Skip to content

Commit 37e0fd5

Browse files
stlazstlaz
committed
imagepullmanager: add v1alpha1 config API
1 parent cb7468b commit 37e0fd5

File tree

5 files changed

+148
-0
lines changed

5 files changed

+148
-0
lines changed

‎pkg/kubelet/apis/config/register.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
4040
&KubeletConfiguration{},
4141
&SerializedNodeConfigSource{},
4242
&CredentialProviderConfig{},
43+
&ImagePullIntent{},
44+
&ImagePulledRecord{},
4345
)
4446
return nil
4547
}

‎pkg/kubelet/apis/config/register_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ func TestComponentConfigSetup(t *testing.T) {
3737
reflect.TypeOf(logsapi.LoggingConfiguration{}): true,
3838
reflect.TypeOf(tracingapi.TracingConfiguration{}): true,
3939
reflect.TypeOf(metav1.Duration{}): true,
40+
reflect.TypeOf(metav1.Time{}): true,
4041
reflect.TypeOf(metav1.TypeMeta{}): true,
4142
reflect.TypeOf(v1.NodeConfigSource{}): true,
4243
reflect.TypeOf(v1.Taint{}): true,

‎pkg/kubelet/apis/config/types.go‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -769,3 +769,74 @@ type CrashLoopBackOffConfig struct {
769769
// +optional
770770
MaxContainerRestartPeriod *metav1.Duration
771771
}
772+
773+
// ImagePullIntent is a record of the kubelet attempting to pull an image.
774+
//
775+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
776+
type ImagePullIntent struct {
777+
metav1.TypeMeta
778+
779+
// Image is the image spec from a Container's `image` field.
780+
// The filename is a SHA-256 hash of this value. This is to avoid filename-unsafe
781+
// characters like ':' and '/'.
782+
Image string
783+
}
784+
785+
// ImagePullRecord is a record of an image that was pulled by the kubelet.
786+
//
787+
// If there are no records in the `kubernetesSecrets` field and both `nodeWideCredentials`
788+
// and `anonymous` are `false`, credentials must be re-checked the next time an
789+
// image represented by this record is being requested.
790+
//
791+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
792+
type ImagePulledRecord struct {
793+
metav1.TypeMeta
794+
795+
// LastUpdatedTime is the time of the last update to this record
796+
LastUpdatedTime metav1.Time
797+
798+
// ImageRef is a reference to the image represented by this file as received
799+
// from the CRI.
800+
// The filename is a SHA-256 hash of this value. This is to avoid filename-unsafe
801+
// characters like ':' and '/'.
802+
ImageRef string
803+
804+
// CredentialMapping maps `image` to the set of credentials that it was
805+
// previously pulled with.
806+
// `image` in this case is the content of a pod's container `image` field that's
807+
// got its tag/digest removed.
808+
//
809+
// Example:
810+
// Container requests the `hello-world:latest@sha256:91fb4b041da273d5a3273b6d587d62d518300a6ad268b28628f74997b93171b2` image:
811+
// "credentialMapping": {
812+
// "hello-world": { "nodePodsAccessible": true }
813+
// }
814+
CredentialMapping map[string]ImagePullCredentials
815+
}
816+
817+
// ImagePullCredentials describe credentials that can be used to pull an image.
818+
type ImagePullCredentials struct {
819+
// KuberneteSecretCoordinates is an index of coordinates of all the kubernetes
820+
// secrets that were used to pull the image.
821+
// +optional
822+
KubernetesSecrets []ImagePullSecret
823+
824+
// NodePodsAccessible is a flag denoting the pull credentials are accessible
825+
// by all the pods on the node, or that no credentials are needed for the pull.
826+
//
827+
// If true, it is mutually exclusive with the `kubernetesSecrets` field.
828+
// +optional
829+
NodePodsAccessible bool
830+
}
831+
832+
// ImagePullSecret is a representation of a Kubernetes secret object coordinates along
833+
// with a credential hash of the pull secret credentials this object contains.
834+
type ImagePullSecret struct {
835+
UID string
836+
Namespace string
837+
Name string
838+
839+
// CredentialHash is a SHA-256 retrieved by hashing the image pull credentials
840+
// content of the secret specified by the UID/Namespace/Name coordinates.
841+
CredentialHash string
842+
}

