From fa6ab481d0bc6951c95eda341e6f6e204af0dbaf Mon Sep 17 00:00:00 2001 From: Kris De Volder Date: Sun, 22 Jan 2017 11:35:29 -0800 Subject: [PATCH] Add tests and hovers for docker-image source attributes. --- .../vscode/concourse/PipelineYmlSchema.java | 13 ++- .../DockerImageSource/aws_access_key_id.md | 2 + .../aws_secret_access_key.md | 2 + .../desc/DockerImageSource/ca_certs.md | 25 ++++ .../desc/DockerImageSource/client_certs.md | 27 +++++ .../DockerImageSource/insecure_registries.md | 3 + .../desc/DockerImageSource/password.md | 1 + .../desc/DockerImageSource/registry_mirror.md | 1 + .../desc/DockerImageSource/repository.md | 2 + .../resources/desc/DockerImageSource/tag.md | 1 + .../desc/DockerImageSource/username.md | 1 + .../concourse/PipelineYamlEditorTest.java | 108 ++++++++++++++++++ 12 files changed, 181 insertions(+), 5 deletions(-) create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/aws_access_key_id.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/aws_secret_access_key.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/ca_certs.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/client_certs.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/insecure_registries.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/password.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/registry_mirror.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/repository.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/tag.md create mode 100644 vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/username.md diff --git a/vscode-extensions/vscode-concourse/src/main/java/org/springframework/ide/vscode/concourse/PipelineYmlSchema.java b/vscode-extensions/vscode-concourse/src/main/java/org/springframework/ide/vscode/concourse/PipelineYmlSchema.java index 9198b08e9..ae41c0efa 100644 --- a/vscode-extensions/vscode-concourse/src/main/java/org/springframework/ide/vscode/concourse/PipelineYmlSchema.java +++ b/vscode-extensions/vscode-concourse/src/main/java/org/springframework/ide/vscode/concourse/PipelineYmlSchema.java @@ -264,13 +264,16 @@ public class PipelineYmlSchema implements YamlSchema { addProp(source, "aws_access_key_id", t_ne_string); addProp(source, "aws_secret_access_key", t_ne_string); addProp(source, "insecure_registries", t_strings); - addProp(source, "registry_mirror", t_strings); - YBeanType t_cert_entry = f.ybean("DomainAndCert", + addProp(source, "registry_mirror", t_ne_string); + addProp(source, "ca_certs", f.yseq(f.ybean("CaCertsEntry", f.yprop("domain", t_ne_string), f.yprop("cert", t_ne_string) - ); - addProp(source, "ca_certs", f.yseq(t_cert_entry)); - addProp(source, "client_certs", f.yseq(t_cert_entry)); + ))); + addProp(source, "client_certs", f.yseq(f.ybean("ClientCertsEntry", + f.yprop("domain", t_ne_string), + f.yprop("key", t_ne_string), + f.yprop("cert", t_ne_string) + ))); YBeanType get = f.ybean("DockerImageGetParams"); addProp(get, "save", t_boolean); diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/aws_access_key_id.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/aws_access_key_id.md new file mode 100644 index 000000000..cb6086bd1 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/aws_access_key_id.md @@ -0,0 +1,2 @@ +*Optional.* AWS access key to use for acquiring ECR +credentials. \ No newline at end of file diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/aws_secret_access_key.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/aws_secret_access_key.md new file mode 100644 index 000000000..00813dec6 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/aws_secret_access_key.md @@ -0,0 +1,2 @@ +*Optional.* AWS secret key to use for acquiring ECR +credentials. \ No newline at end of file diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/ca_certs.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/ca_certs.md new file mode 100644 index 000000000..2345ae69f --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/ca_certs.md @@ -0,0 +1,25 @@ +*Optional.