Skip to content

Commit 7392f04

Browse files
ginglis13ginglis13
authored
Merge pull request #569 from ginglis13/soci-config
Add configuration template for soci-snapshotter
2 parents 558f8e5 + 4c6677c commit 7392f04

File tree

6 files changed

+169
-10
lines changed

6 files changed

+169
-10
lines changed

‎packages/soci-snapshotter/etc-soci-snapshotter.mount.in‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
[Unit]
2+
Description=SOCI Snapshotter GRPC Configuration Directory (/etc/soci-snapshotter)
3+
DefaultDependencies=no
4+
Conflicts=umount.target
5+
Before=local-fs.target umount.target
6+
After=selinux-policy-files.service
7+
Wants=selinux-policy-files.service
8+
9+
[Mount]
10+
What=tmpfs
11+
Where=/etc/soci-snapshotter
12+
Type=tmpfs
13+
Options=nosuid,nodev,noexec,noatime,mode=0750,context=system_u:object_r:etc_secret_t:s0
14+
15+
[Install]
16+
WantedBy=preconfigured.target

‎packages/soci-snapshotter/k8s-snapshotter-conf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[required-extensions]
2+
container-runtime = "v1"
3+
std = { version = "v1" }
4+
+++
5+
---
6+
kind: KubeletConfiguration
7+
apiVersion: kubelet.config.k8s.io/v1beta1
8+
{{#if settings.container-runtime.snapshotter}}
9+
{{#if (eq settings.container-runtime.snapshotter "soci" )}}
10+
imageServiceEndpoint: unix:///run/soci-snapshotter/soci-snapshotter.sock
11+
{{/if}}
12+
{{/if}}

‎packages/soci-snapshotter/soci-config-toml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
[required-extensions]
2+
container-registry = "v1"
3+
container-runtime-plugins = "v1"
4+
std = { version = "v1", helpers = ["default", "join_array"]}
5+
+++
6+
[cri_keychain]
7+
# Make SOCI snapshotter act as a proxy ImageService
8+
# and cache credentials from requests to pull images.
9+
enable_keychain = true
10+
# This tells the SOCI snapshotter where containerd's ImageService is located.
11+
# The SOCI snapshotter will forward requests here after caching credentials.
12+
image_service_path="/run/containerd/containerd.sock"
13+
14+
# Use the containerd content store such that SOCI artifacts are maintained through
15+
# containerd's garbage collector
16+
[content_store]
17+
type="containerd"
18+
19+
{{#if settings.container-registry.mirrors}}
20+
{{#each settings.container-registry.mirrors}}
21+
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."{{registry}}"]
22+
endpoint = [{{join_array ", " endpoint }}]
23+
{{/each}}
24+
{{/if}}
25+
26+
{{#if settings.container-registry.credentials}}
27+
{{#each settings.container-registry.credentials}}
28+
{{#if (eq registry "docker.io" )}}
29+
[registry.configs."registry-1.docker.io".auth]
30+
{{else}}
31+
[registry.configs."{{registry}}".auth]
32+
{{/if}}
33+
{{#if username}}
34+
username = "{{{username}}}"
35+
{{/if}}
36+
{{#if password}}
37+
password = "{{{password}}}"
38+
{{/if}}
39+
{{#if auth}}
40+
auth = "{{{auth}}}"
41+
{{/if}}
42+
{{#if identitytoken}}
43+
identitytoken = "{{{identitytoken}}}"
44+
{{/if}}
45+
{{/each}}
46+
{{/if}}
47+
48+
[pull_modes.soci_v1]
49+
enable = false
50+
[pull_modes.soci_v2]
51+
enable = false
52+
53+
[pull_modes.parallel_pull_unpack]
54+
enable = true
55+
{{#if settings.container-runtime-plugins.soci-snapshotter.parallel-pull-unpack}}
56+
{{#with settings.container-runtime-plugins.soci-snapshotter.parallel-pull-unpack}}
57+
max_concurrent_downloads = {{default -1 max-concurrent-downloads}}
58+
max_concurrent_downloads_per_image = {{default 3 max-concurrent-downloads-per-image}}
59+
{{#if concurrent-download-chunk-size}}
60+
{{#if (eq concurrent-download-chunk-size "unlimited" )}}
61+
concurrent_download_chunk_size = ""
62+
{{else}}
63+
concurrent_download_chunk_size = "{{default "" concurrent-download-chunk-size}}"
64+
{{/if}}
65+
{{/if}}
66+
max_concurrent_unpacks = {{default -1 max-concurrent-unpacks}}
67+
max_concurrent_unpacks_per_image = {{default 1 max-concurrent-unpacks-per-image}}
68+
discard_unpacked_layers = {{default false discard-unpacked-layers}}
69+
{{/with}}
70+
{{/if}}
71+
72+
# Use a symlink to configure soci to use either igzip or unpigz depending on which was packaged.
73+
[pull_modes.parallel_pull_unpack.decompress_streams."gzip"]
74+
path = "/usr/bin/soci-gunzip"
75+
args = ["-d", "-c"]

