-
Notifications
You must be signed in to change notification settings - Fork 173
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
zarf package mirror command introduction (#1913)
## Description This adds a command that mirrors artifacts from a package and pushes them to their airgap equivalents ## Related Issue Fixes #N/A ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [X] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Checklist before merging - [ ] Test, docs, adr added or updated as needed - [X] [Contributor Guide Steps](https://github.com/defenseunicorns/zarf/blob/main/CONTRIBUTING.md#developer-workflow) followed --------- Co-authored-by: razzle <[email protected]> Co-authored-by: Case Wylie <[email protected]>
- Loading branch information
3 people
authored
Sep 6, 2023
1 parent
89b6848
commit ba9addf
Showing
20 changed files
with
498 additions
and
174 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
46 changes: 46 additions & 0 deletions
46
docs/2-the-zarf-cli/100-cli-commands/zarf_package_mirror-resources.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| # zarf package mirror-resources | ||
| <!-- Auto-generated by hack/gen-cli-docs.sh --> | ||
|
|
||
| Mirrors a Zarf package's internal resources to specified image registries and git repositories | ||
|
|
||
| ## Synopsis | ||
|
|
||
| Unpacks resources and dependencies from a Zarf package archive and mirrors them into the specified | ||
| image registries and git repositories within the target environment | ||
|
|
||
| ``` | ||
| zarf package mirror-resources [ PACKAGE ] [flags] | ||
| ``` | ||
|
|
||
| ## Options | ||
|
|
||
| ``` | ||
| --components string Comma-separated list of components to mirror. This list will be respected regardless of a component's 'required' status. | ||
| --confirm Confirms package deployment without prompting. ONLY use with packages you trust. Skips prompts to review SBOM, configure variables, select optional components and review potential breaking changes. | ||
| --git-push-password string Password for the push-user to access the git server | ||
| --git-push-username string Username to access to the git server Zarf is configured to use. User must be able to create repositories via 'git push' (default "zarf-git-user") | ||
| --git-url string External git server url to use for this Zarf cluster | ||
| -h, --help help for mirror-resources | ||
| --no-img-checksum Turns off the addition of a checksum to image tags (as would be used by the Zarf Agent) while mirroring images. | ||
| --registry-push-password string Password for the push-user to connect to the registry | ||
| --registry-push-username string Username to access to the registry Zarf is configured to use (default "zarf-push") | ||
| --registry-url string External registry url address to use for this Zarf cluster | ||
| ``` | ||
|
|
||
| ## Options inherited from parent commands | ||
|
|
||
| ``` | ||
| -a, --architecture string Architecture for OCI images and Zarf packages | ||
| --insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture. | ||
| -l, --log-level string Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info") | ||
| --no-color Disable colors in output | ||
| --no-log-file Disable log file creation | ||
| --no-progress Disable fancy UI progress bars, spinners, logos, etc | ||
| --oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote package. (default 3) | ||
| --tmpdir string Specify the temporary directory to use for intermediate files | ||
| --zarf-cache string Specify the location of the Zarf cache directory (default "~/.zarf-cache") | ||
| ``` | ||
|
|
||
| ## SEE ALSO | ||
|
|
||
| * [zarf package](zarf_package.md) - Zarf package commands for creating, deploying, and inspecting packages |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,12 @@ import ExampleYAML from "@site/src/components/ExampleYAML"; | |
|
|
||
| This example shows how to package `git` repositories within a Zarf package. This package does not deploy anything itself but pushes assets to the specified `git` service to be consumed as desired. Within Zarf, there are a few ways to include `git` repositories (as described below). | ||