* An array of objects with the following format: + +```yaml +ca_certs: +- domain: example.com:443 + cert: | + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- +- domain: 10.244.6.2:443 + cert: | + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- +``` + +Each entry specifies the x509 CA certificate for the trusted docker registry +residing at the specified domain. This is used to validate the certificate of +the docker registry when the registry's certificate is signed by a custom +authority (or itself). + +The domain should match the first component of `repository`, including the +port. If the registry specified in `repository` does not use a custom cert, +adding `ca_certs` will break the check script. This option is overridden by +entries in `insecure_registries` with the same address or a matching CIDR. diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/client_certs.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/client_certs.md new file mode 100644 index 000000000..2fc026793 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/client_certs.md @@ -0,0 +1,27 @@ +*Optional.* An array of objects with the following format: + +```yaml +client_certs: +- domain: example.com:443 + cert: | + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + key: | + -----BEGIN RSA PRIVATE KEY----- + ... + -----END RSA PRIVATE KEY----- +- domain: 10.244.6.2:443 + cert: | + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + key: | + -----BEGIN RSA PRIVATE KEY----- + ... + -----END RSA PRIVATE KEY----- +``` + +Each entry specifies the x509 certificate and key to use for authenticating +against the docker registry residing at the specified domain. The domain +should match the first component of `repository`, including the port. diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/insecure_registries.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/insecure_registries.md new file mode 100644 index 000000000..a8224ddc5 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/insecure_registries.md @@ -0,0 +1,3 @@ +*Optional.* An array of CIDRs or `host:port` addresses +to whitelist for insecure access (either `http` or unverified `https`). +This option overrides any entries in `ca_certs` with the same address. \ No newline at end of file diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/password.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/password.md new file mode 100644 index 000000000..379efeb90 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/password.md @@ -0,0 +1 @@ +*Optional.* The password to use when authenticating. \ No newline at end of file diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/registry_mirror.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/registry_mirror.md new file mode 100644 index 000000000..01e59e6f1 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/registry_mirror.md @@ -0,0 +1 @@ +*Optional.* A URL pointing to a docker registry mirror service. diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/repository.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/repository.md new file mode 100644 index 000000000..c27a71499 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/repository.md @@ -0,0 +1,2 @@ +*Required.* The name of the repository, e.g. +`concourse/docker-image-resource`. \ No newline at end of file diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/tag.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/tag.md new file mode 100644 index 000000000..26580a132 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/tag.md @@ -0,0 +1 @@ +*Optional.* The tag to track. Defaults to `latest`. \ No newline at end of file diff --git a/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/username.md b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/username.md new file mode 100644 index 000000000..cf075df25 --- /dev/null +++ b/vscode-extensions/vscode-concourse/src/main/resources/desc/DockerImageSource/username.md @@ -0,0 +1 @@ +*Optional.