Skip to content

Commit 9be6877

Browse files
adambkaplanadambkaplan
committed
build: add ConfigMap build sources
RFE/bug 1540978
1 parent 0d0ebdf commit 9be6877

23 files changed

+844
-129
lines changed

‎pkg/build/apis/build/validation/validation.go

+20
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,7 @@ func validateSource(input *buildapi.BuildSource, isCustomStrategy, isDockerStrat
218218
}
219219

220220
allErrs = append(allErrs, validateSecrets(input.Secrets, isDockerStrategy, fldPath.Child("secrets"))...)
221+
allErrs = append(allErrs, validateConfigMaps(input.ConfigMaps, isDockerStrategy, fldPath.Child("configMaps"))...)
221222

222223
allErrs = append(allErrs, validateSecretRef(input.SourceSecret, fldPath.Child("sourceSecret"))...)
223224

@@ -275,6 +276,25 @@ func validateGitSource(git *buildapi.GitBuildSource, fldPath *field.Path) field.
275276
return allErrs
276277
}
277278

279+
func validateConfigMaps(configs []buildapi.ConfigMapBuildSource, isDockerStrategy bool, fldPath *field.Path) field.ErrorList {
280+
allErrs := field.ErrorList{}
281+
for i, c := range configs {
282+
if len(c.ConfigMap.Name) == 0 {
283+
allErrs = append(allErrs, field.Required(fldPath.Index(i).Child("configMap"), ""))
284+
}
285+
if reasons := validation.ValidateConfigMapName(c.ConfigMap.Name, false); len(reasons) != 0 {
286+
allErrs = append(allErrs, field.Invalid(fldPath.Index(i).Child("configMap"), c, "must be valid configMap name"))
287+
}
288+
if strings.HasPrefix(path.Clean(c.DestinationDir), "..") {
289+
allErrs = append(allErrs, field.Invalid(fldPath.Index(i).Child("destinationDir"), c.DestinationDir, "destination dir cannot start with '..'"))
290+
}
291+
if isDockerStrategy && filepath.IsAbs(c.DestinationDir) {
292+
allErrs = append(allErrs, field.Invalid(fldPath.Index(i).Child("destinationDir"), c.DestinationDir, "for the docker strategy the destinationDir has to be relative path"))
293+
}
294+
}
295+
return allErrs
296+
}
297+
278298
func validateSecrets(secrets []buildapi.SecretBuildSource, isDockerStrategy bool, fldPath *field.Path) field.ErrorList {
279299
allErrs := field.ErrorList{}
280300
for i, s := range secrets {

