Skip to content

Commit

Permalink
feat: allow other credential helpers in Finch VM (#1265)
Browse files Browse the repository at this point in the history 
Signed-off-by: Austin Vazquez <macedonv@amazon.com>
  • Loading branch information
@austinvazquez
austinvazquez authored Feb 4, 2025
1 parent ca9a88c commit 515a693
Show file tree
Hide file tree
Showing 2 changed files with 85 additions and 5 deletions.
11 changes: 9 additions & 2 deletions pkg/config/nerdctl_config_applier.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,11 +91,18 @@ func addLineToBashrc(fs afero.Fs, profileFilePath string, profStr string, cmd st
func updateEnvironment(fs afero.Fs, fc *Finch, finchDir, homeDir, limaVMHomeDir string) error {
cmdArr := []string{
`export DOCKER_CONFIG="$FINCH_DIR"`,
"[ -L /usr/local/bin/docker-credential-ecr-login ] " +
`|| sudo ln -s "$FINCH_DIR"/cred-helpers/docker-credential-ecr-login /usr/local/bin/`,
`[ -L /root/.aws ] || sudo ln -fs "$AWS_DIR" /root/.aws`,
}

//nolint:gosec // G101: Potential hardcoded credentials false positive
const configureCredHelperTemplate = `([ -e "$FINCH_DIR"/cred-helpers/docker-credential-%s ]
|| (echo "error: docker-credential-%s not found in $FINCH_DIR/cred-helpers directory.")) &&
([ -L /usr/local/bin/docker-credential-%s ] || sudo ln -s "$FINCH_DIR"/cred-helpers/docker-credential-%s /usr/local/bin)`

for _, credHelper := range fc.CredsHelpers {
cmdArr = append(cmdArr, fmt.Sprintf(configureCredHelperTemplate, credHelper, credHelper, credHelper, credHelper))
}

awsDir := fmt.Sprintf("%s/.aws", homeDir)

