePullIdentityProfile: &aksnodeconfigv1.ImagePullIdentityProfile{
1892+
DefaultClientId: "",
1893+
},
1894+
},
1895+
want: "",
1896+
},
1897+
}
1898+
for _, tt := range tests {
1899+
t.Run(tt.name, func(t *testing.T) {
1900+
if got := getImagePullIdentityDefaultClientID(tt.securityProfile); got != tt.want {
1901+
t.Errorf("getImagePullIdentityDefaultClientID() = %v, want %v", got, tt.want)
1902+
}
1903+
})
1904+
}
1905+
}
1906+
1907+
func Test_getImagePullIdentityDefaultTenantID(t *testing.T) {
1908+
tests := []struct {
1909+
name string
1910+
securityProfile *aksnodeconfigv1.SecurityProfile
1911+
want string
1912+
}{
1913+
{
1914+
name: "nil SecurityProfile",
1915+
securityProfile: nil,
1916+
want: "",
1917+
},
1918+
{
1919+
name: "nil ImagePullIdentityProfile",
1920+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1921+
ImagePullIdentityProfile: nil,
1922+
},
1923+
want: "",
1924+
},
1925+
{
1926+
name: "with tenant ID",
1927+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1928+
ImagePullIdentityProfile: &aksnodeconfigv1.ImagePullIdentityProfile{
1929+
DefaultTenantId: "test-tenant-id",
1930+
},
1931+
},
1932+
want: "test-tenant-id",
1933+
},
1934+
{
1935+
name: "empty tenant ID",
1936+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1937+
ImagePullIdentityProfile: &aksnodeconfigv1.ImagePullIdentityProfile{
1938+
DefaultTenantId: "",
1939+
},
1940+
},
1941+
want: "",
1942+
},
1943+
}
1944+
for _, tt := range tests {
1945+
t.Run(tt.name, func(t *testing.T) {
1946+
if got := getImagePullIdentityDefaultTenantID(tt.securityProfile); got != tt.want {
1947+
t.Errorf("getImagePullIdentityDefaultTenantID() = %v, want %v", got, tt.want)
1948+
}
1949+
})
1950+
}
1951+
}
1952+
1953+
func Test_getImagePullIdentityLocalAuthoritySNI(t *testing.T) {
1954+
tests := []struct {
1955+
name string
1956+
securityProfile *aksnodeconfigv1.SecurityProfile
1957+
want string
1958+
}{
1959+
{
1960+
name: "nil SecurityProfile",
1961+
securityProfile: nil,
1962+
want: "",
1963+
},
1964+
{
1965+
name: "nil ImagePullIdentityProfile",
1966+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1967+
ImagePullIdentityProfile: nil,
1968+
},
1969+
want: "",
1970+
},
1971+
{
1972+
name: "with local authority SNI",
1973+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1974+
ImagePullIdentityProfile: &aksnodeconfigv1.ImagePullIdentityProfile{
1975+
LocalAuthoritySni: "test-sni.local",
1976+
},
1977+
},
1978+
want: "test-sni.local",
1979+
},
1980+
{
1981+
name: "empty local authority SNI",
1982+
securityProfile: &aksnodeconfigv1.SecurityProfile{
1983+
ImagePullIdentityProfile: &aksnodeconfigv1.ImagePullIdentityProfile{
1984+
LocalAuthoritySni: "",
1985+
},
1986+
},
1987+
want: "",
1988+
},
1989+
}
1990+
for _, tt := range tests {
1991+
t.Run(tt.name, func(t *testing.T) {
1992+
if got := getImagePullIdentityLocalAuthoritySNI(tt.securityProfile); got != tt.want {
1993+
t.Errorf("getImagePullIdentityLocalAuthoritySNI() = %v, want %v", got, tt.want)
1994+
}
1995+
})
1996+
}
1997+
}

‎aks-node-controller/parser/parser.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,10 @@ func getCSEEnv(config *aksnodeconfigv1.Configuration) map[string]string {
173173
"LOCALDNS_MEMORY_LIMIT": getLocalDnsMemoryLimitInMb(config),
174174
"LOCALDNS_GENERATED_COREFILE": getLocalDnsCorefileBase64(config),
175175
"DISABLE_PUBKEY_AUTH": fmt.Sprintf("%v", config.GetDisablePubkeyAuth()),
176+
"IMAGE_PULL_IDENTITY_BINDING_ENABLED": fmt.Sprintf("%v", getImagePullIdentityBindingEnabled(config.GetSecurityProfile())),
177+
"IMAGE_PULL_IDENTITY_DEFAULT_CLIENT_ID": getImagePullIdentityDefaultClientID(config.GetSecurityProfile()),
178+
"IMAGE_PULL_IDENTITY_DEFAULT_TENANT_ID": getImagePullIdentityDefaultTenantID(config.GetSecurityProfile()),
179+
"IDENTITY_BINDINGS_LOCAL_AUTHORITY_SNI": getImagePullIdentityLocalAuthoritySNI(config.GetSecurityProfile()),
176180
}
177181

178182
for i, cert := range config.CustomCaCerts {

0 commit comments

Comments
 (0)