2019-06-20 18:36:40 -05:00
|
|
|
package cli
|
|
|
|
|
|
|
|
import (
|
2021-12-13 14:23:31 -05:00
|
|
|
"context"
|
2021-10-05 04:12:22 -05:00
|
|
|
"fmt"
|
2022-05-18 15:19:39 -05:00
|
|
|
"net"
|
2021-10-05 04:12:22 -05:00
|
|
|
"net/http"
|
2022-11-02 17:53:08 -05:00
|
|
|
"os"
|
|
|
|
"path"
|
2022-09-09 00:41:13 -05:00
|
|
|
"strconv"
|
2022-08-10 17:28:52 -05:00
|
|
|
"strings"
|
2021-12-28 08:29:30 -05:00
|
|
|
"time"
|
2021-10-05 04:12:22 -05:00
|
|
|
|
2021-11-25 07:04:39 -05:00
|
|
|
glob "github.com/bmatcuk/doublestar/v4"
|
2019-06-20 18:36:40 -05:00
|
|
|
"github.com/mitchellh/mapstructure"
|
2021-05-21 15:47:28 -05:00
|
|
|
distspec "github.com/opencontainers/distribution-spec/specs-go"
|
2019-06-20 18:36:40 -05:00
|
|
|
"github.com/rs/zerolog/log"
|
|
|
|
"github.com/spf13/cobra"
|
|
|
|
"github.com/spf13/viper"
|
2022-10-20 11:39:20 -05:00
|
|
|
|
2021-12-03 22:50:58 -05:00
|
|
|
"zotregistry.io/zot/errors"
|
|
|
|
"zotregistry.io/zot/pkg/api"
|
|
|
|
"zotregistry.io/zot/pkg/api/config"
|
2022-02-24 15:31:36 -05:00
|
|
|
"zotregistry.io/zot/pkg/api/constants"
|
2021-12-28 08:29:30 -05:00
|
|
|
extconf "zotregistry.io/zot/pkg/extensions/config"
|
2022-01-22 09:05:14 -05:00
|
|
|
"zotregistry.io/zot/pkg/extensions/monitoring"
|
2021-12-03 22:50:58 -05:00
|
|
|
"zotregistry.io/zot/pkg/storage"
|
2022-11-02 17:53:08 -05:00
|
|
|
storageConstants "zotregistry.io/zot/pkg/storage/constants"
|
|
|
|
"zotregistry.io/zot/pkg/storage/s3"
|
2019-06-20 18:36:40 -05:00
|
|
|
)
|
|
|
|
|
|
|
|
// metadataConfig reports metadata after parsing, which we use to track
|
2020-05-11 17:13:24 -05:00
|
|
|
// errors.
|
2019-06-20 18:36:40 -05:00
|
|
|
func metadataConfig(md *mapstructure.Metadata) viper.DecoderConfigOption {
|
|
|
|
return func(c *mapstructure.DecoderConfig) {
|
|
|
|
c.Metadata = md
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
func newServeCmd(conf *config.Config) *cobra.Command {
|
2019-10-09 13:50:10 -05:00
|
|
|
// "serve"
|
2019-06-20 18:36:40 -05:00
|
|
|
serveCmd := &cobra.Command{
|
|
|
|
Use: "serve <config>",
|
|
|
|
Aliases: []string{"serve"},
|
|
|
|
Short: "`serve` stores and distributes OCI images",
|
|
|
|
Long: "`serve` stores and distributes OCI images",
|
|
|
|
Run: func(cmd *cobra.Command, args []string) {
|
|
|
|
if len(args) > 0 {
|
2022-02-10 09:17:49 -05:00
|
|
|
if err := LoadConfiguration(conf, args[0]); err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
2021-05-13 13:59:12 -05:00
|
|
|
}
|
2021-12-13 14:23:31 -05:00
|
|
|
|
|
|
|
ctlr := api.NewController(conf)
|
2021-05-13 13:59:12 -05:00
|
|
|
|
2022-03-24 07:49:51 -05:00
|
|
|
// config reloader
|
2022-02-10 09:17:49 -05:00
|
|
|
hotReloader, err := NewHotReloader(ctlr, args[0])
|
2021-05-13 13:59:12 -05:00
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
|
2022-03-24 07:49:51 -05:00
|
|
|
/* context used to cancel go routines so that
|
|
|
|
we can change their config on the fly (restart routines with different config) */
|
|
|
|
reloaderCtx := hotReloader.Start()
|
2019-06-20 18:36:40 -05:00
|
|
|
|
2023-02-10 00:04:52 -05:00
|
|
|
if err := ctlr.Init(reloaderCtx); err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
|
2022-03-24 07:49:51 -05:00
|
|
|
if err := ctlr.Run(reloaderCtx); err != nil {
|
2019-06-20 18:36:40 -05:00
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
return serveCmd
|
|
|
|
}
|
|
|
|
|
|
|
|
func newScrubCmd(conf *config.Config) *cobra.Command {
|
2021-10-05 04:12:22 -05:00
|
|
|
// "scrub"
|
|
|
|
scrubCmd := &cobra.Command{
|
|
|
|
Use: "scrub <config>",
|
|
|
|
