mirror of
https://github.com/kubernetes-sigs/kustomize.git
synced 2026-06-11 17:12:51 +00:00
refactor network name in kyaml container
This commit is contained in:
@@ -161,15 +161,10 @@ func (c *Filter) getCommand() (string, []string) {
|
||||
// run the container using docker. this is simpler than using the docker
|
||||
// libraries, and ensures things like auth work the same as if the container
|
||||
// was run from the cli.
|
||||
|
||||
network := "none"
|
||||
if c.Network.Name != "" {
|
||||
network = c.Network.Name
|
||||
}
|
||||
args := []string{"run",
|
||||
"--rm", // delete the container afterward
|
||||
"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR", // attach stdin, stdout, stderr
|
||||
"--network", network,
|
||||
"--network", c.ContainerSpec.Network.Name.String(),
|
||||
|
||||
// added security options
|
||||
"--user", c.User.String(),
|
||||
@@ -198,3 +193,19 @@ func (c *Filter) getCommand() (string, []string) {
|
||||
a := append(args, c.Image)
|
||||
return "docker", a
|
||||
}
|
||||
|
||||
// NewContainer returns a new container instance
|
||||
func NewContainer(spec runtimeutil.ContainerSpec) Filter {
|
||||
f := Filter{ContainerSpec: spec}
|
||||
// default user is nobody
|
||||
if f.ContainerSpec.User.IsEmpty() {
|
||||
f.ContainerSpec.User = runtimeutil.UserNobody
|
||||
}
|
||||
|
||||
// default network name is none
|
||||
if f.ContainerSpec.Network.Name.IsEmpty() {
|
||||
f.ContainerSpec.Network.Name = runtimeutil.NetworkNameNone
|
||||
}
|
||||
|
||||
return f
|
||||
}
|
||||
|
||||
@@ -38,12 +38,12 @@ metadata:
|
||||
"--user", "nobody",
|
||||
"--security-opt=no-new-privileges",
|
||||
},
|
||||
instance: Filter{
|
||||
ContainerSpec: runtimeutil.ContainerSpec{
|
||||
instance: NewContainer(
|
||||
runtimeutil.ContainerSpec{
|
||||
Image: "example.com:version",
|
||||
User: "nobody",
|
||||
},
|
||||
},
|
||||
),
|
||||
},
|
||||
|
||||
{
|
||||
@@ -61,15 +61,15 @@ metadata:
|
||||
"--user", "nobody",
|
||||
"--security-opt=no-new-privileges",
|
||||
},
|
||||
instance: Filter{
|
||||
ContainerSpec: runtimeutil.ContainerSpec{
|
||||
instance: NewContainer(
|
||||
runtimeutil.ContainerSpec{
|
||||
Image: "example.com:version",
|
||||
Network: runtimeutil.ContainerNetwork{
|
||||
Name: "test-1",
|
||||
},
|
||||
User: "nobody",
|
||||
},
|
||||
},
|
||||
),
|
||||
},
|
||||
|
||||
{
|
||||
@@ -91,8 +91,8 @@ metadata:
|
||||
"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "volume", "myvol", "/local/"),
|
||||
"--mount", fmt.Sprintf("type=%s,source=%s,target=%s,readonly", "tmpfs", "", "/local/"),
|
||||
},
|
||||
instance: Filter{
|
||||
ContainerSpec: runtimeutil.ContainerSpec{
|
||||
instance: NewContainer(
|
||||
runtimeutil.ContainerSpec{
|
||||
Image: "example.com:version",
|
||||
StorageMounts: []runtimeutil.StorageMount{
|
||||
{MountType: "bind", Src: "/mount/path", DstPath: "/local/"},
|
||||
@@ -102,7 +102,7 @@ metadata:
|
||||
},
|
||||
User: "nobody",
|
||||
},
|
||||
},
|
||||
),
|
||||
},
|
||||
{
|
||||
name: "root user",
|
||||
@@ -119,12 +119,12 @@ metadata:
|
||||
"--user", "root",
|
||||
"--security-opt=no-new-privileges",
|
||||
},
|
||||
instance: Filter{
|
||||
ContainerSpec: runtimeutil.ContainerSpec{
|
||||
instance: NewContainer(
|
||||
runtimeutil.ContainerSpec{
|
||||
Image: "example.com:version",
|
||||
User: "root",
|
||||
},
|
||||
},
|
||||
),
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@@ -33,6 +33,26 @@ const (
|
||||
UserNobody ContainerUser = "nobody"
|
||||
)
|
||||
|
||||
// ContainerNetworkName is a type for network name used in container
|
||||
type ContainerNetworkName string
|
||||
|
||||
func (n *ContainerNetworkName) String() string {
|
||||
return string(*n)
|
||||
}
|
||||
|
||||
func (n *ContainerNetworkName) IsEmpty() bool {
|
||||
return string(*n) == ""
|
||||
}
|
||||
|
||||
func (n *ContainerNetworkName) Set(s string) {
|
||||
*n = ContainerNetworkName(s)
|
||||
}
|
||||
|
||||
const (
|
||||
NetworkNameNone ContainerNetworkName = "none"
|
||||
NetworkNameEmpty ContainerNetworkName = ""
|
||||
)
|
||||
|
||||
// FunctionSpec defines a spec for running a function
|
||||
type FunctionSpec struct {
|
||||
DeferFailure bool `json:"deferFailure,omitempty" yaml:"deferFailure,omitempty"`
|
||||
@@ -75,7 +95,7 @@ type ContainerNetwork struct {
|
||||
Required bool `json:"required,omitempty" yaml:"required,omitempty"`
|
||||
|
||||
// Name is the name of the network to use from a container
|
||||
Name string `json:"name,omitempty" yaml:"name,omitempty"`
|
||||
Name ContainerNetworkName `json:"name,omitempty" yaml:"name,omitempty"`
|
||||
}
|
||||
|
||||
// StarlarkSpec defines how to run a function as a starlark program
|
||||
@@ -128,7 +148,7 @@ func GetFunctionSpec(n *yaml.RNode) *FunctionSpec {
|
||||
}
|
||||
|
||||
if fn := getFunctionSpecFromAnnotation(n, meta); fn != nil {
|
||||
fn.Container.Network.Name = ""
|
||||
fn.Container.Network.Name = NetworkNameEmpty
|
||||
fn.StorageMounts = []StorageMount{}
|
||||
return fn
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user