Skip to content

Commit 128952e

Browse files
author
ljalbertsimard
committed
feat(Registry): add support for IAM role authentication
1 parent b60b8f9 commit 128952e

4 files changed

Lines changed: 82 additions & 21 deletions

File tree

‎docs/customizing_deis/registry_settings.rst‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,21 @@ setting description
4343
/deis/store/gateway/secretKey S3 API secret key used to access store-gateway (set by store-gateway)
4444
==================================== =================================================================================
4545

46+
If the ``/deis/registry/s3bucket`` key is supplied, the registry
47+
will use Amazon S3 as its storage backend and use the following values.
48+
49+
==================================== =================================================================================
50+
setting description
51+
==================================== =================================================================================
52+
/deis/registry/s3accessKey S3 API access key. If not specified, the registry will get it from the instance role
53+
/deis/registry/s3secretKey S3 API secret key, required if s3accessKey is specified
54+
/deis/registry/s3region S3 region to connect to, will use boto default if not specified
55+
/deis/registry/s3bucket S3 bucket to store images
56+
/deis/registry/s3path path in the bucket (default: "/registry")
57+
/deis/registry/s3encrypt whether the object is encrypted while at rest on the server (default: true)
58+
/deis/registry/s3secure use secure protocol to establish connection with S3 (default: true)
59+
==================================== =================================================================================
60+
4661
The Deis registry component inherits from the Docker registry container, so additional configuration
4762
options can be supplied. For a full explanation of these settings, see the Docker registry `README`_.
4863

‎docs/managing_deis/running-deis-without-ceph.rst‎

Lines changed: 46 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -121,21 +121,58 @@ The :ref:`registry` component won't start until it's configured with an S3 store
121121
.. code-block:: console
122122
123123
$ BUCKET=MYS3BUCKET
124-
$ AWS_ACCESS_KEY=something
125-
$ AWS_SECRET_KEY=something
126124
$ AWS_S3_REGION=some-aws-region #(e.g., us-west-1)
127125
$ deisctl config registry set s3bucket=${BUCKET} \
128-
bucketName=${BUCKET} \
129-
s3accessKey=${AWS_ACCESS_KEY} \
130-
s3secretKey=${AWS_SECRET_KEY} \
131126
s3region=${AWS_S3_REGION} \
132127
s3path=/ \
133128
s3encrypt=false \
134129
s3secure=false
135-
$ deisctl config store set gateway/accessKey=${AWS_ACCESS_KEY} \
136-
gateway/secretKey=${AWS_SECRET_KEY} \
137-
gateway/host=s3.amazonaws.com \
138-
gateway/port=80
130+
131+
By default, the registry will try to authenticate to S3 using the instance role.
132+
If your cluster is not running on EC2, you can supply hard coded API access and
133+
secret key:
134+
135+
.. code-block:: console
136+
137+
$ deisctl config registry set s3accessKey=your-access-key \
138+
s3secretKey=your-secret-key
139+
140+
For reference, here's example of a policy you could attach to the role/user used by
141+
the registry:
142+
143+
.. code-block:: javascript
144+
145+
{
146+
"Statement": [
147+
{
148+
"Resource": "arn:aws:s3:::*",
149+
"Action": "s3:ListAllMyBuckets",
150+
"Effect": "Allow"
151+
},
152+
{
153+
"Resource": [
154+
"arn:aws:s3:::MYBUCKET"
155+
],
156+
"Action": [
157+
"s3:ListBucket",
158+
"s3:GetBucketLocation"
159+
],
160+
"Effect": "Allow"
161+
},
162+
{
163+
"Resource": [
164+
"arn:aws:s3:::MYBUCKET/*"
165+
],
166+
"Action": [
167+
"s3:GetObject",
168+
"s3:PutObject",
169+
"s3:DeleteObject"
170+
],
171+
"Effect": "Allow"
172+
}
173+
],
174+
"Version": "2012-10-17"
175+
}
139176
140177
Configure database settings
141178
^^^^^^^^^^^^^^^^^^^^^^^^^^^