‎staging/src/k8s.io/kubelet/config/v1alpha1/register.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ var (
3838
func addKnownTypes(scheme *runtime.Scheme) error {
3939
scheme.AddKnownTypes(SchemeGroupVersion,
4040
&CredentialProviderConfig{},
41+
&ImagePullIntent{},
42+
&ImagePulledRecord{},
4143
)
4244
return nil
4345
}

‎staging/src/k8s.io/kubelet/config/v1alpha1/types.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,3 +96,75 @@ type ExecEnvVar struct {
9696
Name string `json:"name"`
9797
Value string `json:"value"`
9898
}
99+
100+
// ImagePullIntent is a record of the kubelet attempting to pull an image.
101+
//
102+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
103+
type ImagePullIntent struct {
104+
metav1.TypeMeta `json:",inline"`
105+
106+
// Image is the image spec from a Container's `image` field.
107+
// The filename is a SHA-256 hash of this value. This is to avoid filename-unsafe
108+
// characters like ':' and '/'.
109+
Image string `json:"image"`
110+
}
111+
112+
// ImagePullRecord is a record of an image that was pulled by the kubelet.
113+
//
114+
// If there are no records in the `kubernetesSecrets` field and both `nodeWideCredentials`
115+
// and `anonymous` are `false`, credentials must be re-checked the next time an
116+
// image represented by this record is being requested.
117+
//
118+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
119+
type ImagePulledRecord struct {
120+
metav1.TypeMeta `json:",inline"`
121+
122+
// LastUpdatedTime is the time of the last update to this record
123+
LastUpdatedTime metav1.Time `json:"lastUpdatedTime"`
124+
125+
// ImageRef is a reference to the image represented by this file as received
126+
// from the CRI.
127+
// The filename is a SHA-256 hash of this value. This is to avoid filename-unsafe
128+
// characters like ':' and '/'.
129+
ImageRef string `json:"imageRef"`
130+
131+
// CredentialMapping maps `image` to the set of credentials that it was
132+
// previously pulled with.
133+
// `image` in this case is the content of a pod's container `image` field that's
134+
// got its tag/digest removed.
135+
//
136+
// Example:
137+
// Container requests the `hello-world:latest@sha256:91fb4b041da273d5a3273b6d587d62d518300a6ad268b28628f74997b93171b2` image:
138+
// "credentialMapping": {
139+
// "hello-world": { "nodePodsAccessible": true }
140+
// }
141+
CredentialMapping map[string]ImagePullCredentials `json:"credentialMapping,omitempty"`
142+
}
143+
144+
// ImagePullCredentials describe credentials that can be used to pull an image.
145+
type ImagePullCredentials struct {
146+
// KuberneteSecretCoordinates is an index of coordinates of all the kubernetes
147+
// secrets that were used to pull the image.
148+
// +optional
149+
// +listType=set
150+
KubernetesSecrets []ImagePullSecret `json:"kubernetesSecrets"`
151+
152+
// NodePodsAccessible is a flag denoting the pull credentials are accessible
153+
// by all the pods on the node, or that no credentials are needed for the pull.
154+
//
155+
// If true, it is mutually exclusive with the `kubernetesSecrets` field.
156+
// +optional
157+
NodePodsAccessible bool `json:"nodePodsAccessible,omitempty"`
158+
}
159+
160+
// ImagePullSecret is a representation of a Kubernetes secret object coordinates along
161+
// with a credential hash of the pull secret credentials this object contains.
162+
type ImagePullSecret struct {
163+
UID string `json:"uid"`
164+
Namespace string `json:"namespace"`
165+
Name string `json:"name"`
166+
167+
// CredentialHash is a SHA-256 retrieved by hashing the image pull credentials
168+
// content of the secret specified by the UID/Namespace/Name coordinates.
169+
CredentialHash string `json:"credentialHash"`
170+
}

0 commit comments

Comments
 (0)