Skip to content

Commit 94a64b0

Browse files
zlangbertzlangbert
committed
feat: add soci snapshotter extension
Adds the AWS SOCI containerd snapshotter, allowing for lazy pulls (similar to stargz)
1 parent 64a46a7 commit 94a64b0

File tree

8 files changed

+155
-0
lines changed

8 files changed

+155
-0
lines changed

‎container-runtime/soci-snapshotter/10-soci-snapshotter.part‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[proxy_plugins]
2+
[proxy_plugins.soci]
3+
type = "snapshot"
4+
address = "/var/run/soci-snapshotter/soci-snapshotter-grpc.sock"
5+
6+
[plugins."io.containerd.cri.v1.images"]
7+
snapshotter = "soci"
8+
disable_snapshot_annotations = false

‎container-runtime/soci-snapshotter/README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# AWS SOCI Snapshotter extension
2+
3+
## Installation
4+
5+
See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
6+
7+
## Pulling from Privte Registries
8+
9+
To pull from private registries an additional step is required. You must configure the Kubelet to use the SOCI snapshotter as an image service proxy. This is explained in more detail in the [SOCI docs](https://github.com/awslabs/soci-snapshotter/blob/main/docs/registry-authentication.md#kubernetes-cri-credentials). An example config patch:
10+
11+
```yaml
12+
machine:
13+
kubelet:
14+
extraConfig:
15+
imageServiceEndpoint: unix:///var/run/soci-snapshotter/soci-snapshotter-grpc.sock
16+
```

‎container-runtime/soci-snapshotter/config.toml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# SOCI Snapshotter configuration
2+
3+
# Enable use of the SOCI snapshotter as a proxy ImageService so it can pull
4+
# images from private registries.
5+
[cri_keychain]
6+
enable_keychain = true
7+
image_service_path = "/var/run/containerd/containerd.sock"

‎container-runtime/soci-snapshotter/manifest.yaml.tmpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: v1alpha1
2+
metadata:
3+
name: soci-snapshotter
4+
version: "{{ .VERSION }}"
5+
author: Sidero Labs
6+
description: |
7+
[{{ .TIER }}] This system extension provides AWS SOCI Snapshotter using containerd's runtime handler.
8+
compatibility:
9+
talos:
10+
version: ">= v1.8.0"

‎container-runtime/soci-snapshotter/pkg.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: soci-snapshotter
2+
variant: scratch
3+
shell: /bin/bash
4+
dependencies:
5+
- stage: base
6+
steps:
7+
- sources:
8+
- url: https://github.com/awslabs/soci-snapshotter/archive/refs/tags/{{ .SOCI_SNAPSHOTTER_VERSION }}.tar.gz
9+
destination: soci-snapshotter.tar.gz
10+
sha256: {{ .SOCI_SNAPSHOTTER_SHA256 }}
11+
sha512: {{ .SOCI_SNAPSHOTTER_SHA512 }}
12+
env:
13+
GOPATH: /tmp/go
14+
cachePaths:
15+
- /.cache/go-build
16+
- /tmp/go/pkg
17+
- network: default
18+
prepare:
19+
- |
20+
mkdir -p ${GOPATH}/src/github.com/awslabs/soci-snapshotter
21+
22+
tar -xzf soci-snapshotter.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/awslabs/soci-snapshotter
23+
- |
24+
cd ${GOPATH}/src/github.com/awslabs/soci-snapshotter/cmd
25+
go mod download
26+
- network: none
27+
build:
28+
- |
29+
cd ${GOPATH}/src/github.com/awslabs/soci-snapshotter
30+
31+
make soci-snapshotter-grpc
32+
make soci
33+
install:
34+
- |
35+
mkdir -p /rootfs/usr/local/bin
36+
mkdir -p /rootfs/usr/local/lib/containers/soci-snapshotter
37+
38+
cd ${GOPATH}/src/github.com/containerd/soci-snapshotter
39+
40+
cp ./out/soci-snapshotter-grpc /rootfs/usr/local/lib/containers/soci-snapshotter/soci-snapshotter-grpc
41+
chmod +x rootfs/usr/local/lib/containers/soci-snapshotter/soci-snapshotter-grpc
42+
43+
cp ./out/soci /rootfs/usr/local/lib/containers/soci-snapshotter/soci
44+
chmod +x rootfs/usr/local/lib/containers/soci-snapshotter/soci
45+
- |
46+
mkdir -p /rootfs/etc/cri/conf.d
47+
cp /pkg/10-soci-snapshotter.part /rootfs/etc/cri/conf.d/10-soci-snapshotter.part
48+
49+
mkdir -p /rootfs/usr/local/etc/soci-snapshotter-grpc
50+
cp /pkg/config.toml /rootfs/usr/local/etc/soci-snapshotter-grpc/config.toml
51+
52+
mkdir -p /rootfs/usr/local/etc/containers
53+
cp /pkg/soci-snapshotter.yaml /rootfs/usr/local/etc/containers/
54+
test:
55+
- |
56+
mkdir -p /extensions-validator-rootfs
57+
cp -r /rootfs/ /extensions-validator-rootfs/rootfs
58+
cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
59+
/extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
60+
sbom:
61+
outputPath: /rootfs/usr/local/share/spdx/soci-snapshotter.spdx.json
62+
version: {{ .SOCI_SNAPSHOTTER_VERSION }}
63+
licenses:
64+
- Apache-2.0
65+
finalize:
66+
- from: /rootfs
67+
to: /rootfs
68+
- from: /pkg/manifest.yaml
69+
to: /