* The username to authenticate with when pushing. \ No newline at end of file diff --git a/vscode-extensions/vscode-concourse/src/test/java/org/springframework/ide/vscode/concourse/PipelineYamlEditorTest.java b/vscode-extensions/vscode-concourse/src/test/java/org/springframework/ide/vscode/concourse/PipelineYamlEditorTest.java index 47d8ab1a8..640788f3f 100644 --- a/vscode-extensions/vscode-concourse/src/test/java/org/springframework/ide/vscode/concourse/PipelineYamlEditorTest.java +++ b/vscode-extensions/vscode-concourse/src/test/java/org/springframework/ide/vscode/concourse/PipelineYamlEditorTest.java @@ -1122,6 +1122,114 @@ public class PipelineYamlEditorTest { editor.assertProblems("jobs: []|'name' is required"); } + + @Test public void dockerImageResourceSourceReconcile() throws Exception { + Editor editor; + + editor = harness.newEditor( + "resources:\n" + + "- name: my-docker-image\n" + + " type: docker-image\n" + + " source:\n" + + " tag: latest\n" + ); + editor.assertProblems("tag: latest|'repository' is required"); + + editor = harness.newEditor( + "resources:\n" + + "- name: my-docker-image\n" + + " type: docker-image\n" + + " source:\n" + + " repository: kdvolder/sts4-build-env\n" + + " tag: latest\n" + + " username: kdvolder\n" + + " password: {{docker_password}}\n" + + " aws_access_key_id: {{aws_access_key}}\n" + + " aws_secret_access_key: {{aws_secret_key}}\n" + + " insecure_registries: no-list\n" + + " registry_mirror: https://my-docker-registry.com\n" + + " ca_certs:\n" + + " - domain: example.com:443\n" + + " cert: |\n" + + " -----BEGIN CERTIFICATE-----\n" + + " ...\n" + + " -----END CERTIFICATE-----\n" + + " bogus_ca_certs_prop: bad\n" + + " client_certs:\n" + + " - domain: example.com:443\n" + + " cert: |\n" + + " -----BEGIN CERTIFICATE-----\n" + + " ...\n" + + " -----END CERTIFICATE-----\n" + + " key: |\n" + + " -----BEGIN RSA PRIVATE KEY-----\n" + + " ...\n" + + " -----END RSA PRIVATE KEY-----\n" + + " bogus_client_cert_prop: bad\n" + ); + editor.assertProblems( + "no-list|Expecting a 'Sequence'", + "bogus_ca_certs_prop|Unknown property", //ca_certs + "bogus_client_cert_prop|Unknown property" //client_certs + ); + } + + @Test public void dockerImageResourceSourceHovers() throws Exception { + Editor editor; + + editor = harness.newEditor( + "resources:\n" + + "- name: my-docker-image\n" + + " type: docker-image\n" + + " source:\n" + + " tag: latest\n" + ); + editor.assertProblems("tag: latest|'repository' is required"); + + editor = harness.newEditor( + "resources:\n" + + "- name: my-docker-image\n" + + " type: docker-image\n" + + " source:\n" + + " repository: kdvolder/sts4-build-env\n" + + " tag: latest\n" + + " username: kdvolder\n" + + " password: {{docker_password}}\n" + + " aws_access_key_id: {{aws_access_key}}\n" + + " aws_secret_access_key: {{aws_secret_key}}\n" + + " insecure_registries: no-list\n" + + " registry_mirror: https://my-docker-registry.com\n" + + " ca_certs:\n" + + " - domain: example.com:443\n" + + " cert: |\n" + + " -----BEGIN CERTIFICATE-----\n" + + " ...\n" + + " -----END CERTIFICATE-----\n" + + " bogus_ca_certs_prop: bad\n" + + " client_certs:\n" + + " - domain: example.com:443\n" + + " cert: |\n" + + " -----BEGIN CERTIFICATE-----\n" + + " ...\n" + + " -----END CERTIFICATE-----\n" + + " key: |\n" + + " -----BEGIN RSA PRIVATE KEY-----\n" + + " ...\n" + + " -----END RSA PRIVATE KEY-----\n" + + " bogus_client_cert_prop: bad\n" + ); + editor.assertHoverContains("repository", "The name of the repository"); + editor.assertHoverContains("tag", "The tag to track"); + editor.assertHoverContains("username", "username to authenticate"); + editor.assertHoverContains("password", "password to use"); + editor.assertHoverContains("aws_access_key_id", "AWS access key to use"); + editor.assertHoverContains("aws_secret_access_key", "AWS secret key to use"); + editor.assertHoverContains("insecure_registries", "array of CIDRs"); + editor.assertHoverContains("registry_mirror", "URL pointing to a docker registry"); + editor.assertHoverContains("ca_certs", "Each entry specifies the x509 CA certificate for"); + editor.assertHoverContains("client_certs", "Each entry specifies the x509 certificate and key"); + } + ////////////////////////////////////////////////////////////////////////////// private void assertContextualCompletions(String conText, String textBefore, String... textAfter) throws Exception {