Aliases: []string{"scrub"},
|
|
|
|
Short: "`scrub` checks manifest/blob integrity",
|
|
|
|
Long: "`scrub` checks manifest/blob integrity",
|
|
|
|
Run: func(cmd *cobra.Command, args []string) {
|
|
|
|
if len(args) > 0 {
|
2022-02-10 09:17:49 -05:00
|
|
|
if err := LoadConfiguration(conf, args[0]); err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
2021-10-05 04:12:22 -05:00
|
|
|
} else {
|
|
|
|
if err := cmd.Usage(); err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
2021-12-13 14:23:31 -05:00
|
|
|
|
2021-10-05 04:12:22 -05:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// checking if the server is already running
|
2021-12-13 14:23:31 -05:00
|
|
|
req, err := http.NewRequestWithContext(context.Background(),
|
|
|
|
http.MethodGet,
|
2022-05-18 15:19:39 -05:00
|
|
|
fmt.Sprintf("http://%s/v2", net.JoinHostPort(conf.HTTP.Address, conf.HTTP.Port)),
|
2021-12-13 14:23:31 -05:00
|
|
|
nil)
|
|
|
|
if err != nil {
|
|
|
|
log.Error().Err(err).Msg("unable to create a new http request")
|
|
|
|
panic(err)
|
|
|
|
}
|
2021-10-05 04:12:22 -05:00
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
response, err := http.DefaultClient.Do(req)
|
2021-10-05 04:12:22 -05:00
|
|
|
if err == nil {
|
|
|
|
response.Body.Close()
|
2022-03-04 02:37:06 -05:00
|
|
|
log.Warn().Msg("The server is running, in order to perform the scrub command the server should be shut down")
|
2021-10-05 04:12:22 -05:00
|
|
|
panic("Error: server is running")
|
|
|
|
} else {
|
|
|
|
// server is down
|
2021-12-13 14:23:31 -05:00
|
|
|
ctlr := api.NewController(conf)
|
2022-01-22 09:05:14 -05:00
|
|
|
ctlr.Metrics = monitoring.NewMetricsServer(false, ctlr.Log)
|
2021-10-05 04:12:22 -05:00
|
|
|
|
2022-03-24 07:49:51 -05:00
|
|
|
if err := ctlr.InitImageStore(context.Background()); err != nil {
|
2021-10-05 04:12:22 -05:00
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
result, err := ctlr.StoreController.CheckAllBlobsIntegrity()
|
2021-10-05 04:12:22 -05:00
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
result.PrintScrubResults(cmd.OutOrStdout())
|
|
|
|
}
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
return scrubCmd
|
|
|
|
}
|
|
|
|
|
|
|
|
func newVerifyCmd(conf *config.Config) *cobra.Command {
|
|
|
|
// verify
|
2021-05-13 13:59:12 -05:00
|
|
|
verifyCmd := &cobra.Command{
|
|
|
|
Use: "verify <config>",
|
|
|
|
Aliases: []string{"verify"},
|
|
|
|
Short: "`verify` validates a zot config file",
|
|
|
|
Long: "`verify` validates a zot config file",
|
|
|
|
Run: func(cmd *cobra.Command, args []string) {
|
|
|
|
if len(args) > 0 {
|
2022-02-10 09:17:49 -05:00
|
|
|
if err := LoadConfiguration(conf, args[0]); err != nil {
|
2023-02-14 12:16:37 -05:00
|
|
|
log.Error().Msgf("Config file %s is invalid", args[0])
|
2022-02-10 09:17:49 -05:00
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
|
2021-05-13 13:59:12 -05:00
|
|
|
log.Info().Msgf("Config file %s is valid", args[0])
|
|
|
|
}
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
return verifyCmd
|
|
|
|
}
|
2019-12-13 00:53:18 -05:00
|
|
|
|
2022-01-10 20:15:35 -05:00
|
|
|
// "zot" - registry server.
|
|
|
|
func NewServerRootCmd() *cobra.Command {
|
2021-12-13 14:23:31 -05:00
|
|
|
showVersion := false
|
|
|
|
conf := config.New()
|
2019-06-20 18:36:40 -05:00
|
|
|
|
|
|
|
rootCmd := &cobra.Command{
|
|
|
|
Use: "zot",
|
|
|
|
Short: "`zot`",
|
|
|
|
Long: "`zot`",
|
|
|
|
Run: func(cmd *cobra.Command, args []string) {
|
|
|
|
if showVersion {
|
2021-06-08 15:11:18 -05:00
|
|
|
log.Info().Str("distribution-spec", distspec.Version).Str("commit", config.Commit).
