Skip to content

Commit d02840d

Browse files
zlangbertfrezbo
zlangbert
authored and
frezbo
committed
feat: add soci snapshotter extension
Adds the AWS SOCI containerd snapshotter, allowing for lazy pulls (similar to stargz) Signed-off-by: Noel Georgi <[email protected]>
1 parent 313ae03 commit d02840d

File tree

10 files changed

+154
-0
lines changed

10 files changed

+154
-0
lines changed

‎.kres.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ spec:
5353
- qlogic-firmware
5454
- realtek-firmware
5555
- revpi-firmware
56+
- soci-snapshotter
5657
- spin
5758
- stargz-snapshotter
5859
- tailscale

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ TARGETS += qemu-guest-agent
110110
TARGETS += qlogic-firmware
111111
TARGETS += realtek-firmware
112112
TARGETS += revpi-firmware
113+
TARGETS += soci-snapshotter
113114
TARGETS += spin
114115
TARGETS += stargz-snapshotter
115116
TARGETS += tailscale

‎container-runtime/soci-snapshotter/10-soci-snapshotter.part‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[proxy_plugins]
2+
[proxy_plugins.soci]
3+
type = "snapshot"
4+
address = "/var/run/soci-snapshotter/soci-snapshotter-grpc.sock"
5+
6+
[plugins."io.containerd.cri.v1.images"]
7+
snapshotter = "soci"
8+
disable_snapshot_annotations = false

‎container-runtime/soci-snapshotter/README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# AWS SOCI Snapshotter extension
2+
3+
## Installation
4+
5+
See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
6+
7+
## Pulling from Privte Registries
8+
9+
To pull from private registries an additional step is required. You must configure the Kubelet to use the SOCI snapshotter as an image service proxy. This is explained in more detail in the [SOCI docs](https://github.com/awslabs/soci-snapshotter/blob/main/docs/registry-authentication.md#kubernetes-cri-credentials). An example config patch:
10+
11+
```yaml
12+
machine:
13+
kubelet:
14+
extraConfig:
15+
imageServiceEndpoint: unix:///var/run/soci-snapshotter/soci-snapshotter-grpc.sock
16+
```

‎container-runtime/soci-snapshotter/config.toml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# SOCI Snapshotter configuration
2+
3+
# Enable use of the SOCI snapshotter as a proxy ImageService so it can pull
4+
# images from private registries.
5+
[cri_keychain]
6+
enable_keychain = true
7+
image_service_path = "/var/run/containerd/containerd.sock"

‎container-runtime/soci-snapshotter/manifest.yaml.tmpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: v1alpha1
2+
metadata:
3+
name: soci-snapshotter
4+
version: "{{ .VERSION }}"
5+
author: Sidero Labs
6+
description: |
7+
[{{ .TIER }}] This system extension provides AWS SOCI Snapshotter using containerd's runtime handler.
8+
compatibility:
9+
talos:
10+
version: ">= v1.8.0"

‎container-runtime/soci-snapshotter/pkg.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: soci-snapshotter
2+
variant: scratch
3+
shell: /bin/bash
4+
dependencies:
5+
- stage: base
6+
steps:
7+
- sources:
8+
- url: https://github.com/awslabs/soci-snapshotter/archive/refs/tags/{{ .SOCI_SNAPSHOTTER_VERSION }}.tar.gz
9+
destination: soci-snapshotter.tar.gz
10+
sha256: {{ .SOCI_SNAPSHOTTER_SHA256 }}
11+
sha512: {{ .SOCI_SNAPSHOTTER_SHA512 }}
12+
env:
13+
GOPATH: /tmp/go
14+
VERSION: {{ .SOCI_SNAPSHOTTER_VERSION }}
15+
REVISION: {{ .SOCI_SNAPSHOTTER_REV }}
16+
cachePaths:
17+
- /.cache/go-build
18+
- /tmp/go/pkg
19+
- network: default
20+
prepare:
21+
- |
22+
mkdir -p ${GOPATH}/src/github.com/awslabs/soci-snapshotter
23+
24+
tar -xzf soci-snapshotter.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/awslabs/soci-snapshotter
25+
- |
26+
cd ${GOPATH}/src/github.com/awslabs/soci-snapshotter/cmd
27+
go mod download
28+
- network: none
29+
build:
30+
- |
31+
cd ${GOPATH}/src/github.com/awslabs/soci-snapshotter
32+
33+
make soci-snapshotter-grpc
34+
make soci
35+
install:
36+
- |
37+
mkdir -p /rootfs/usr/local/bin
38+
mkdir -p /rootfs/usr/local/lib/containers/soci-snapshotter
39+
40+
cd ${GOPATH}/src/github.com/awslabs/soci-snapshotter
41+
42+
cp ./out/soci-snapshotter-grpc /rootfs/usr/local/lib/containers/soci-snapshotter/soci-snapshotter-grpc
43+
chmod +x /rootfs/usr/local/lib/containers/soci-snapshotter/soci-snapshotter-grpc
44+
45+
cp ./out/soci /rootfs/usr/local/lib/containers/soci-snapshotter/soci
46+
chmod +x /rootfs/usr/local/lib/containers/soci-snapshotter/soci
47+
48+
mkdir -p /rootfs/usr/local/lib/containers/soci-snapshotter/etc/soci-snapshotter-grpc/
49+
cp /pkg/config.toml /rootfs/usr/local/lib/containers/soci-snapshotter/etc/soci-snapshotter-grpc/config.toml
50+
- |
51+
mkdir -p /rootfs/etc/cri/conf.d
52+
cp /pkg/10-soci-snapshotter.part /rootfs/etc/cri/conf.d/10-soci-snapshotter.part
53+
54+
mkdir -p /rootfs/usr/local/etc/containers
55+
cp /pkg/soci-snapshotter.yaml /rootfs/usr/local/etc/containers/
56+
test:
57+
- |
58+
mkdir -p /extensions-validator-rootfs
59+
cp -r /rootfs/ /extensions-validator-rootfs/rootfs
60+
cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
61+
/extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
62+
sbom:
63+
outputPath: /rootfs/usr/local/share/spdx/soci-snapshotter.spdx.json
64+
version: {{ .SOCI_SNAPSHOTTER_VERSION }}
65+
licenses:
66+
- Apache-2.0
67+
finalize:
68+
- from: /rootfs
69+
to: /rootfs
70+
- from: /pkg/manifest.yaml
71+
to: /

