Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove deprecated ADDITIONAL_OCI_ARTIFACT_TYPES #1590

Merged
merged 1 commit into from
Apr 30, 2024
Merged

Remove deprecated ADDITIONAL_OCI_ARTIFACT_TYPES #1590

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGES/1537.removal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Removed the deprecated `ADDITIONAL_OCI_ARTIFACT_TYPES` setting.
56 changes: 6 additions & 50 deletions docs/workflows/oci-artifacts.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,58 +3,14 @@ Managing additional OCI media types

.. _default-oci-types:

By default the following list of media types is enabled in the Container Registry::
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would not remove entirely this file and leave a section in documentation stating that we are an OCI artifact registry. I would reword some of these docs with few examples what kind of additional to regular mediatypes we support ( out of the box) so it is clear for the end user that we are not just container but also artifact registry.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about we mention this information on our landing page (https://docs.pulpproject.org/pulp_container/)? I do not think it is necessary to have a dedicated page for it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could be going both ways, however my preference would be to have it in a separate page for better readability and not cluttering the landing page
Example https://docs.docker.com/docker-hub/oci-artifacts/

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@git-hyagi, do you think we should keep this doc section? If so, we may want to revisit the paragraphs and state clearly that we support OCI Artifacts, e.g., by referencing helm charts and providing more insights into what a generic OCI Artifact might look like. Of course, omitting the removed setting.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am in favor of keeping this doc section and rewriting the paragraphs to make it clear that this not just a container registry.

Pulp is not only a container registry, it also supports OCI artifacts by leveraging the config property on the image manifest.
Here are some examples of compliant OCI artifacts supported by `pulp_container` plugin::

* OCI images
* Helm
* Cosign, SBOMs, attestations
* [OCI images](./workflows/build-containerfile.rst)
* [Helm](./workflows/helm-support.rst)
* [Flatpak images](./workflows/flatpak-support.rst)
* [Cosign, SBOMs, attestations](./workflows/cosign-support.rst)
* Source containers
* Singularity
* Conftest policies
* WASM

.. note::

The ``ADDITIONAL_OCI_ARTIFACT_TYPES`` is deprecated and will be removed in a future release.
Since the validation of media types is not part of the OCI standard and new types keep being
added we decided to deprecate this configuration.

For any other OCI media type that is not supported by default, you can add them to the
``ADDITIONAL_OCI_ARTIFACT_TYPES`` setting using the following format::

ADDITIONAL_OCI_ARTIFACT_TYPES = {
"<oci config type 1>": [
"<oci layer type A>",
"<oci layer type B>",
],
"<oci config type 2>": [
"<oci layer type C>",
"<oci layer type D>",
],
}


For example, you can add support for custom defined mediatype by adding the following to your
``ADDITIONAL_OCI_ARTIFACT_TYPES`` setting::

ADDITIONAL_OCI_ARTIFACT_TYPES = {
"<oci config type 1>": [
"<oci layer type A>",
"<oci layer type B>",
],
"<oci config type 2>": [
"<oci layer type C>",
"<oci layer type D>",
],
"application/vnd.guardians.groot.config.v1+json": [
"text/plain",
"application/vnd.guardians.groot.docs.layer.v1+tar",
],
}

.. note::

When adding OCI media types that are not configured by default, it is necessary then to manually add
the :ref:`Default oci types<default-oci-types>` to the list.
The OCI image-spec types are supported by default, they are built-in and cannot be disabled, it is
not necessary to add them manually to the list.
9 changes: 0 additions & 9 deletions pulp_container/app/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,3 @@ class PulpContainerPluginAppConfig(PulpPluginAppConfig):

def ready(self):
super().ready()
self.register_registry_types()

def register_registry_types(self):
# circular import avoidance
from pulp_container import constants
from django.conf import settings

for media_type, layer_types in settings.ADDITIONAL_OCI_ARTIFACT_TYPES.items():
constants.register_well_known_types(media_type, layer_types)
44 changes: 0 additions & 44 deletions pulp_container/app/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,50 +3,6 @@
"reusable_conditions": ["pulp_container.app.global_access_conditions"],
}

ADDITIONAL_OCI_ARTIFACT_TYPES = {
"application/vnd.oci.image.config.v1+json": [
# cosign signing and attestations
"application/vnd.dev.cosign.simplesigning.v1+json",
"application/vnd.dsse.envelope.v1+json",
# cosign SBOMS spdx and cyclonedx
"text/spdx",
"text/spdx+xml",
"text/spdx+json",
"application/vnd.cyclonedx",
"application/vnd.cyclonedx+xml",
"application/vnd.cyclonedx+json",
# syft SBOMS
"application/vnd.syft+json",
# cosign in-toto attestations
"application/vnd.in-toto+json",
],
# helm
"application/vnd.cncf.helm.config.v1+json": [
"application/tar+gzip",
"application/vnd.cncf.helm.chart.content.v1.tar+gzip",
"application/vnd.cncf.helm.chart.provenance.v1.prov",
],
# source containers
"application/vnd.oci.source.image.config.v1+json": [
"application/vnd.oci.image.layer.v1.tar+gzip",
],
# conftest policies
"application/vnd.cncf.openpolicyagent.config.v1+json": [
"application/vnd.cncf.openpolicyagent.policy.layer.v1+rego",
"application/vnd.cncf.openpolicyagent.data.layer.v1+json",
"application/vnd.cncf.openpolicyagent.manifest.layer.v1+json",
"application/vnd.cncf.openpolicyagent.rego.layer.v1+rego",
],
# singularity
"application/vnd.sylabs.sif.config.v1+json": [
"application/vnd.sylabs.sif.layer.v1.sif",
],
# wasm
"application/vnd.wasm.config.v1+json": [
"application/vnd.wasm.content.layer.v1+wasm",
],
}