|
2021-12-07 15:51:04 -05:00
|
|
|
Str("binary-type", config.BinaryType).Str("go version", config.GoVersion).Msg("version")
|
2022-01-12 10:17:04 -05:00
|
|
|
} else {
|
|
|
|
_ = cmd.Usage()
|
|
|
|
cmd.SilenceErrors = false
|
2019-06-20 18:36:40 -05:00
|
|
|
}
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2022-01-10 20:15:35 -05:00
|
|
|
// "serve"
|
2021-12-13 14:23:31 -05:00
|
|
|
rootCmd.AddCommand(newServeCmd(conf))
|
2022-01-10 20:15:35 -05:00
|
|
|
// "verify"
|
2021-12-13 14:23:31 -05:00
|
|
|
rootCmd.AddCommand(newVerifyCmd(conf))
|
2022-01-10 20:15:35 -05:00
|
|
|
// "scrub"
|
|
|
|
rootCmd.AddCommand(newScrubCmd(conf))
|
|
|
|
// "version"
|
|
|
|
rootCmd.Flags().BoolVarP(&showVersion, "version", "v", false, "show the version and exit")
|
2020-06-16 20:52:40 -05:00
|
|
|
|
2022-01-10 20:15:35 -05:00
|
|
|
return rootCmd
|
|
|
|
}
|
|
|
|
|
|
|
|
// "zli" - client-side cli.
|
|
|
|
func NewCliRootCmd() *cobra.Command {
|
|
|
|
showVersion := false
|
|
|
|
|
|
|
|
rootCmd := &cobra.Command{
|
|
|
|
Use: "zli",
|
|
|
|
Short: "`zli`",
|
|
|
|
Long: "`zli`",
|
|
|
|
Run: func(cmd *cobra.Command, args []string) {
|
|
|
|
if showVersion {
|
|
|
|
log.Info().Str("distribution-spec", distspec.Version).Str("commit", config.Commit).
|
|
|
|
Str("binary-type", config.BinaryType).Str("go version", config.GoVersion).Msg("version")
|
2022-01-12 10:17:04 -05:00
|
|
|
} else {
|
|
|
|
_ = cmd.Usage()
|
|
|
|
cmd.SilenceErrors = false
|
2022-01-10 20:15:35 -05:00
|
|
|
}
|
|
|
|
},
|
|
|
|
}
|
2020-06-16 20:52:40 -05:00
|
|
|
|
2022-01-10 20:15:35 -05:00
|
|
|
// additional cmds
|
|
|
|
enableCli(rootCmd)
|
|
|
|
// "version"
|
2019-06-20 18:36:40 -05:00
|
|
|
rootCmd.Flags().BoolVarP(&showVersion, "version", "v", false, "show the version and exit")
|
|
|
|
|
|
|
|
return rootCmd
|
|
|
|
}
|
2021-05-13 13:59:12 -05:00
|
|
|
|
2022-08-10 17:28:52 -05:00
|
|
|
func validateStorageConfig(cfg *config.Config) error {
|
|
|
|
expConfigMap := make(map[string]config.StorageConfig, 0)
|
|
|
|
|
|
|
|
defaultRootDir := cfg.Storage.RootDirectory
|
|
|
|
|
|
|
|
for _, storageConfig := range cfg.Storage.SubPaths {
|
|
|
|
if strings.EqualFold(defaultRootDir, storageConfig.RootDirectory) {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msg("storage subpaths cannot use default storage root directory")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
expConfig, ok := expConfigMap[storageConfig.RootDirectory]
|
|
|
|
if ok {
|
|
|
|
equal := expConfig.ParamsEqual(storageConfig)
|
|
|
|
if !equal {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msg("storage config with same root directory should have same parameters")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
expConfigMap[storageConfig.RootDirectory] = storageConfig
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-11-22 13:29:57 -05:00
|
|
|
func validateCacheConfig(cfg *config.Config) error {
|
|
|
|
// global
|
|
|
|
// dedupe true, remote storage, remoteCache true, but no cacheDriver (remote)
|
|
|
|
//nolint: lll
|
|
|
|
if cfg.Storage.Dedupe && cfg.Storage.StorageDriver != nil && cfg.Storage.RemoteCache && cfg.Storage.CacheDriver == nil {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msg(
|
|
|
|
"dedupe set to true with remote storage and caching, but no remote cache configured!")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
if cfg.Storage.CacheDriver != nil && cfg.Storage.RemoteCache {
|
|
|
|
// local storage with remote caching
|
|
|
|
if cfg.Storage.StorageDriver == nil {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msg("cannot have local storage driver with remote caching!")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
// unsupported cache driver
|
|
|
|
if cfg.Storage.CacheDriver["name"] != storageConstants.DynamoDBDriverName {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msgf("unsupported cache driver: %s", cfg.Storage.CacheDriver["name"])
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if !cfg.Storage.RemoteCache && cfg.Storage.CacheDriver != nil {
|
|
|
|
log.Warn().Err(errors.ErrBadConfig).Msgf(
|
|
|
|
"remoteCache set to false but cacheDriver config (remote caching) provided for %s,"+
|
|
|
|
"will ignore and use local caching", cfg.Storage.RootDirectory)
|
|
|
|
}
|
|
|
|
|
|
|
|
// subpaths
|
|
|
|
for _, subPath := range cfg.Storage.SubPaths {
|
|
|
|
// dedupe true, remote storage, remoteCache true, but no cacheDriver (remote)
|
|
|
|
//nolint: lll
|
|
|
|
if subPath.Dedupe && subPath.StorageDriver != nil && subPath.RemoteCache && subPath.CacheDriver == nil {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msg("dedupe set to true with remote storage and caching, but no remote cache configured!")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
if subPath.CacheDriver != nil && subPath.RemoteCache {
|
|
|
|
// local storage with remote caching
|
|
|
|
if subPath.StorageDriver == nil {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msg("cannot have local storage driver with remote caching!")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
// unsupported cache driver
|
|
|
|
if subPath.CacheDriver["name"] != storageConstants.DynamoDBDriverName {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msgf("unsupported cache driver: %s", subPath.CacheDriver["name"])
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if !subPath.RemoteCache && subPath.CacheDriver != nil {
