-
Notifications
You must be signed in to change notification settings - Fork 364
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: add logic in agent to invoke docker credentials helpers
When we added in the container_startup_script to run in the agent's runtime environment (docker), an assumption was made that the golang client would handle invoking credentials helpers. Unfortunately, they are invoked by the cli itself. Because of this, this commit is to invoke the credential helper if auth wasn't provided on the experiment config.
- Loading branch information
1 parent
dcd4d86
commit 4ddfab4
Showing
4 changed files
with
101 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| package internal | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "io/ioutil" | ||
| "os" | ||
|
|
||
| hclient "github.com/docker/docker-credential-helpers/client" | ||
| "github.com/docker/docker/api/types" | ||
| "github.com/pkg/errors" | ||
| ) | ||
|
|
||
| const ( | ||
| dockerConfigFile = "/root/.docker/config.json" | ||
| credentialsHelperPrefix = "docker-credential-" | ||
| tokenUsername = "<token>" | ||
| ) | ||
|
|
||
| type credentialStore struct { | ||
| registry string | ||
| store hclient.ProgramFunc | ||
| } | ||
|
|
||
| // getAllCredentialStores returns the credential helpers configured in the default docker | ||
| // config or an error. | ||
| func getAllCredentialStores() (map[string]*credentialStore, error) { | ||
| type ConfigFile struct { | ||
| CredentialHelpers map[string]string `json:"credHelpers,omitempty"` | ||
| } | ||
|
|
||
| credentialsStores := map[string]*credentialStore{} | ||
| configFile, err := os.Open(dockerConfigFile) | ||
| if err != nil { | ||
| return credentialsStores, errors.Wrap(err, "can't open docker config") | ||
| } | ||
|
|
||
| b, err := ioutil.ReadAll(configFile) | ||
| if err != nil { | ||
| return credentialsStores, errors.Wrap(err, "can't read docker config") | ||
| } | ||
|
|
||
| var config ConfigFile | ||
| err = json.Unmarshal(b, &config) | ||
| if err != nil { | ||
| return credentialsStores, errors.Wrap(err, "can't parse docker config") | ||
| } | ||
|
|
||
| if config.CredentialHelpers == nil { | ||
| return credentialsStores, nil | ||
| } | ||
|
|
||
| for hostname, helper := range config.CredentialHelpers { | ||
| credentialsStores[hostname] = &credentialStore{ | ||
| registry: hostname, | ||
| store: hclient.NewShellProgramFunc(credentialsHelperPrefix + helper), | ||
| } | ||
| } | ||
|
|
||
| return credentialsStores, nil | ||
| } | ||
|
|
||
| // get executes the command to get the credentials from the native store. | ||
| func (s *credentialStore) get() (types.AuthConfig, error) { | ||
| var ret types.AuthConfig | ||
|
|
||
| creds, err := hclient.Get(s.store, s.registry) | ||
| if err != nil { | ||
| return ret, err | ||
| } | ||
|
|
||
| if creds.Username == tokenUsername { | ||
| ret.IdentityToken = creds.Secret | ||
| } else { | ||
| ret.Password = creds.Secret | ||
| ret.Username = creds.Username | ||
| } | ||
|
|
||
| ret.ServerAddress = s.registry | ||
| return ret, nil | ||
| } |