refactor network name in kyaml container

This commit is contained in:
Donny Xia
2020-08-24 11:40:57 -07:00
parent a2e080bf6c
commit fa15242719
5 changed files with 63 additions and 35 deletions

View File

@@ -161,15 +161,10 @@ func (c *Filter) getCommand() (string, []string) {
// run the container using docker. this is simpler than using the docker
// libraries, and ensures things like auth work the same as if the container
// was run from the cli.
network := "none"
if c.Network.Name != "" {
network = c.Network.Name
}
args := []string{"run",
"--rm", // delete the container afterward
"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR", // attach stdin, stdout, stderr
"--network", network,
"--network", c.ContainerSpec.Network.Name.String(),
// added security options
"--user", c.User.String(),
@@ -198,3 +193,19 @@ func (c *Filter) getCommand() (string, []string) {
a := append(args, c.Image)
return "docker", a
}
// NewContainer returns a new container instance
func NewContainer(spec runtimeutil.ContainerSpec) Filter {
f := Filter{ContainerSpec: spec}
// default user is nobody
if f.ContainerSpec.User.IsEmpty() {
f.ContainerSpec.User = runtimeutil.UserNobody
}
// default network name is none
if f.ContainerSpec.Network.Name.IsEmpty() {
f.ContainerSpec.Network.Name = runtimeutil.NetworkNameNone
}
return f
}

View File

@@ -38,12 +38,12 @@ metadata:
"--user", "nobody",
"--security-opt=no-new-privileges",
},
instance: Filter{
ContainerSpec: runtimeutil.ContainerSpec{
instance: NewContainer(
runtimeutil.ContainerSpec{
Image: "example.com:version",
User: "nobody",
},
},
),
},
{
@@ -61,15 +61,15 @@ metadata:
"--user", "nobody",
"--security-opt=no-new-privileges",
},
instance: Filter{
ContainerSpec: runtimeutil.ContainerSpec{
instance: NewContainer(
runtimeutil.ContainerSpec{
Image: "example.com:version",
Network: runtimeutil.ContainerNetwork{
Name: "test-1",
},
User: "nobody",
},
},
),
},
{
@@ -91,8 +91,8 @@ metadata:
"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "volume", "myvol", "/local/"),
"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "tmpfs", "", "/local/"),
},
instance: Filter{
ContainerSpec: runtimeutil.ContainerSpec{
instance: NewContainer(
runtimeutil.ContainerSpec{
Image: "example.com:version",
StorageMounts: []runtimeutil.StorageMount{
{MountType: "bind", Src: "/mount/path", DstPath: "/local/"},
@@ -102,7 +102,7 @@ metadata:
},
User: "nobody",
},
},
),
},
{
name: "root user",
@@ -119,12 +119,12 @@ metadata:
"--user", "root",
"--security-opt=no-new-privileges",
},
instance: Filter{
ContainerSpec: runtimeutil.ContainerSpec{
instance: NewContainer(
runtimeutil.ContainerSpec{
Image: "example.com:version",
User: "root",
},
},
),
},
}

View File

@@ -33,6 +33,26 @@ const (
UserNobody ContainerUser = "nobody"
)
// ContainerNetworkName is a type for network name used in container
type ContainerNetworkName string
func (n *ContainerNetworkName) String() string {
return string(*n)
}
func (n *ContainerNetworkName) IsEmpty() bool {
return string(*n) == ""
}
func (n *ContainerNetworkName) Set(s string) {
*n = ContainerNetworkName(s)
}
const (
NetworkNameNone ContainerNetworkName = "none"
NetworkNameEmpty ContainerNetworkName = ""
)
// FunctionSpec defines a spec for running a function
type FunctionSpec struct {
DeferFailure bool `json:"deferFailure,omitempty" yaml:"deferFailure,omitempty"`
@@ -75,7 +95,7 @@ type ContainerNetwork struct {
Required bool `json:"required,omitempty" yaml:"required,omitempty"`
// Name is the name of the network to use from a container
Name string `json:"name,omitempty" yaml:"name,omitempty"`
Name ContainerNetworkName `json:"name,omitempty" yaml:"name,omitempty"`
}
// StarlarkSpec defines how to run a function as a starlark program
@@ -128,7 +148,7 @@ func GetFunctionSpec(n *yaml.RNode) *FunctionSpec {
}
if fn := getFunctionSpecFromAnnotation(n, meta); fn != nil {
fn.Container.Network.Name = ""
fn.Container.Network.Name = NetworkNameEmpty
fn.StorageMounts = []StorageMount{}
return fn
}