‎packages/soci-snapshotter/soci-snapshotter.service‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ Before=containerd.service
88
[Service]
99
Type=notify
1010
EnvironmentFile=/etc/network/proxy.env
11-
ExecStart=/usr/bin/soci-snapshotter-grpc --address fd://
11+
ExecStart=/usr/bin/soci-snapshotter-grpc --address fd:// --config /etc/soci-snapshotter/config.toml --root /var/lib/soci-snapshotter
1212
Restart=always
1313
RestartSec=5
14+
SyslogIdentifier=soci-snapshotter

‎packages/soci-snapshotter/soci-snapshotter.socket‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ PartOf=soci-snapshotter.service
44
Documentation=https://github.com/awslabs/soci-snapshotter
55

66
[Socket]
7-
ListenStream=/run/soci-snapshotter-grpc/soci-snapshotter-grpc.sock
7+
ListenStream=/run/soci-snapshotter/soci-snapshotter.sock
88
SocketMode=0660
99

1010
[Install]

‎packages/soci-snapshotter/soci-snapshotter.spec‎

Lines changed: 63 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ URL: https://github.com/awslabs/soci-snapshotter
1313
Source0: https://github.com/awslabs/soci-snapshotter/archive/v%{gover}/soci-snapshotter-%{gover}.tar.gz
1414
Source1: bundled-soci-snapshotter-%{gover}.tar.gz
1515
Source2: bundled-cmd.tar.gz
16+
Source3: soci-config-toml
17+
Source4: k8s-snapshotter-conf
18+
Source100: etc-soci-snapshotter.mount.in
1619
Source101: soci-snapshotter.service
1720
Source102: soci-snapshotter.socket
1821
Source1000: clarify.toml
@@ -24,12 +27,14 @@ Patch1003: 1003-hard-fail-on-config-parsing-errors.patch
2427
BuildRequires: %{_cross_os}glibc-devel
2528
BuildRequires: %{_cross_os}libz-devel
2629
Requires: %{name}(binaries)
30+
Requires: (%{name}-k8s if %{_cross_os}variant-runtime(k8s))
31+
Requires: %{name}(optimized-gunzip)
2732

2833
%description
2934
%{summary}.
3035

3136
%package bin
32-
Summary: Remote management agent binaries
37+
Summary: A remote snapshotter for containerd
3338
Provides: %{name}(binaries)
3439
Requires: (%{_cross_os}image-feature(no-fips) and %{name})
3540
Conflicts: (%{_cross_os}image-feature(fips) or %{name}-fips-bin)
@@ -38,14 +43,45 @@ Conflicts: (%{_cross_os}image-feature(fips) or %{name}-fips-bin)
3843
%{summary}.
3944

4045
%package fips-bin
41-
Summary: Remote management agent binaries, FIPS edition
46+
Summary: A remote snapshotter for containerd, FIPS edition
4247
Provides: %{name}(binaries)
4348
Requires: (%{_cross_os}image-feature(fips) and %{name})
4449
Conflicts: (%{_cross_os}image-feature(no-fips) or %{name}-bin)
4550