|
|
|
|
log.Warn().Err(errors.ErrBadConfig).Msgf(
|
|
|
|
"remoteCache set to false but cacheDriver config (remote caching) provided for %s,"+
|
|
|
|
"will ignore and use local caching", subPath.RootDirectory)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-11-30 02:35:06 -05:00
|
|
|
func validateExtensionsConfig(cfg *config.Config) error {
|
|
|
|
//nolint:lll
|
|
|
|
if cfg.Storage.StorageDriver != nil && cfg.Extensions != nil && cfg.Extensions.Search != nil &&
|
|
|
|
cfg.Extensions.Search.Enable != nil && *cfg.Extensions.Search.Enable && cfg.Extensions.Search.CVE != nil {
|
|
|
|
log.Warn().Err(errors.ErrBadConfig).Msg("CVE functionality can't be used with remote storage. Please disable CVE")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, subPath := range cfg.Storage.SubPaths {
|
|
|
|
//nolint:lll
|
|
|
|
if subPath.StorageDriver != nil && cfg.Extensions != nil && cfg.Extensions.Search != nil &&
|
|
|
|
cfg.Extensions.Search.Enable != nil && *cfg.Extensions.Search.Enable && cfg.Extensions.Search.CVE != nil {
|
|
|
|
log.Warn().Err(errors.ErrBadConfig).Msg("CVE functionality can't be used with remote storage. Please disable CVE")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-02-10 09:17:49 -05:00
|
|
|
func validateConfiguration(config *config.Config) error {
|
2022-09-09 00:41:13 -05:00
|
|
|
if err := validateHTTP(config); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-05-06 05:15:03 -05:00
|
|
|
if err := validateGC(config); err != nil {
|
|
|
|
return err
|
2022-02-09 19:51:35 -05:00
|
|
|
}
|
|
|
|
|
2022-05-06 05:15:03 -05:00
|
|
|
if err := validateLDAP(config); err != nil {
|
|
|
|
return err
|
2022-03-21 13:40:37 -05:00
|
|
|
}
|
|
|
|
|
2022-05-06 05:15:03 -05:00
|
|
|
if err := validateSync(config); err != nil {
|
|
|
|
return err
|
2022-02-09 19:51:35 -05:00
|
|
|
}
|
|
|
|
|
2022-08-10 17:28:52 -05:00
|
|
|
if err := validateStorageConfig(config); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-11-22 13:29:57 -05:00
|
|
|
if err := validateCacheConfig(config); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-11-30 02:35:06 -05:00
|
|
|
if err := validateExtensionsConfig(config); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2021-09-01 04:15:00 -05:00
|
|
|
// check authorization config, it should have basic auth enabled or ldap
|
2023-03-08 14:47:15 -05:00
|
|
|
if config.HTTP.AccessControl != nil {
|
2022-07-14 10:13:46 -05:00
|
|
|
// checking for anonymous policy only authorization config: no users, no policies but anonymous policy
|
|
|
|
if err := validateAuthzPolicies(config); err != nil {
|
|
|
|
return err
|
2021-09-01 04:15:00 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-07-16 22:53:05 -05:00
|
|
|
if len(config.Storage.StorageDriver) != 0 {
|
2021-10-28 04:10:01 -05:00
|
|
|
// enforce s3 driver in case of using storage driver
|
2021-07-16 22:53:05 -05:00
|
|
|
if config.Storage.StorageDriver["name"] != storage.S3StorageDriverName {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msgf("unsupported storage driver: %s", config.Storage.StorageDriver["name"])
|
2022-02-10 09:17:49 -05:00
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
2021-07-16 22:53:05 -05:00
|
|
|
}
|
2021-10-28 04:10:01 -05:00
|
|
|
|
|
|
|
// enforce filesystem storage in case sync feature is enabled
|
|
|
|
if config.Extensions != nil && config.Extensions.Sync != nil {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msg("sync supports only filesystem storage")
|
2022-02-10 09:17:49 -05:00
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
2021-10-28 04:10:01 -05:00
|
|
|
}
|
2021-11-25 07:04:39 -05:00
|
|
|
}
|
|
|
|
|
2021-07-16 22:53:05 -05:00
|
|
|
// enforce s3 driver on subpaths in case of using storage driver
|
|
|
|
if config.Storage.SubPaths != nil {
|
|
|
|
if len(config.Storage.SubPaths) > 0 {
|
|
|
|
subPaths := config.Storage.SubPaths
|
|
|
|
|
|
|
|
for route, storageConfig := range subPaths {
|
|
|
|
if len(storageConfig.StorageDriver) != 0 {
|
|
|
|
if storageConfig.StorageDriver["name"] != storage.S3StorageDriverName {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Str("subpath",
|
|
|
|
route).Msgf("unsupported storage driver: %s", storageConfig.StorageDriver["name"])
|
2022-02-10 09:17:49 -05:00
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
2021-07-16 22:53:05 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-09-10 10:23:26 -05:00
|
|
|
// check glob patterns in authz config are compilable
|
2023-03-08 14:47:15 -05:00
|
|
|
if config.HTTP.AccessControl != nil {
|
|
|
|
for pattern := range config.HTTP.AccessControl.Repositories {
|
2021-09-10 10:23:26 -05:00
|
|
|
ok := glob.ValidatePattern(pattern)
|
|
|
|
if !ok {
|
|
|
|
log.Error().Err(glob.ErrBadPattern).Str("pattern", pattern).Msg("authorization pattern could not be compiled")
|
2022-02-10 09:17:49 -05:00
|
|
|
|
|
|
|
return glob.ErrBadPattern
|
2021-09-10 10:23:26 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2022-02-10 09:17:49 -05:00
|
|
|
|
|
|
|
return nil
|
2021-09-10 10:23:26 -05:00
|
|
|
}
|
|
|
|
|
2022-07-14 10:13:46 -05:00
|
|
|
func validateAuthzPolicies(config *config.Config) error {
|
|
|
|
if (config.HTTP.Auth == nil || (config.HTTP.Auth.HTPasswd.Path == "" && config.HTTP.Auth.LDAP == nil)) &&
|
|
|
|
!authzContainsOnlyAnonymousPolicy(config) {
|
2022-03-10 07:25:15 -05:00
|
|
|
log.Error().Err(errors.ErrBadConfig).
