|
| 1 | +// Copyright (c) 2026 Alibaba Cloud |
| 2 | +// |
| 3 | +// SPDX-License-Identifier: Apache-2.0 |
| 4 | +// |
| 5 | + |
| 6 | +use std::env; |
| 7 | + |
| 8 | +use anyhow::{Context, Result}; |
| 9 | +use confidential_data_hub::CdhConfig; |
| 10 | +use tracing::info; |
| 11 | + |
| 12 | +const CDH_DEFAULT_IMAGE_AUTHENTICATED_REGISTRY_CREDENTIALS: &str = |
| 13 | + "CDH_DEFAULT_IMAGE_AUTHENTICATED_REGISTRY_CREDENTIALS"; |
| 14 | + |
| 15 | +pub fn read_config(config_path: Option<String>) -> Result<(CdhConfig, String)> { |
| 16 | + let (mut config, config_log) = match config_path { |
| 17 | + Some(config_path) => { |
| 18 | + let config = CdhConfig::from_file(&config_path[..]) |
| 19 | + .with_context(|| format!("failed to read config file {config_path}"))?; |
| 20 | + let log = format!("Using config file: {config_path}"); |
| 21 | + (config, log) |
| 22 | + } |
| 23 | + None => { |
| 24 | + if let std::result::Result::Ok(env_path) = env::var("CDH_CONFIG_PATH") { |
| 25 | + let log = format!("Read CDH's config path from env: {env_path}"); |
| 26 | + let config = CdhConfig::from_file(&env_path[..]) |
| 27 | + .with_context(|| format!("failed to read config file {env_path}"))?; |
| 28 | + (config, log) |
| 29 | + } else { |
| 30 | + let log = "No CDH config path specified. Using default configuration.".to_string(); |
| 31 | + let config = CdhConfig::default_with_kernel_cmdline() |
| 32 | + .with_context(|| "failed to read default configuration".to_string())?; |
| 33 | + (config, log) |
| 34 | + } |
| 35 | + } |
| 36 | + }; |
| 37 | + |
| 38 | + if let std::result::Result::Ok(env) = |
| 39 | + env::var(CDH_DEFAULT_IMAGE_AUTHENTICATED_REGISTRY_CREDENTIALS) |
| 40 | + { |
| 41 | + info!("Read authenticated registry credentials URI from env: {env}"); |
| 42 | + config.image.authenticated_registry_credentials_uri = Some(env); |
| 43 | + } |
| 44 | + |
| 45 | + config.extend_credentials_from_kernel_cmdline()?; |
| 46 | + |
| 47 | + Ok((config, config_log)) |
| 48 | +} |
| 49 | + |
| 50 | +#[cfg(test)] |
| 51 | +mod tests { |
| 52 | + use std::{env, io::Write}; |
| 53 | + |
| 54 | + use anyhow::anyhow; |
| 55 | + use confidential_data_hub::{CdhConfig, KbsConfig, LogConfig, DEFAULT_CDH_SOCKET_ADDR}; |
| 56 | + use image_rs::config::ImageConfig; |
| 57 | + use serial_test::serial; |
| 58 | + |
| 59 | + use crate::config::read_config; |
| 60 | + |
| 61 | + #[test] |
| 62 | + #[serial] |
| 63 | + fn test_config_auth_override_by_env() { |
| 64 | + let config = r#" |
| 65 | +[kbc] |
| 66 | +name = "offline_fs_kbc" |
| 67 | +
|
| 68 | +[image] |
| 69 | +authenticated_registry_credentials_uri = "kbs:///default/auth/1" |
| 70 | + "#; |
| 71 | + let mut file = tempfile::Builder::new() |
| 72 | + .append(true) |
| 73 | + .suffix(".toml") |
| 74 | + .tempfile() |
| 75 | + .unwrap(); |
| 76 | + file.write_all(config.as_bytes()).unwrap(); |
| 77 | + |
| 78 | + // without env and from config file |
| 79 | + let config_path = file.path().to_str().unwrap().to_string(); |
| 80 | + let (config, _) = read_config(Some(config_path.clone())).expect("Must be successful"); |
| 81 | + assert_eq!( |
| 82 | + config.image.authenticated_registry_credentials_uri, |
| 83 | + Some("kbs:///default/auth/1".into()) |
| 84 | + ); |
| 85 | + |
| 86 | + // overrided by env |
| 87 | + env::set_var( |
| 88 | + "CDH_DEFAULT_IMAGE_AUTHENTICATED_REGISTRY_CREDENTIALS", |
| 89 | + "file:///test", |
| 90 | + ); |
| 91 | + let (config, _) = read_config(Some(config_path.clone())).unwrap(); |
| 92 | + assert_eq!( |
| 93 | + config.image.authenticated_registry_credentials_uri, |
| 94 | + Some("file:///test".to_string()) |
| 95 | + ); |
| 96 | + env::remove_var("CDH_DEFAULT_IMAGE_AUTHENTICATED_REGISTRY_CREDENTIALS"); |
| 97 | + |
| 98 | + // no env again |
| 99 | + let (config, _) = read_config(Some(config_path)).unwrap(); |
| 100 | + assert_eq!( |
| 101 | + config.image.authenticated_registry_credentials_uri, |
| 102 | + Some("kbs:///default/auth/1".into()) |
| 103 | + ); |
| 104 | + } |
| 105 | + |
| 106 | + #[test] |
| 107 | + #[serial] |
| 108 | + fn test_config_path() { |
| 109 | + // --config takes precedence, |
| 110 | + // then env.CDH_CONFIG_PATH |
| 111 | + |
| 112 | + let config = CdhConfig::default_with_kernel_cmdline().expect("Must be successful"); |
| 113 | + let expected = CdhConfig { |
| 114 | + log: LogConfig::default(), |
| 115 | + kbc: KbsConfig { |
| 116 | + name: "offline_fs_kbc".into(), |
| 117 | + url: "".into(), |
| 118 | + kbs_cert: None, |
| 119 | + }, |
| 120 | + credentials: Vec::new(), |
| 121 | + socket: DEFAULT_CDH_SOCKET_ADDR.into(), |
| 122 | + image: ImageConfig::from_kernel_cmdline(), |
| 123 | + skip_sealed_secret_verification: false, |
| 124 | + }; |
| 125 | + assert_eq!(config, expected); |
| 126 | + |
| 127 | + let config = CdhConfig::from_file("/thing").unwrap_err(); |
| 128 | + let expected = anyhow!("configuration file \"/thing\" not found"); |
| 129 | + assert_eq!(format!("{config}"), format!("{expected}")); |
| 130 | + |
| 131 | + env::set_var("CDH_CONFIG_PATH", "/byenv"); |
| 132 | + let result = read_config(None).unwrap_err(); |
| 133 | + let expected = anyhow!("failed to read config file /byenv"); |
| 134 | + assert_eq!(format!("{result}"), format!("{expected}")); |
| 135 | + env::remove_var("CDH_CONFIG_PATH"); |
| 136 | + |
| 137 | + let config = CdhConfig::from_file("/thing").unwrap_err(); |
| 138 | + let expected = anyhow!("configuration file \"/thing\" not found"); |
| 139 | + assert_eq!(format!("{config}"), format!("{expected}")); |
| 140 | + } |
| 141 | +} |
0 commit comments