‎container-runtime/soci-snapshotter/soci-snapshotter.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: soci-snapshotter
2+
depends:
3+
- service: cri
4+
restart: always
5+
container:
6+
entrypoint: ./soci-snapshotter-grpc
7+
args:
8+
- -log-level=debug
9+
- -address=/var/run/soci-snapshotter/soci-snapshotter-grpc.sock
10+
- -root=/var/lib/containerd/io.containerd.snapshotter.v1.soci
11+
security:
12+
rootfsPropagation: shared
13+
mounts:
14+
- source: /var
15+
destination: /var
16+
type: bind
17+
options:
18+
- rshared
19+
- rbind
20+
- rw
21+
- source: /run
22+
destination: /run
23+
type: bind
24+
options:
25+
- rshared
26+
- rbind
27+
- rw
28+
- source: /etc/ssl/certs
29+
destination: /etc/ssl/certs
30+
type: bind
31+
options:
32+
- rbind
33+
- ro
34+
- source: /usr/local/etc/soci-snapshotter-grpc
35+
destination: /etc/soci-snapshotter-grpc
36+
type: bind
37+
options:
38+
- bind
39+
- ro

‎container-runtime/soci-snapshotter/vars.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
VERSION: "{{ .SOCI_SNAPSHOTTER_VERSION }}"
2+
TIER: "extra"

‎container-runtime/vars.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ GVISOR_SHA512: 0e7327735f37f38430ca1b32a708de95c280a62c2bcec14afcdcd18b20f114326
99
STARGZ_SNAPSHOTTER_VERSION: v0.18.0
1010
STARGZ_SNAPSHOTTER_SHA256: 674062cea54d3d4908da6155a484f09e3a249f8625689643d4800893df09fcea
1111
STARGZ_SNAPSHOTTER_SHA512: 7134372586f5fd8d9b29d6cc44638defa5abd5f3d398bf63123edfa1f00abc0e607848b36a6fad16a730aafb218a6d0d5b5d6321ad0c63f116d10cc12de18d79
12+
# renovate: datasource=github-releases depName=awslabs/soci-snapshotter
13+
SOCI_SNAPSHOTTER_VERSION: v0.11.1
14+
SOCI_SNAPSHOTTER_SHA256: cabeac915c9bd31c5ab16dd11ef3fb46ce9f9b707428b88319aa8940b9de3b5a
15+
SOCI_SNAPSHOTTER_SHA512: f42bf8bf1121cce918ed9cfab542d81e2ee5562fe42ef2d4806b7cf78da2e3e15f830eb86fc1dbc17fc0f1f2566723a4db3feadb473e66c06f2f5bbf21f69588
1216
# renovate: datasource=github-releases depName=kubernetes/cloud-provider-aws
1317
CLOUD_PROVIDER_AWS_VERSION: v1.34.1
1418
CLOUD_PROVIDER_AWS_SHA256: 41acb02dcbf3357d2f2f910a9dcc2a115b1f8eecc9d02c3df089e116a0a63905

0 commit comments

Comments
 (0)