‎pkg/build/apis/build/validation/validation_test.go

+129-6
Original file line numberDiff line numberDiff line change
@@ -820,11 +820,14 @@ func TestValidateSource(t *testing.T) {
820820
dockerfile := "FROM something"
821821
invalidProxyAddress := "some!@#$%^&*()url"
822822
errorCases := []struct {
823-
t field.ErrorType
824-
path string
825-
source *buildapi.BuildSource
826-
ok bool
827-
multiple bool
823+
t field.ErrorType
824+
path string
825+
source *buildapi.BuildSource
826+
ok bool
827+
multiple bool
828+
customStrategy bool
829+
dockerStrategy bool
830+
jenkinsStrategy bool
828831
}{
829832
// 0
830833
{
@@ -1189,10 +1192,130 @@ func TestValidateSource(t *testing.T) {
11891192
},
11901193
},
11911194
},
1195+
// 25 - invalid configMap name
1196+
{
1197+
t: field.ErrorTypeInvalid,
1198+
path: "configMaps[0].configMap",
1199+
source: &buildapi.BuildSource{
1200+
ConfigMaps: []buildapi.ConfigMapBuildSource{
1201+
{
1202+
ConfigMap: kapi.LocalObjectReference{
1203+
Name: "A@ba!dn#me",
1204+
},
1205+
DestinationDir: "./some/relative/path",
1206+
},
1207+
},
1208+
},
1209+
},
1210+
// 26 - invalid relative path
1211+
{
1212+
t: field.ErrorTypeInvalid,
1213+
path: "configMaps[0].destinationDir",
1214+
source: &buildapi.BuildSource{
1215+
ConfigMaps: []buildapi.ConfigMapBuildSource{
1216+
{
1217+
ConfigMap: kapi.LocalObjectReference{
1218+
Name: "good-secret-name",
1219+
},
1220+
DestinationDir: "../bad/parent/path",
1221+
},
1222+
},
1223+
},
1224+
},
1225+
// 27 - invalid abs path with Docker strategy
1226+
{
1227+
t: field.ErrorTypeInvalid,
1228+
path: "configMaps[0].destinationDir",
1229+
dockerStrategy: true,
1230+
source: &buildapi.BuildSource{
1231+
ConfigMaps: []buildapi.ConfigMapBuildSource{
1232+
{
1233+
ConfigMap: kapi.LocalObjectReference{
1234+
Name: "good-secret-name",
1235+
},
1236+
DestinationDir: "/var/log/something",
1237+
},
1238+
},
1239+
},
1240+
},
1241+
// 28 - ok abs path without Docker strategy
1242+
{
1243+
ok: true,
1244+
source: &buildapi.BuildSource{
1245+
ConfigMaps: []buildapi.ConfigMapBuildSource{
1246+
{
1247+
ConfigMap: kapi.LocalObjectReference{
1248+
Name: "good-secret-name",
1249+
},
1250+
DestinationDir: "/var/log/something",
1251+
},
1252+
},
1253+
},
1254+
},
1255+
// 29 - invalid secret name
1256+
{
1257+
t: field.ErrorTypeInvalid,
1258+
path: "secrets[0].secret",
1259+
source: &buildapi.BuildSource{
1260+
Secrets: []buildapi.SecretBuildSource{
1261+
{
1262+
Secret: kapi.LocalObjectReference{
1263+
Name: "A@ba!dn#me",
1264+
},
1265+
DestinationDir: "./some/relative/path",
1266+
},
1267+
},
1268+
},
1269+
},
1270+
// 30 - invalid secret relative path
1271+
{
1272+
t: field.ErrorTypeInvalid,
1273+
path: "secrets[0].destinationDir",
1274+
source: &buildapi.BuildSource{
1275+
Secrets: []buildapi.SecretBuildSource{
1276+
{
1277+
Secret: kapi.LocalObjectReference{
1278+
Name: "good-secret-name",
1279+
},
1280+
DestinationDir: "../bad/parent/path",
1281+
},
1282+
},
1283+
},
1284+
},
1285+
// 31 - invalid abs path with Docker strategy
1286+
{
1287+
t: field.ErrorTypeInvalid,
1288+
path: "secrets[0].destinationDir",
1289+
dockerStrategy: true,
1290+
source: &buildapi.BuildSource{
1291+
Secrets: []buildapi.SecretBuildSource{
1292+
{
1293+
Secret: kapi.LocalObjectReference{
1294+
Name: "good-secret-name",
1295+
},
1296+
DestinationDir: "/var/log/something",
1297+
},
1298+
},
1299+
},
1300+
},
1301+
// 32 - ok abs path without Docker strategy
1302+
{
1303+
ok: true,
1304+
source: &buildapi.BuildSource{
1305+
Secrets: []buildapi.SecretBuildSource{
1306+
{
1307+
Secret: kapi.LocalObjectReference{
1308+
Name: "good-secret-name",
1309+
},
1310+
DestinationDir: "/var/log/something",
1311+
},
1312+
},
1313+
},
1314+
},
11921315
}
11931316
for i, tc := range errorCases {
11941317
t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
1195-
errors := validateSource(tc.source, false, false, false, nil)
1318+
errors := validateSource(tc.source, tc.customStrategy, tc.dockerStrategy, tc.jenkinsStrategy, nil)
11961319
switch len(errors) {
11971320
case 0:
11981321
if !tc.ok {

‎pkg/build/builder/common.go

+46
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"strings"
1515
"time"
1616

17+
corev1 "k8s.io/api/core/v1"
1718
"k8s.io/apimachinery/pkg/api/errors"
1819
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1920
"k8s.io/apimachinery/pkg/util/sets"
@@ -66,6 +67,51 @@ type GitClient interface {
6667
GetInfo(location string) (*git.SourceInfo, []error)
6768
}
6869