|
|
|
|
Msg("access control config requires httpasswd, ldap authentication " +
|
2022-07-14 10:13:46 -05:00
|
|
|
"or using only 'anonymousPolicy' policies")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
2022-03-10 07:25:15 -05:00
|
|
|
}
|
2022-07-14 10:13:46 -05:00
|
|
|
|
|
|
|
return nil
|
2022-03-10 07:25:15 -05:00
|
|
|
}
|
|
|
|
|
2022-11-02 17:53:08 -05:00
|
|
|
//nolint:gocyclo
|
2021-12-28 08:29:30 -05:00
|
|
|
func applyDefaultValues(config *config.Config, viperInstance *viper.Viper) {
|
|
|
|
defaultVal := true
|
|
|
|
|
|
|
|
if config.Extensions == nil && viperInstance.Get("extensions") != nil {
|
|
|
|
config.Extensions = &extconf.ExtensionConfig{}
|
|
|
|
|
|
|
|
extMap := viperInstance.GetStringMap("extensions")
|
|
|
|
_, ok := extMap["metrics"]
|
|
|
|
|
|
|
|
if ok {
|
|
|
|
// we found a config like `"extensions": {"metrics": {}}`
|
|
|
|
// Note: In case metrics is not empty the config.Extensions will not be nil and we will not reach here
|
|
|
|
config.Extensions.Metrics = &extconf.MetricsConfig{}
|
|
|
|
}
|
|
|
|
|
|
|
|
_, ok = extMap["search"]
|
|
|
|
if ok {
|
|
|
|
// we found a config like `"extensions": {"search": {}}`
|
|
|
|
// Note: In case search is not empty the config.Extensions will not be nil and we will not reach here
|
|
|
|
config.Extensions.Search = &extconf.SearchConfig{}
|
|
|
|
}
|
2022-09-27 20:06:50 -05:00
|
|
|
|
|
|
|
_, ok = extMap["scrub"]
|
|
|
|
if ok {
|
|
|
|
// we found a config like `"extensions": {"scrub:": {}}`
|
|
|
|
// Note: In case scrub is not empty the config.Extensions will not be nil and we will not reach here
|
|
|
|
config.Extensions.Scrub = &extconf.ScrubConfig{}
|
|
|
|
}
|
2023-03-09 13:43:26 -05:00
|
|
|
|
|
|
|
_, ok = extMap["mgmt"]
|
|
|
|
if ok {
|
|
|
|
// we found a config like `"extensions": {"mgmt:": {}}`
|
|
|
|
// Note: In case mgmt is not empty the config.Extensions will not be nil and we will not reach here
|
|
|
|
config.Extensions.Mgmt = &extconf.MgmtConfig{}
|
|
|
|
}
|
2021-12-28 08:29:30 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
if config.Extensions != nil {
|
|
|
|
if config.Extensions.Sync != nil {
|
|
|
|
if config.Extensions.Sync.Enable == nil {
|
|
|
|
config.Extensions.Sync.Enable = &defaultVal
|
|
|
|
}
|
|
|
|
|
|
|
|
for id, regCfg := range config.Extensions.Sync.Registries {
|
|
|
|
if regCfg.TLSVerify == nil {
|
|
|
|
config.Extensions.Sync.Registries[id].TLSVerify = &defaultVal
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if config.Extensions.Search != nil {
|
|
|
|
if config.Extensions.Search.Enable == nil {
|
|
|
|
config.Extensions.Search.Enable = &defaultVal
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if config.Extensions.Metrics != nil {
|
|
|
|
if config.Extensions.Metrics.Enable == nil {
|
|
|
|
config.Extensions.Metrics.Enable = &defaultVal
|
|
|
|
}
|
|
|
|
|
|
|
|
if config.Extensions.Metrics.Prometheus == nil {
|
2022-02-24 15:31:36 -05:00
|
|
|
config.Extensions.Metrics.Prometheus = &extconf.PrometheusConfig{Path: constants.DefaultMetricsExtensionRoute}
|
2021-12-28 08:29:30 -05:00
|
|
|
}
|
|
|
|
}
|
2022-09-27 20:06:50 -05:00
|
|
|
|
2023-03-09 13:43:26 -05:00
|
|
|
if config.Extensions.Mgmt != nil {
|
|
|
|
if config.Extensions.Mgmt.Enable == nil {
|
|
|
|
config.Extensions.Mgmt.Enable = &defaultVal
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-09-27 20:06:50 -05:00
|
|
|
if config.Extensions.Scrub != nil {
|
|
|
|