‎registry/templates/config.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -78,30 +78,30 @@ local: &local
7878
s3: &s3
7979
<<: *common
8080
storage: s3
81-
s3_region: {{ if exists "/deis/registry/s3region" }}{{ getv "/deis/registry/s3region" }}{{ else }}""{{ end }}
82-
s3_bucket: {{ if exists "/deis/registry/s3bucket" }}{{ getv "/deis/registry/s3bucket" }}{{ else }}""{{ end }}
83-
boto_bucket: {{ if exists "/deis/registry/s3bucket" }}{{ getv "/deis/registry/s3bucket" }}{{ else }}""{{ end }}
81+
s3_region: {{ if exists "/deis/registry/s3region" }}{{ getv "/deis/registry/s3region" }}{{ else }}~{{ end }}
82+
s3_bucket: {{ if exists "/deis/registry/s3bucket" }}{{ getv "/deis/registry/s3bucket" }}{{ else }}~{{ end }}
83+
boto_bucket: {{ if exists "/deis/registry/s3bucket" }}{{ getv "/deis/registry/s3bucket" }}{{ else }}~{{ end }}
8484
storage_path: {{ if exists "/deis/registry/s3path" }}{{ getv "/deis/registry/s3path" }}{{ else }}"/registry"{{ end }}
8585
s3_encrypt: bool({{ if exists "/deis/registry/s3encrypt" }}{{ getv "/deis/registry/s3encrypt" }}{{ else }}"true"{{ end }})
8686
s3_secure: bool({{ if exists "/deis/registry/s3secure" }}{{ getv "/deis/registry/s3secure" }}{{ else }}"true"{{ end }})
87-
s3_access_key: {{ if exists "/deis/registry/s3accessKey" }}{{ getv "/deis/registry/s3accessKey" }}{{ else }}""{{ end }}
88-
s3_secret_key: {{ if exists "/deis/registry/s3secretKey" }}{{ getv "/deis/registry/s3secretKey" }}{{ else }}""{{ end }}
87+
s3_access_key: {{ if exists "/deis/registry/s3accessKey" }}{{ getv "/deis/registry/s3accessKey" }}{{ else }}~{{ end }}
88+
s3_secret_key: {{ if exists "/deis/registry/s3secretKey" }}{{ getv "/deis/registry/s3secretKey" }}{{ else }}~{{ end }}
8989

9090
# Ceph Object Gateway Configuration
9191
# See http://ceph.com/docs/master/radosgw/ for details on installing this service.
9292
ceph-s3: &ceph-s3
9393
<<: *common
9494
storage: s3
9595
s3_region: ~
96-
s3_bucket: {{ getv "/deis/registry/bucketName" }}
96+
s3_bucket: {{if exists "/deis/registry/bucketName"}}{{ getv "/deis/registry/bucketName" }}{{ else }}""{{ end }}
9797
s3_encrypt: false
9898
s3_secure: false
9999
storage_path: /registry
100-
s3_access_key: {{ getv "/deis/store/gateway/accessKey" }}
101-
s3_secret_key: {{ getv "/deis/store/gateway/secretKey" }}
102-
boto_bucket: {{ getv "/deis/registry/bucketName" }}
103-
boto_host: {{ getv "/deis/store/gateway/host" }}
104-
boto_port: {{ getv "/deis/store/gateway/port" }}
100+
s3_access_key: {{if exists "/deis/store/gateway/accessKey"}}{{ getv "/deis/store/gateway/accessKey" }}{{ else }}""{{ end }}
101+
s3_secret_key: {{if exists "/deis/store/gateway/secretKey"}}{{ getv "/deis/store/gateway/secretKey" }}{{ else }}""{{ end }}
102+
boto_bucket: {{if exists "/deis/registry/bucketName"}}{{ getv "/deis/registry/bucketName" }}{{ else }}""{{ end }}
103+
boto_host: {{if exists "/deis/store/gateway/host"}}{{ getv "/deis/store/gateway/host" }}{{ else }}""{{ end }}
104+
boto_port: {{if exists "/deis/store/gateway/port"}}{{ getv "/deis/store/gateway/port" }}{{ else }}""{{ end }}
105105
boto_debug: 0
106106
boto_calling_format: boto.s3.connection.OrdinaryCallingFormat
107107

@@ -194,7 +194,7 @@ prod:
194194

195195
# Flavor used by deis
196196
deis:
197-
{{ if exists "/deis/registry/s3accessKey" }}<<: *s3
197+
{{ if exists "/deis/registry/s3bucket" }}<<: *s3
198198
{{ else if exists "/deis/registry/swiftAuthURL" }} <<: *openstack-swift
199199
{{ else }} <<: *ceph-s3
200200
{{ end }}

‎registry/templates/create_bucket‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,22 @@ import sys
55
from boto.s3.connection import OrdinaryCallingFormat
66

77
conn = boto.connect_s3(
8+
{{ if exists "/deis/store/gateway/accessKey" }}
89
aws_access_key_id='{{ getv "/deis/store/gateway/accessKey" }}',
910
aws_secret_access_key='{{ getv "/deis/store/gateway/secretKey" }}',
11+
{{end}}
12+
{{ if exists "/deis/store/gateway/host" }}
1013
host='{{ getv "/deis/store/gateway/host" }}',
1114
port={{ getv "/deis/store/gateway/port" }},
15+
{{ end }}
1216
is_secure=False,
1317
calling_format=OrdinaryCallingFormat())
18+
19+
{{ if exists "/deis/registry/s3bucket" }}
20+
name = '{{ getv "/deis/registry/s3bucket" }}'
21+
{{ else }}
1422
name = '{{ getv "/deis/registry/bucketName" }}'
23+
{{ end }}
1524

1625
if name not in (bucket.name for bucket in conn.get_all_buckets()):
1726
conn.create_bucket(name)

0 commit comments

Comments
 (0)