add oci pull to images

[mac641]

Description

References

• Demo how a oci image puller might look like #169
• Support SHA512 hash for image verification #154
• add oci config pixie#40
• implement image check for oci pull metal-api#635

TODO

• how are oci credentials supposed to be retrieved?
• add tests

[mac641]

@majst01 okay, so this is what I came up with. Can you do a review, pls?

Besides, I'm wondering if it's suitable to retrieve the oci credentials from env vars. Can you help me out here?

[majst01]

@majst01 okay, so this is what I came up with. Can you do a review, pls?

Besides, I'm wondering if it's suitable to retrieve the oci credentials from env vars. Can you help me out here?

The OCI creadentials should be passed as optional fields from the pixiecore to the metal-hammer:

https://github.com/metal-stack/metal-hammer/blob/master/cmd/pixie-client.go#L14

Ideally a slice of registryconfig which contains the registry url, the username and the password should come from pixiecore.

[mac641]

@majst01 does this work? https://github.com/metal-stack/metal-hammer/pull/175/files#diff-cfcd5a78ad9476ee24d7680dd023e71136f329c771d76ae6837ba68320b6379cR37

what does machine.Allocation.Image.URL contain? Is it the full oci url or just the image name, e.g. debian:12?

[majst01]

@majst01 does this work? https://github.com/metal-stack/metal-hammer/pull/175/files#diff-cfcd5a78ad9476ee24d7680dd023e71136f329c771d76ae6837ba68320b6379cR37

what does machine.Allocation.Image.URL contain? Is it the full oci url or just the image name, e.g. debian:12?

It contains the full URL as configured in the image

[majst01]

Unsure if all cases are covered and or relevant.

Other pitfalls might be:

• files with s-bit set
• file modes of special files like /etc/shadow /etc/passwd etc.

This should be tested, at least manually, better would be with a automated test ?

[mac641]

@majst01 So, I've been adding a couple of tests, mainly targeting s-bits and symlinks but it's impossible to test special files like /etc/shadow etc. without root permissions. I was considering an in-memory filesystem like afero as well but this would require dependency injection to work which would end up in a lot of refactoring. I think this is out-of-scope.
What do you think? Shall we skip the special files test? How would you tackle this problem?