4651
%description fips-bin
4752
%{summary}.
4853

54+
%package pigz
55+
Summary: Prefer pigz for gzip decompression
56+
Requires: %{_cross_os}pigz
57+
Requires: %{name}
58+
Provides: %{name}(optimized-gunzip) = 1:
59+
Conflicts: %{name}-igzip
60+
61+
%description pigz
62+
%{summary}.
63+
64+
%package igzip
65+
Summary: Prefer igzip for gzip decompression
66+
Requires: %{_cross_os}igzip
67+
Requires: %{name}
68+
Conflicts: %{name}-pigz
69+
%if "%{_cross_arch}" == "x86_64"
70+
Provides: %{name}(optimized-gunzip) = 2:
71+
%else
72+
Provides: %{name}(optimized-gunzip) = 0:
73+
%endif
74+
75+
%description igzip
76+
%{summary}.
77+
78+
%package k8s
79+
Summary: Drop-ins to override the kubelet's configuration
80+
Provides: %{name}(k8s)
81+
82+
%description k8s
83+
%{summary}.
84+
4985
%prep
5086
%autosetup -n %{gorepo}-%{gover} -p1
5187
%setup -T -D -n %{gorepo}-%{gover} -b 1 -q
@@ -58,37 +94,56 @@ export LD_VERSION="-X github.com/awslabs/soci-snapshotter/version.Version=v%{gov
5894
export LD_REVISION="-X github.com/awslabs/soci-snapshotter/version.Revision=%{gitrev}"
5995

6096
go build -C cmd -ldflags="${GOLDFLAGS} ${LD_VERSION} ${LD_REVISION}" -o "../out/soci-snapshotter-grpc" ./soci-snapshotter-grpc
61-
go build -C cmd -ldflags="${GOLDFLAGS} ${LD_VERSION} ${LD_REVISION}" -o "../out/soci" ./soci
6297

6398
gofips build -C cmd -ldflags="${GOLDFLAGS} ${LD_VERSION} ${LD_REVISION}" -o "../out/fips/soci-snapshotter-grpc" ./soci-snapshotter-grpc
64-
gofips build -C cmd -ldflags="${GOLDFLAGS} ${LD_VERSION} ${LD_REVISION}" -o "../out/fips/soci" ./soci
6599

66100
%install
67101
install -d %{buildroot}%{_cross_bindir}
68102
install -d %{buildroot}%{_cross_fips_bindir}
69103
install -d %{buildroot}%{_cross_unitdir}
70104
install -p -m 0755 out/soci-snapshotter-grpc %{buildroot}%{_cross_bindir}
71-
install -p -m 0755 out/soci %{buildroot}%{_cross_bindir}
72105
install -p -m 0755 out/fips/soci-snapshotter-grpc %{buildroot}%{_cross_fips_bindir}
73-
install -p -m 0755 out/fips/soci %{buildroot}%{_cross_fips_bindir}
106+
107+
SOCIMOUNTPATH=$(systemd-escape --path /etc/soci-snapshotter)
108+
install -p -m 0644 %{S:100} %{buildroot}%{_cross_unitdir}/${SOCIMOUNTPATH}.mount
109+
74110
install -D -p -m 0644 %{S:101} %{buildroot}%{_cross_unitdir}
75111
install -D -p -m 0644 %{S:102} %{buildroot}%{_cross_unitdir}
76112

113+
install -d %{buildroot}%{_cross_templatedir}
114+
install -p -m 0644 %{S:3} %{buildroot}%{_cross_templatedir}/soci-config-toml
115+
install -p -m 0644 %{S:4} %{buildroot}%{_cross_templatedir}/k8s-snapshotter-conf
116+
77117
%cross_scan_attribution --clarify %{S:1000} go-vendor vendor
78118

119+
%post igzip -p <lua>
120+
posix.symlink("%{_cross_bindir}/igzip", "%{_cross_bindir}/soci-gunzip")
121+
122+
%post pigz -p <lua>
123+
posix.symlink("%{_cross_bindir}/unpigz", "%{_cross_bindir}/soci-gunzip")
124+
79125
%files
80126
%license LICENSE NOTICE.md
81127
%{_cross_unitdir}/soci-snapshotter.service
82128
%{_cross_unitdir}/soci-snapshotter.socket
129+
%{_cross_unitdir}/etc-soci\x2dsnapshotter.mount
83130
%{_cross_attribution_vendor_dir}
84131
%{_cross_attribution_file}
132+
%{_cross_templatedir}/soci-config-toml
85133

86134
%files bin
87135
%{_cross_bindir}/soci-snapshotter-grpc
88-
%{_cross_bindir}/soci
89136

90137
%files fips-bin
91138
%{_cross_fips_bindir}/soci-snapshotter-grpc
92-
%{_cross_fips_bindir}/soci
139+
140+
%files pigz
141+
# No files provided by pigz but required for packaging.
142+
143+
%files igzip
144+
# No files provided by igzip but required for packaging.
145+
146+
%files k8s
147+
%{_cross_templatedir}/k8s-snapshotter-conf
93148

94149
%changelog

0 commit comments

Comments
 (0)