@@ -2,132 +2,31 @@ package main
22
33import (
44 "context"
5- "crypto/tls"
6- "encoding/json"
75 "fmt"
8- "net/http"
96 "os"
107
11- "github.com/sirupsen/logrus"
12- "go.uber.org/multierr"
13- corev1 "k8s.io/api/core/v1"
14- "k8s.io/apimachinery/pkg/api/errors"
15- "k8s.io/apimachinery/pkg/types"
16- "oras.land/oras-go/v2"
17- "oras.land/oras-go/v2/content/file"
18- "oras.land/oras-go/v2/registry"
19- "oras.land/oras-go/v2/registry/remote"
20- "oras.land/oras-go/v2/registry/remote/auth"
21- "oras.land/oras-go/v2/registry/remote/credentials"
8+ "github.com/replicatedhq/embedded-cluster/pkg/artifacts"
229)
2310
24- var (
25- insecureTransport * http.Transport
26- )
27-
28- func init () {
29- insecureTransport = http .DefaultTransport .(* http.Transport ).Clone ()
30- insecureTransport .TLSClientConfig = & tls.Config {InsecureSkipVerify : true }
31- }
32-
33- // DockerConfig represents the content of the '.dockerconfigjson' secret.
34- type DockerConfig struct {
35- Auths map [string ]DockerConfigEntry `json:"auths"`
36- }
37-
38- // DockerConfigEntry represents the content of the '.dockerconfigjson' secret.
39- type DockerConfigEntry struct {
40- Username string `json:"username"`
41- Password string `json:"password"`
42- }
43-
44- // registryAuth returns the authentication store to be used when reaching the
45- // registry. The authentication store is read from the cluster secret named
46- // 'registry-creds' in the 'kotsadm' namespace.
47- func registryAuth (ctx context.Context ) (credentials.Store , error ) {
48- nsn := types.NamespacedName {Name : "registry-creds" , Namespace : "kotsadm" }
49- var sct corev1.Secret
50- if err := kubecli .Get (ctx , nsn , & sct ); err != nil {
51- if ! errors .IsNotFound (err ) {
52- return nil , fmt .Errorf ("unable to get secret: %w" , err )
53- }
54-
55- // if we can't locate a secret then returns an empty credentials
56- // store so we attempt to fetch the assets without auth.
57- logrus .Infof ("no registry auth found, trying anonymous access" )
58- return credentials .NewMemoryStore (), nil
59- }
60-
61- data , ok := sct .Data [".dockerconfigjson" ]
62- if ! ok {
63- return nil , fmt .Errorf ("unable to find secret .dockerconfigjson" )
64- }
65-
66- var cfg DockerConfig
67- if err := json .Unmarshal (data , & cfg ); err != nil {
68- return nil , fmt .Errorf ("unable to unmarshal secret: %w" , err )
69- }
70-
71- creds := credentials .NewMemoryStore ()
72- for addr , entry := range cfg .Auths {
73- creds .Put (ctx , addr , auth.Credential {
74- Username : entry .Username ,
75- Password : entry .Password ,
76- })
77- }
78- return creds , nil
79- }
80-
81- // pullArtifact fetches an artifact from the registry pointed by 'from'. The artifact
82- // is stored in a temporary directory and the path to this directory is returned.
83- // Callers are responsible for removing the temporary directory when it is no longer
84- // needed. In case of error, the temporary directory is removed here.
8511func pullArtifact (ctx context.Context , from string ) (string , error ) {
86- store , err := registryAuth ( ctx )
12+ tmpdir , err := os . MkdirTemp ( "" , "lam-artifact-*" )
8713 if err != nil {
88- return "" , fmt .Errorf ("unable to get registry auth : %w" , err )
14+ return "" , fmt .Errorf ("create temp dir : %w" , err )
8915 }
9016
91- imgref , err := registry .ParseReference (from )
92- if err != nil {
93- return "" , fmt .Errorf ("unable to parse image reference: %w" , err )
94- }
95-
96- tmpdir , err := os .MkdirTemp ("" , "embedded-cluster-artifact-*" )
97- if err != nil {
98- return "" , fmt .Errorf ("unable to create temp dir: %w" , err )
99- }
100-
101- repo , err := remote .NewRepository (from )
102- if err != nil {
103- return "" , fmt .Errorf ("unable to create repository: %w" , err )
104- }
105-
106- fs , err := file .New (tmpdir )
107- if err != nil {
108- return "" , fmt .Errorf ("unable to create file store: %w" , err )
109- }
110- defer fs .Close ()
111-
112- repo .Client = & auth.Client {
113- Client : & http.Client {Transport : insecureTransport },
114- Credential : store .Get ,
115- }
116-
117- tag := imgref .Reference
118- _ , tlserr := oras .Copy (ctx , repo , tag , fs , tag , oras .DefaultCopyOptions )
119- if tlserr == nil {
17+ opts := artifacts.PullOptions {}
18+ err = artifacts .Pull (ctx , kubecli , from , tmpdir , opts )
19+ if err == nil {
12020 return tmpdir , nil
12121 }
12222
12323 // if we fail to fetch the artifact using https we gonna try once more using plain
12424 // http as some versions of the registry were deployed without tls.
125- repo .PlainHTTP = true
126- logrus .Infof ("unable to fetch artifact using tls, retrying with http" )
127- if _ , err := oras .Copy (ctx , repo , tag , fs , tag , oras .DefaultCopyOptions ); err != nil {
128- os .RemoveAll (tmpdir )
129- err = multierr .Combine (tlserr , err )
130- return "" , fmt .Errorf ("unable to fetch artifacts with or without tls: %w" , err )
25+ opts .PlainHTTP = true
26+ if err := artifacts .Pull (ctx , kubecli , from , tmpdir , opts ); err == nil {
27+ return tmpdir , nil
13128 }
132- return tmpdir , nil
29+
30+ os .RemoveAll (tmpdir )
31+ return "" , fmt .Errorf ("pull artifact: %w" , err )
13332}
0 commit comments