|
|
||
| :::tip | ||
|
|
||
| Git repositories included in a package can be deployed with `zarf package deploy` if an existing Kubernetes cluster has been initialized with `zarf init`. If you do not have an initialized cluster but want to push resources to a remote registry anyway, you can use [`zarf package mirror-resources`](./../../docs/2-the-zarf-cli/100-cli-commands/zarf_package_mirror-resources.md). | ||
|
|
||
| ::: | ||
|
|
||
| ## Tag-Based Git Repository Clone | ||
|
|
||
| Tag-based `git` repository cloning is the **recommended** way of cloning a `git` repository for air-gapped deployments because it wraps meaning around a specific point in git history that can easily be traced back to the online world. Tag-based clones are defined using the `scheme://host/repo@tag` format as seen in the example of the `defenseunicorns/zarf` repository (`https://github.com/defenseunicorns/[email protected]`). | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // SPDX-FileCopyrightText: 2021-Present The Zarf Authors | ||
|
|
||
| // Package packager contains functions for interacting with, managing and deploying Zarf packages. | ||
| package packager | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| "github.com/defenseunicorns/zarf/src/config" | ||
| "github.com/defenseunicorns/zarf/src/pkg/message" | ||
| "github.com/defenseunicorns/zarf/src/pkg/utils/helpers" | ||
| "github.com/defenseunicorns/zarf/src/types" | ||
| ) | ||
|
|
||
| // Mirror pulls resources from a package (images, git repositories, etc) and pushes them to remotes in the air gap without deploying them | ||
| func (p *Packager) Mirror() (err error) { | ||
| spinner := message.NewProgressSpinner("Mirroring Zarf package %s", p.cfg.PkgOpts.PackagePath) | ||
| defer spinner.Stop() | ||
|
|
||
| if helpers.IsOCIURL(p.cfg.PkgOpts.PackagePath) { | ||
| err := p.SetOCIRemote(p.cfg.PkgOpts.PackagePath) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| } | ||
|
|
||
| if err := p.loadZarfPkg(); err != nil { | ||
| return fmt.Errorf("unable to load the Zarf Package: %w", err) | ||
| } | ||
|
|
||
| if err := ValidatePackageSignature(p.tmp.Base, p.cfg.PkgOpts.PublicKeyPath); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // Confirm the overall package mirror | ||
| if !p.confirmAction(config.ZarfMirrorStage, p.cfg.SBOMViewFiles) { | ||
| return fmt.Errorf("mirror cancelled") | ||
| } | ||
|
|
||
| state := &types.ZarfState{ | ||
| RegistryInfo: p.cfg.InitOpts.RegistryInfo, | ||
| GitServer: p.cfg.InitOpts.GitServer, | ||
| } | ||
| p.cfg.State = state | ||
|
|
||
| // Filter out components that are not compatible with this system if we have loaded from a tarball | ||
| p.filterComponents(true) | ||
| requestedComponentNames := getRequestedComponentList(p.cfg.PkgOpts.OptionalComponents) | ||
|
|
||
| for _, component := range p.cfg.Pkg.Components { | ||
| if len(requestedComponentNames) == 0 || helpers.SliceContains(requestedComponentNames, component.Name) { | ||
| if err := p.mirrorComponent(component); err != nil { | ||
| return err | ||
| } | ||
| } | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // mirrorComponent mirrors a Zarf Component. | ||
| func (p *Packager) mirrorComponent(component types.ZarfComponent) error { | ||
|
|
||
| componentPath, err := p.createOrGetComponentPaths(component) | ||
| if err != nil { | ||
| return fmt.Errorf("unable to create the component paths: %w", err) | ||
| } | ||
|
|
||
| // All components now require a name | ||
| message.HeaderInfof("📦 %s COMPONENT", strings.ToUpper(component.Name)) | ||
|
|
||
| hasImages := len(component.Images) > 0 | ||
| hasRepos := len(component.Repos) > 0 | ||
|
|
||
| if hasImages { | ||
| if err := p.pushImagesToRegistry(component.Images, p.cfg.MirrorOpts.NoImgChecksum); err != nil { | ||
| return fmt.Errorf("unable to push images to the registry: %w", err) | ||
| } | ||
| } | ||
|
|
||
| if hasRepos { | ||
| if err = p.pushReposToRepository(componentPath.Repos, component.Repos); err != nil { | ||
| return fmt.Errorf("unable to push the repos to the repository: %w", err) | ||
| } | ||
| } | ||
|
|
||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.