70+
// localObjectBuildSource is a build source that is copied into a build from a Kubernetes
71+
// key-value store, such as a `Secret` or `ConfigMap`.
72+
type localObjectBuildSource interface {
73+
// LocalObjectRef returns a reference to a local Kubernetes object by name.
74+
LocalObjectRef() corev1.LocalObjectReference
75+
// DestinationPath returns the directory where the files from the build source should be
76+
// available for the build time.
77+
// For the Source build strategy, these will be injected into a container
78+
// where the assemble script runs.
79+
// For the Docker build strategy, these will be copied into the build
80+
// directory, where the Dockerfile is located, so users can ADD or COPY them
81+
// during docker build.
82+
DestinationPath() string
83+
// IsSecret returns `true` if the build source is a `Secret` containing sensitive data.
84+
IsSecret() bool
85+
}
86+
87+
type configMapSource buildapiv1.ConfigMapBuildSource
88+
89+
func (c configMapSource) LocalObjectRef() corev1.LocalObjectReference {
90+
return c.ConfigMap
91+
}
92+
93+
func (c configMapSource) DestinationPath() string {
94+
return c.DestinationDir
95+
}
96+
97+
func (c configMapSource) IsSecret() bool {
98+
return false
99+
}
100+
101+
type secretSource buildapiv1.SecretBuildSource
102+
103+
func (s secretSource) LocalObjectRef() corev1.LocalObjectReference {
104+
return s.Secret
105+
}
106+
107+
func (s secretSource) DestinationPath() string {
108+
return s.DestinationDir
109+
}
110+
111+
func (s secretSource) IsSecret() bool {
112+
return true
113+
}
114+
69115
// buildInfo returns a slice of KeyValue pairs with build metadata to be
70116
// inserted into Docker images produced by build.
71117
func buildInfo(build *buildapiv1.Build, sourceInfo *git.SourceInfo) []KeyValue {

‎pkg/build/builder/docker.go

+68-42
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ func (d *DockerBuilder) Build() error {
137137
}
138138

139139
startTime := metav1.Now()
140-
err = d.dockerBuild(buildDir, buildTag, d.build.Spec.Source.Secrets)
140+
err = d.dockerBuild(buildDir, buildTag)
141141

142142
timing.RecordNewStep(ctx, buildapiv1.StageBuild, buildapiv1.StepDockerBuild, startTime, metav1.Now())
143143

@@ -205,59 +205,82 @@ func (d *DockerBuilder) Build() error {
205205
return nil
206206
}
207207

208+
// copyConfigMaps copies all files from the directory where the configMap is
209+
// mounted in the builder pod to a directory where the is the Dockerfile, so
210+
// users can ADD or COPY the files inside their Dockerfile.
211+
func (d *DockerBuilder) copyConfigMaps(configs []buildapiv1.ConfigMapBuildSource, targetDir string) error {
212+
var err error
213+
for _, c := range configs {
214+
err = d.copyLocalObject(configMapSource(c), strategy.ConfigMapBuildSourceBaseMountPath, targetDir)
215+
if err != nil {
216+
return err
217+
}
218+
}
219+
return nil
220+
}
221+
208222
// copySecrets copies all files from the directory where the secret is
209223
// mounted in the builder pod to a directory where the is the Dockerfile, so
210224
// users can ADD or COPY the files inside their Dockerfile.
211-
func (d *DockerBuilder) copySecrets(secrets []buildapiv1.SecretBuildSource, buildDir string) error {
225+
func (d *DockerBuilder) copySecrets(secrets []buildapiv1.SecretBuildSource, targetDir string) error {
226+
var err error
212227
for _, s := range secrets {
213-
dstDir := filepath.Join(buildDir, s.DestinationDir)
214-
if err := os.MkdirAll(dstDir, 0777); err != nil {
228+
err = d.copyLocalObject(secretSource(s), strategy.SecretBuildSourceBaseMountPath, targetDir)
229+
if err != nil {
215230
return err
216231
}
217-
glog.V(3).Infof("Copying files from the build secret %q to %q", s.Secret.Name, dstDir)
218-
219-
// Secrets contain nested directories and fairly baroque links. To prevent extra data being
220-
// copied, perform the following steps:
221-
//
222-
// 1. Only top level files and directories within the secret directory are candidates
223-
// 2. Any item starting with '..' is ignored
224-
// 3. Destination directories are created first with 0777
225-
// 4. Use the '-L' option to cp to copy only contents.
226-
//
227-
srcDir := filepath.Join(strategy.SecretBuildSourceBaseMountPath, s.Secret.Name)
228-
if err := filepath.Walk(srcDir, func(path string, info os.FileInfo, err error) error {
229-
if err != nil {
230-
return err
231-
}
232-
if srcDir == path {
233-
return nil
234-
}
232+
}
233+
return nil
234+
}
235235