FLATPAK_INDEX = False

# The number of allowed threads to sign manifests in parallel
Expand Down
8 changes: 4 additions & 4 deletions pulp_container/app/utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@

from pulpcore.plugin.models import Artifact, Task

from pulp_container.constants import ALLOWED_ARTIFACT_TYPES, MANIFEST_MEDIA_TYPES, MEDIA_TYPE
from pulp_container.constants import MANIFEST_MEDIA_TYPES, MEDIA_TYPE
from pulp_container.app.exceptions import ManifestInvalid
from pulp_container.app.json_schemas import (
OCI_INDEX_SCHEMA,
Expand Down Expand Up @@ -177,10 +177,10 @@ def determine_media_type_from_json(content_data):
else:
if config := content_data.get("config"):
config_media_type = config.get("mediaType")
if config_media_type in ALLOWED_ARTIFACT_TYPES:
return MEDIA_TYPE.MANIFEST_OCI
else:
if config_media_type == MEDIA_TYPE.CONFIG_BLOB:
return MEDIA_TYPE.MANIFEST_V2
else:
return MEDIA_TYPE.MANIFEST_OCI
else:
return MEDIA_TYPE.MANIFEST_V1

Expand Down
13 changes: 0 additions & 13 deletions pulp_container/constants.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,16 +71,3 @@
SIGNATURE_PAYLOAD_MAX_SIZE = 4 * MEGABYTE

SIGNATURE_API_EXTENSION_VERSION = 2


ALLOWED_ARTIFACT_TYPES = [MEDIA_TYPE.CONFIG_BLOB_OCI, MEDIA_TYPE.OCI_EMPTY_JSON]
ALLOWED_BLOB_CONTENT_TYPES = OCI_BLOB_MEDIA_TYPE


def register_well_known_types(artifact_config_type, artifact_layer_types):
if artifact_config_type not in ALLOWED_ARTIFACT_TYPES:
ALLOWED_ARTIFACT_TYPES.append(artifact_config_type)

for layer_type in artifact_layer_types:
if layer_type not in ALLOWED_BLOB_CONTENT_TYPES:
ALLOWED_BLOB_CONTENT_TYPES.append(layer_type)
75 changes: 14 additions & 61 deletions staging_docs/admin/guides/change-allowed-artifacts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,61 +1,14 @@
# Configure Supported OCI Types

By default, the following list of media types is enabled in the Container Registry:

* OCI images
* Helm
* Cosign, SBOMs, attestations
* Source containers
* Singularity
* Conftest policies
* WASM

!!! note

The `ADDITIONAL_OCI_ARTIFACT_TYPES` is deprecated and will be removed in a future release.
Since the validation of media types is not part of the OCI standard and new types keep being
added we decided to deprecate this configuration.

For any other OCI media type that is not supported by default, you can add them to the
`ADDITIONAL_OCI_ARTIFACT_TYPES` setting using the following format:

```
ADDITIONAL_OCI_ARTIFACT_TYPES = {
"<oci config type 1>": [
"<oci layer type A>",
"<oci layer type B>",
],
"<oci config type 2>": [
"<oci layer type C>",
"<oci layer type D>",
],
}
```

For example, you can add support for custom defined mediatype by adding the following to your
`ADDITIONAL_OCI_ARTIFACT_TYPES` setting:

```
ADDITIONAL_OCI_ARTIFACT_TYPES = {
"<oci config type 1>": [
"<oci layer type A>",
"<oci layer type B>",
],
"<oci config type 2>": [
"<oci layer type C>",
"<oci layer type D>",
],
"application/vnd.guardians.groot.config.v1+json": [
"text/plain",
"application/vnd.guardians.groot.docs.layer.v1+tar",
],
}

```

!!! note

When adding OCI media types that are not configured by default, it is necessary then to manually add
the `Default oci types<default-oci-types>` to the list.
The OCI image-spec types are supported by default, they are built-in and cannot be disabled, it is
not necessary to add them manually to the list.
# Support To OCI Artifacts

Pulp is not only a container registry, it also supports OCI artifacts by leveraging the config
property on the image manifest.
Here are some examples of compliant OCI artifacts supported by `pulp_container` plugin:

* [OCI images](site:pulp_container/docs/user/guides/manage-image)
* [Helm](site:pulp_container/docs/user/guides/manage-helm-chart)
* [Flatpak images](site:pulp_container/docs/user/guides/manage-flatpak)
* [Cosign, SBOMs, attestations](site:pulp_container/docs/user/guides/manage-cosign-signature)
* Source containers
* Singularity
* Conftest policies
* WASM
Loading