‎container-runtime/soci-snapshotter/soci-snapshotter.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: soci-snapshotter
2+
depends:
3+
- service: cri
4+
restart: always
5+
container:
6+
entrypoint: ./soci-snapshotter-grpc
7+
args:
8+
- -log-level=debug
9+
- -address=/var/run/soci-snapshotter/soci-snapshotter-grpc.sock
10+
- -root=/var/lib/containerd/io.containerd.snapshotter.v1.soci
11+
security:
12+
rootfsPropagation: shared
13+
mounts:
14+
- source: /var
15+
destination: /var
16+
type: bind
17+
options:
18+
- rshared
19+
- rbind
20+
- rw
21+
- source: /run
22+
destination: /run
23+
type: bind
24+
options:
25+
- rshared
26+
- rbind
27+
- rw
28+
- source: /etc/ssl/certs
29+
destination: /etc/ssl/certs
30+
type: bind
31+
options:
32+
- rbind
33+
- ro

‎container-runtime/soci-snapshotter/vars.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
VERSION: "{{ .SOCI_SNAPSHOTTER_VERSION }}"
2+
TIER: "extra"

‎container-runtime/vars.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@ GVISOR_SHA512: 038631f7b6e03ca14b2a038b51756b0ce8e3f9b490deebe4938419e82f98c9e81
99
STARGZ_SNAPSHOTTER_VERSION: v0.18.1
1010
STARGZ_SNAPSHOTTER_SHA256: 42e9bf7536a3c1eca2160b58fc865de47f6a338f30bb88a25fe50ed8b0d130e3
1111
STARGZ_SNAPSHOTTER_SHA512: 076943cd8488bf58b0fd54b41471f99d0289b4fc63f66549fb946c82fdb7e68794c215b8b9ed0e858cf12227db59bf7a360004d5232b6c090decdbb36a1bd323
12+
# renovate: datasource=github-releases depName=awslabs/soci-snapshotter
13+
SOCI_SNAPSHOTTER_VERSION: v0.11.1
14+
SOCI_SNAPSHOTTER_REV: 28781de6731978b2e2f0f43573a345e9fa14dbd1
15+
SOCI_SNAPSHOTTER_SHA256: cabeac915c9bd31c5ab16dd11ef3fb46ce9f9b707428b88319aa8940b9de3b5a
16+
SOCI_SNAPSHOTTER_SHA512: f42bf8bf1121cce918ed9cfab542d81e2ee5562fe42ef2d4806b7cf78da2e3e15f830eb86fc1dbc17fc0f1f2566723a4db3feadb473e66c06f2f5bbf21f69588
1217
# renovate: datasource=github-releases depName=kubernetes/cloud-provider-aws
1318
CLOUD_PROVIDER_AWS_VERSION: v1.34.1
1419
CLOUD_PROVIDER_AWS_SHA256: 41acb02dcbf3357d2f2f910a9dcc2a115b1f8eecc9d02c3df089e116a0a63905

0 commit comments

Comments
 (0)