if *fc.VMType == "wsl2" {
Expand Down
79 changes: 76 additions & 3 deletions pkg/config/nerdctl_config_applier_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,6 @@ func Test_updateEnvironment(t *testing.T) {
FINCH_DIR=/finch/dir
AWS_DIR=/home/dir/.aws
export DOCKER_CONFIG="$FINCH_DIR"
[ -L /usr/local/bin/docker-credential-ecr-login ] || sudo ln -s "$FINCH_DIR"/cred-helpers/docker-credential-ecr-login /usr/local/bin/
[ -L /root/.aws ] || sudo ln -fs "$AWS_DIR" /root/.aws
[ -L /home/mock_user.linux/.finch ] || ln -s $FINCH_DIR /home/mock_user.linux/.finch`), string(fileBytes))
},
Expand Down Expand Up @@ -95,7 +94,6 @@ export DOCKER_CONFIG="$FINCH_DIR"
FINCH_DIR=/finch/dir
AWS_DIR=/home/dir/.aws
export DOCKER_CONFIG="$FINCH_DIR"
[ -L /usr/local/bin/docker-credential-ecr-login ] || sudo ln -s "$FINCH_DIR"/cred-helpers/docker-credential-ecr-login /usr/local/bin/
[ -L /root/.aws ] || sudo ln -fs "$AWS_DIR" /root/.aws)
[ -L /home/mock_user.linux/.finch ] || ln -s $FINCH_DIR /home/mock_user.linux/.finch`,
),
Expand All @@ -110,7 +108,6 @@ export DOCKER_CONFIG="$FINCH_DIR"
FINCH_DIR=/finch/dir
AWS_DIR=/home/dir/.aws
export DOCKER_CONFIG="$FINCH_DIR"
[ -L /usr/local/bin/docker-credential-ecr-login ] || sudo ln -s "$FINCH_DIR"/cred-helpers/docker-credential-ecr-login /usr/local/bin/
[ -L /root/.aws ] || sudo ln -fs "$AWS_DIR" /root/.aws)
[ -L /home/mock_user.linux/.finch ] || ln -s $FINCH_DIR /home/mock_user.linux/.finch`), string(fileBytes))
},
Expand Down Expand Up @@ -140,6 +137,82 @@ export DOCKER_CONFIG="$FINCH_DIR"
},
),
},
{
name: "put docker-credential-ecr-login in path",
cfg: &Finch{
SystemSettings: SystemSettings{
SharedSystemSettings: SharedSystemSettings{
VMType: pointer.String("vz"),
},
},
SharedSettings: SharedSettings{
CredsHelpers: []string{"ecr-login"},
},
},
finchDir: "/finch/dir",
homeDir: "/home/dir",
limaVMHomeDir: "/home/mock_user.linux",
mockSvc: func(t *testing.T, fs afero.Fs) {
require.NoError(t, afero.WriteFile(fs, "/home/mock_user.linux/.bashrc", []byte(""), 0o644))
},
postRunCheck: func(t *testing.T, fs afero.Fs) {
fileBytes, err := afero.ReadFile(fs, "/home/mock_user.linux/.bashrc")
require.NoError(t, err)
assert.Equal(t, string(
"\nFINCH_DIR=/finch/dir\n"+
"AWS_DIR=/home/dir/.aws\n"+
"export DOCKER_CONFIG=\"$FINCH_DIR\"\n"+
"[ -L /root/.aws ] || sudo ln -fs \"$AWS_DIR\" /root/.aws\n"+
"([ -e \"$FINCH_DIR\"/cred-helpers/docker-credential-ecr-login ] \n"+
"|| (echo \"error: docker-credential-ecr-login not found in $FINCH_DIR/cred-helpers directory.\")) && \n"+
"([ -L /usr/local/bin/docker-credential-ecr-login ] "+
"|| sudo ln -s \"$FINCH_DIR\"/cred-helpers/docker-credential-ecr-login /usr/local/bin)\n"+
"[ -L /home/mock_user.linux/.finch ] || ln -s $FINCH_DIR /home/mock_user.linux/.finch"),
string(fileBytes),
)
},
want: nil,
},
{
name: "put docker-credential-ecr-login and secretservice in path",
cfg: &Finch{
SystemSettings: SystemSettings{
SharedSystemSettings: SharedSystemSettings{
VMType: pointer.String("vz"),
},
},
SharedSettings: SharedSettings{
CredsHelpers: []string{"ecr-login", "secretservice"},
},
},
finchDir: "/finch/dir",
homeDir: "/home/dir",
limaVMHomeDir: "/home/mock_user.linux",
mockSvc: func(t *testing.T, fs afero.Fs) {
require.NoError(t, afero.WriteFile(fs, "/home/mock_user.linux/.bashrc", []byte(""), 0o644))
},
postRunCheck: func(t *testing.T, fs afero.Fs) {
fileBytes, err := afero.ReadFile(fs, "/home/mock_user.linux/.bashrc")
require.NoError(t, err)
assert.Equal(t, string(
"\nFINCH_DIR=/finch/dir\n"+
"AWS_DIR=/home/dir/.aws\n"+
"export DOCKER_CONFIG=\"$FINCH_DIR\"\n"+
"[ -L /root/.aws ] || sudo ln -fs \"$AWS_DIR\" /root/.aws\n"+
"([ -e \"$FINCH_DIR\"/cred-helpers/docker-credential-ecr-login ] \n"+
"|| (echo \"error: docker-credential-ecr-login not found in $FINCH_DIR/cred-helpers directory.\")) && \n"+
"([ -L /usr/local/bin/docker-credential-ecr-login ] "+
"|| sudo ln -s \"$FINCH_DIR\"/cred-helpers/docker-credential-ecr-login /usr/local/bin)\n"+
"([ -e \"$FINCH_DIR\"/cred-helpers/docker-credential-secretservice ] \n"+
"|| (echo \"error: docker-credential-secretservice not found in $FINCH_DIR/cred-helpers directory.\")) && \n"+
"([ -L /usr/local/bin/docker-credential-secretservice ] "+
"|| sudo ln -s \"$FINCH_DIR\"/cred-helpers/docker-credential-secretservice /usr/local/bin)\n"+
"[ -L /home/mock_user.linux/.finch ] || ln -s $FINCH_DIR /home/mock_user.linux/.finch"),
string(fileBytes),
)
},
want: nil,
},
}

for _, tc := range testCases {
Expand Down

0 comments on commit 515a693

Please sign in to comment.