236-
// skip any contents that begin with ".."
237-
if strings.HasPrefix(filepath.Base(path), "..") {
238-
if info.IsDir() {
239-
return filepath.SkipDir
240-
}
241-
return nil
242-
}
236+
func (d *DockerBuilder) copyLocalObject(s localObjectBuildSource, sourceDir, targetDir string) error {
237+
dstDir := filepath.Join(targetDir, s.DestinationPath())
238+
if err := os.MkdirAll(dstDir, 0777); err != nil {
239+
return err
240+
}
241+
glog.V(3).Infof("Copying files from the build source %q to %q", s.LocalObjectRef().Name, dstDir)
242+
243+
// Build sources contain nested directories and fairly baroque links. To prevent extra data being
244+
// copied, perform the following steps:
245+
//
246+
// 1. Only top level files and directories within the secret directory are candidates
247+
// 2. Any item starting with '..' is ignored
248+
// 3. Destination directories are created first with 0777
249+
// 4. Use the '-L' option to cp to copy only contents.
250+
//
251+
srcDir := filepath.Join(sourceDir, s.LocalObjectRef().Name)
252+
if err := filepath.Walk(srcDir, func(path string, info os.FileInfo, err error) error {
253+
if err != nil {
254+
return err
255+
}
256+
if srcDir == path {
257+
return nil
258+
}
243259

244-
// ensure all directories are traversable
260+
// skip any contents that begin with ".."
261+
if strings.HasPrefix(filepath.Base(path), "..") {
245262
if info.IsDir() {
246-
if err := os.MkdirAll(dstDir, 0777); err != nil {
247-
return err
248-
}
263+
return filepath.SkipDir
249264
}
250-
out, err := exec.Command("cp", "-vLRf", path, dstDir+"/").Output()
251-
if err != nil {
252-
glog.V(4).Infof("Secret %q failed to copy: %q", s.Secret.Name, string(out))
265+
return nil
266+
}
267+
268+
// ensure all directories are traversable
269+
if info.IsDir() {
270+
if err := os.MkdirAll(dstDir, 0777); err != nil {
253271
return err
254272
}
255-
// See what is copied when debugging.
256-
glog.V(5).Infof("Result of secret copy %s\n%s", s.Secret.Name, string(out))
257-
return nil
258-
}); err != nil {
273+
}
274+
out, err := exec.Command("cp", "-vLRf", path, dstDir+"/").Output()
275+
if err != nil {
276+
glog.V(4).Infof("Build source %q failed to copy: %q", s.LocalObjectRef().Name, string(out))
259277
return err
260278
}
279+
// See what is copied when debugging.
280+
glog.V(5).Infof("Result of build source copy %s\n%s", s.LocalObjectRef().Name, string(out))
281+
return nil
282+
}); err != nil {
283+
return err
261284
}
262285
return nil
263286
}
@@ -282,7 +305,7 @@ func (d *DockerBuilder) setupPullSecret() (*docker.AuthConfigurations, error) {
282305
}
283306

284307
// dockerBuild performs a docker build on the source that has been retrieved
285-
func (d *DockerBuilder) dockerBuild(dir string, tag string, secrets []buildapiv1.SecretBuildSource) error {
308+
func (d *DockerBuilder) dockerBuild(dir string, tag string) error {
286309
var noCache bool
287310
var forcePull bool
288311
var buildArgs []docker.BuildArg
@@ -304,7 +327,10 @@ func (d *DockerBuilder) dockerBuild(dir string, tag string, secrets []buildapiv1
304327
if err != nil {
305328
return err
306329
}
307-
if err := d.copySecrets(secrets, dir); err != nil {
330+
if err := d.copySecrets(d.build.Spec.Source.Secrets, dir); err != nil {
331+
return err
332+
}
333+
if err = d.copyConfigMaps(d.build.Spec.Source.ConfigMaps, dir); err != nil {
308334
return err
309335
}
310336

0 commit comments

Comments
 (0)