if config.Extensions.Scrub.Enable == nil {
|
|
|
|
config.Extensions.Scrub.Enable = &defaultVal
|
|
|
|
}
|
|
|
|
|
|
|
|
if config.Extensions.Scrub.Interval == 0 {
|
2022-10-05 05:21:14 -05:00
|
|
|
config.Extensions.Scrub.Interval = 24 * time.Hour //nolint: gomnd
|
2022-09-27 20:06:50 -05:00
|
|
|
}
|
|
|
|
}
|
2021-12-28 08:29:30 -05:00
|
|
|
}
|
2022-03-07 07:50:15 -05:00
|
|
|
|
2022-03-30 08:02:03 -05:00
|
|
|
if !config.Storage.GC && viperInstance.Get("storage::gcdelay") == nil {
|
|
|
|
config.Storage.GCDelay = 0
|
|
|
|
}
|
2022-11-02 17:53:08 -05:00
|
|
|
|
2023-02-14 12:16:37 -05:00
|
|
|
// cache settings
|
2022-11-02 17:53:08 -05:00
|
|
|
|
|
|
|
// global storage
|
|
|
|
|
|
|
|
// if dedupe is true but remoteCache bool not set in config file
|
|
|
|
// for cloud based storage, remoteCache defaults to true
|
|
|
|
if config.Storage.Dedupe && !viperInstance.IsSet("storage::remotecache") && config.Storage.StorageDriver != nil {
|
|
|
|
config.Storage.RemoteCache = true
|
|
|
|
}
|
|
|
|
|
|
|
|
// s3 dedup=false, check for previous dedup usage and set to true if cachedb found
|
|
|
|
if !config.Storage.Dedupe && config.Storage.StorageDriver != nil {
|
|
|
|
cacheDir, _ := config.Storage.StorageDriver["rootdirectory"].(string)
|
|
|
|
cachePath := path.Join(cacheDir, s3.CacheDBName+storageConstants.DBExtensionName)
|
|
|
|
|
|
|
|
if _, err := os.Stat(cachePath); err == nil {
|
|
|
|
log.Info().Msg("Config: dedupe set to false for s3 driver but used to be true.")
|
|
|
|
log.Info().Str("cache path", cachePath).Msg("found cache database")
|
|
|
|
|
|
|
|
config.Storage.RemoteCache = false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// subpaths
|
|
|
|
for name, storageConfig := range config.Storage.SubPaths {
|
|
|
|
// if dedupe is true but remoteCache bool not set in config file
|
|
|
|
// for cloud based storage, remoteCache defaults to true
|
|
|
|
if storageConfig.Dedupe && !viperInstance.IsSet("storage::subpaths::"+name+"::remotecache") && storageConfig.StorageDriver != nil { //nolint:lll
|
|
|
|
storageConfig.RemoteCache = true
|
|
|
|
}
|
|
|
|
|
|
|
|
// s3 dedup=false, check for previous dedup usage and set to true if cachedb found
|
|
|
|
if !storageConfig.Dedupe && storageConfig.StorageDriver != nil {
|
|
|
|
subpathCacheDir, _ := storageConfig.StorageDriver["rootdirectory"].(string)
|
|
|
|
subpathCachePath := path.Join(subpathCacheDir, s3.CacheDBName+storageConstants.DBExtensionName)
|
|
|
|
|
|
|
|
if _, err := os.Stat(subpathCachePath); err == nil {
|
|
|
|
log.Info().Msg("Config: dedupe set to false for s3 driver but used to be true. ")
|
|
|
|
log.Info().Str("cache path", subpathCachePath).Msg("found cache database")
|
|
|
|
|
|
|
|
storageConfig.RemoteCache = false
|
|
|
|
}
|
|
|
|
}
|
2023-02-14 12:16:37 -05:00
|
|
|
|
|
|
|
// if gc is enabled and gcDelay is not set, it is set to default value
|
|
|
|
if storageConfig.GC && !viperInstance.IsSet("storage::subpaths::"+name+"::gcdelay") {
|
|
|
|
storageConfig.GCDelay = storage.DefaultGCDelay
|
|
|
|
config.Storage.SubPaths[name] = storageConfig
|
|
|
|
}
|
2022-11-02 17:53:08 -05:00
|
|
|
}
|
2022-03-30 08:02:03 -05:00
|
|
|
}
|
2022-03-07 07:50:15 -05:00
|
|
|
|
2022-03-30 08:02:03 -05:00
|
|
|
func updateDistSpecVersion(config *config.Config) {
|
|
|
|
if config.DistSpecVersion == distspec.Version {
|
|
|
|
return
|
|
|
|
}
|
2022-03-07 07:50:15 -05:00
|
|
|
|
2022-03-30 08:02:03 -05:00
|
|
|
log.Warn().
|
|
|
|
Msgf("config dist-spec version: %s differs from version actually used: %s",
|
|
|
|
config.DistSpecVersion, distspec.Version)
|
2022-03-07 07:50:15 -05:00
|
|
|
|
2022-03-30 08:02:03 -05:00
|
|
|
config.DistSpecVersion = distspec.Version
|
2021-12-28 08:29:30 -05:00
|
|
|
}
|
|
|
|
|
2022-02-10 09:17:49 -05:00
|
|
|
func LoadConfiguration(config *config.Config, configPath string) error {
|
2021-09-10 10:23:26 -05:00
|
|
|
// Default is dot (.) but because we allow glob patterns in authz
|
|
|
|
// we need another key delimiter.
|
|
|
|
viperInstance := viper.NewWithOptions(viper.KeyDelimiter("::"))
|
|
|
|
|
|
|
|
viperInstance.SetConfigFile(configPath)
|
|
|
|
|
|
|
|
if err := viperInstance.ReadInConfig(); err != nil {
|
|
|
|
log.Error().Err(err).Msg("error while reading configuration")
|
2022-02-10 09:17:49 -05:00
|
|
|
|
|
|
|
return err
|
2021-09-10 10:23:26 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
metaData := &mapstructure.Metadata{}
|
|
|
|
if err := viperInstance.Unmarshal(&config, metadataConfig(metaData)); err != nil {
|
|
|
|
log.Error().Err(err).Msg("error while unmarshalling new config")
|
2022-02-10 09:17:49 -05:00
|
|
|
|
|
|
|
return err
|
2021-09-10 10:23:26 -05:00
|
|
|
}
|
|
|
|
|
2022-05-06 05:15:03 -05:00
|
|
|
if len(metaData.Keys) == 0 {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msgf("config doesn't contain any key:value pair")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(metaData.Unused) > 0 {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msgf("unknown keys: %v", metaData.Unused)
|
2022-02-10 09:17:49 -05:00
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
2021-09-10 10:23:26 -05:00
|
|
|
}
|
|
|
|
|
2021-06-08 15:11:18 -05:00
|
|
|
// defaults
|
2021-12-28 08:29:30 -05:00
|
|
|
applyDefaultValues(config, viperInstance)
|
2021-06-08 15:11:18 -05:00
|
|
|
|
2021-12-28 08:29:30 -05:00
|
|
|
// various config checks
|
2022-02-10 09:17:49 -05:00
|
|
|
if err := validateConfiguration(config); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-03-30 08:02:03 -05:00
|
|
|
// update distSpecVersion
|
|
|
|
updateDistSpecVersion(config)
|
|
|
|
|
2022-02-10 09:17:49 -05:00
|
|
|
return nil
|
2021-05-13 13:59:12 -05:00
|
|
|
}
|
2022-03-10 07:25:15 -05:00
|
|
|
|
2022-07-14 10:13:46 -05:00
|
|
|
func authzContainsOnlyAnonymousPolicy(cfg *config.Config) bool {
|
2023-03-08 14:47:15 -05:00
|
|
|
adminPolicy := cfg.HTTP.AccessControl.AdminPolicy
|
2022-07-14 10:13:46 -05:00
|
|
|
anonymousPolicyPresent := false
|
2022-03-10 07:25:15 -05:00
|
|
|
|
2022-07-14 10:13:46 -05:00
|
|
|
log.Info().Msg("checking if anonymous authorization is the only type of authorization policy configured")
|
2022-03-10 07:25:15 -05:00
|
|
|
|
|
|
|
if len(adminPolicy.Actions)+len(adminPolicy.Users) > 0 {
|
2022-07-14 10:13:46 -05:00
|
|
|
log.Info().Msg("admin policy detected, anonymous authorization is not the only authorization policy configured")
|
2022-03-10 07:25:15 -05:00
|
|
|
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2023-03-08 14:47:15 -05:00
|
|
|
for _, repository := range cfg.HTTP.AccessControl.Repositories {
|
2022-07-14 10:13:46 -05:00
|
|
|
if len(repository.DefaultPolicy) > 0 {
|
|
|
|
log.Info().Interface("repository", repository).
|
|
|
|
Msg("default policy detected, anonymous authorization is not the only authorization policy configured")
|
|
|
|
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(repository.AnonymousPolicy) > 0 {
|
|
|
|
log.Info().Msg("anonymous authorization detected")
|
|
|
|
|
|
|
|
anonymousPolicyPresent = true
|
|
|
|
}
|
|
|
|
|
2022-03-10 07:25:15 -05:00
|
|
|
for _, policy := range repository.Policies {
|
|
|
|
if len(policy.Actions)+len(policy.Users) > 0 {
|
|
|
|
log.Info().Interface("repository", repository).
|
2022-07-14 10:13:46 -05:00
|
|
|
Msg("repository with non-empty policy detected, " +
|
|
|
|
"anonymous authorization is not the only authorization policy configured")
|
2022-03-10 07:25:15 -05:00
|
|
|
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-07-14 10:13:46 -05:00
|
|
|
return anonymousPolicyPresent
|
2022-03-10 07:25:15 -05:00
|
|
|
}
|
2022-05-06 05:15:03 -05:00
|
|
|
|
|
|
|
func validateLDAP(config *config.Config) error {
|
|
|
|
// LDAP mandatory configuration
|
|
|
|
if config.HTTP.Auth != nil && config.HTTP.Auth.LDAP != nil {
|
|
|
|
ldap := config.HTTP.Auth.LDAP
|
|
|
|
if ldap.UserAttribute == "" {
|
|
|
|
log.Error().Str("userAttribute", ldap.UserAttribute).
|
|
|
|
Msg("invalid LDAP configuration, missing mandatory key: userAttribute")
|
|
|
|
|
|
|
|
return errors.ErrLDAPConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
if ldap.Address == "" {
|
|
|
|
log.Error().Str("address", ldap.Address).
|
|
|
|
Msg("invalid LDAP configuration, missing mandatory key: address")
|
|
|
|
|
|
|
|
return errors.ErrLDAPConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
if ldap.BaseDN == "" {
|
|
|
|
log.Error().Str("basedn", ldap.BaseDN).
|
|
|
|
Msg("invalid LDAP configuration, missing mandatory key: basedn")
|
|
|
|
|
|
|
|
return errors.ErrLDAPConfig
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-09-09 00:41:13 -05:00
|
|
|
func validateHTTP(config *config.Config) error {
|
|
|
|
if config.HTTP.Port != "" {
|
|
|
|
port, err := strconv.ParseInt(config.HTTP.Port, 10, 64)
|
|
|
|
if err != nil || (port < 0 || port > 65535) {
|
|
|
|
log.Error().Str("port", config.HTTP.Port).Msg("invalid port")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
fmt.Printf("HTTP port %d\n", port)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-05-06 05:15:03 -05:00
|
|
|
func validateGC(config *config.Config) error {
|
|
|
|
// enforce GC params
|
|
|
|
if config.Storage.GCDelay < 0 {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).
|
|
|
|
Msgf("invalid garbage-collect delay %v specified", config.Storage.GCDelay)
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
if config.Storage.GCInterval < 0 {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).
|
|
|
|
Msgf("invalid garbage-collect interval %v specified", config.Storage.GCInterval)
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
if !config.Storage.GC {
|
|
|
|
if config.Storage.GCDelay != 0 {
|
|
|
|
log.Warn().Err(errors.ErrBadConfig).
|
|
|
|
Msg("garbage-collect delay specified without enabling garbage-collect, will be ignored")
|
|
|
|
}
|
|
|
|
|
|
|
|
if config.Storage.GCInterval != 0 {
|
|
|
|
log.Warn().Err(errors.ErrBadConfig).
|
|
|
|
Msg("periodic garbage-collect interval specified without enabling garbage-collect, will be ignored")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-02-14 12:16:37 -05:00
|
|
|
// subpaths
|
|
|
|
for name, subPath := range config.Storage.SubPaths {
|
|
|
|
if subPath.GC && subPath.GCDelay <= 0 {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).
|
|
|
|
Str("subPath", name).
|
|
|
|
Interface("gcDelay", subPath.GCDelay).
|
|
|
|
Msg("invalid GC delay configuration - cannot be negative or zero")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-06 05:15:03 -05:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func validateSync(config *config.Config) error {
|
|
|
|
// check glob patterns in sync config are compilable
|
|
|
|
if config.Extensions != nil && config.Extensions.Sync != nil {
|
|
|
|
for id, regCfg := range config.Extensions.Sync.Registries {
|
|
|
|
// check retry options are configured for sync
|
|
|
|
if regCfg.MaxRetries != nil && regCfg.RetryDelay == nil {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).Msgf("extensions.sync.registries[%d].retryDelay"+
|
|
|
|
" is required when using extensions.sync.registries[%d].maxRetries", id, id)
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
if regCfg.Content != nil {
|
|
|
|
for _, content := range regCfg.Content {
|
|
|
|
ok := glob.ValidatePattern(content.Prefix)
|
|
|
|
if !ok {
|
2022-10-05 13:03:24 -05:00
|
|
|
log.Error().Err(glob.ErrBadPattern).Str("prefix", content.Prefix).Msg("sync prefix could not be compiled")
|
2022-05-06 05:15:03 -05:00
|
|
|
|
|
|
|
return glob.ErrBadPattern
|
|
|
|
}
|
2022-10-05 13:03:24 -05:00
|
|
|
|
|
|
|
if content.StripPrefix && !strings.Contains(content.Prefix, "/*") && content.Destination == "/" {
|
|
|
|
log.Error().Err(errors.ErrBadConfig).
|
|
|
|
Interface("sync content", content).
|
|
|
|
Msg("sync config: can not use stripPrefix true and destination '/' without using glob patterns in prefix")
|
|
|
|
|
|
|
|
return errors.ErrBadConfig
|
|
|
|
}
|
2022-05-06 05:15:03 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|