github.com/devdivbcp/moby@v17.12.0-ce-rc1.0.20200726071732-2d4bfdc789ad+incompatible/daemon/cluster/services.go (about) 1 package cluster // import "github.com/docker/docker/daemon/cluster" 2 3 import ( 4 "context" 5 "encoding/base64" 6 "encoding/json" 7 "fmt" 8 "io" 9 "os" 10 "strconv" 11 "strings" 12 "time" 13 14 "github.com/docker/distribution/reference" 15 apitypes "github.com/docker/docker/api/types" 16 "github.com/docker/docker/api/types/backend" 17 types "github.com/docker/docker/api/types/swarm" 18 timetypes "github.com/docker/docker/api/types/time" 19 "github.com/docker/docker/daemon/cluster/convert" 20 "github.com/docker/docker/errdefs" 21 runconfigopts "github.com/docker/docker/runconfig/opts" 22 swarmapi "github.com/docker/swarmkit/api" 23 gogotypes "github.com/gogo/protobuf/types" 24 "github.com/pkg/errors" 25 "github.com/sirupsen/logrus" 26 "google.golang.org/grpc" 27 ) 28 29 // GetServices returns all services of a managed swarm cluster. 30 func (c *Cluster) GetServices(options apitypes.ServiceListOptions) ([]types.Service, error) { 31 c.mu.RLock() 32 defer c.mu.RUnlock() 33 34 state := c.currentNodeState() 35 if !state.IsActiveManager() { 36 return nil, c.errNoManager(state) 37 } 38 39 // We move the accepted filter check here as "mode" filter 40 // is processed in the daemon, not in SwarmKit. So it might 41 // be good to have accepted file check in the same file as 42 // the filter processing (in the for loop below). 43 accepted := map[string]bool{ 44 "name": true, 45 "id": true, 46 "label": true, 47 "mode": true, 48 "runtime": true, 49 } 50 if err := options.Filters.Validate(accepted); err != nil { 51 return nil, err 52 } 53 54 if len(options.Filters.Get("runtime")) == 0 { 55 // Default to using the container runtime filter 56 options.Filters.Add("runtime", string(types.RuntimeContainer)) 57 } 58 59 filters := &swarmapi.ListServicesRequest_Filters{ 60 NamePrefixes: options.Filters.Get("name"), 61 IDPrefixes: options.Filters.Get("id"), 62 Labels: runconfigopts.ConvertKVStringsToMap(options.Filters.Get("label")), 63 Runtimes: options.Filters.Get("runtime"), 64 } 65 66 ctx, cancel := c.getRequestContext() 67 defer cancel() 68 69 r, err := state.controlClient.ListServices( 70 ctx, 71 &swarmapi.ListServicesRequest{Filters: filters}, 72 grpc.MaxCallRecvMsgSize(defaultRecvSizeForListResponse), 73 ) 74 if err != nil { 75 return nil, err 76 } 77 78 services := make([]types.Service, 0, len(r.Services)) 79 80 for _, service := range r.Services { 81 if options.Filters.Contains("mode") { 82 var mode string 83 switch service.Spec.GetMode().(type) { 84 case *swarmapi.ServiceSpec_Global: 85 mode = "global" 86 case *swarmapi.ServiceSpec_Replicated: 87 mode = "replicated" 88 } 89 90 if !options.Filters.ExactMatch("mode", mode) { 91 continue 92 } 93 } 94 svcs, err := convert.ServiceFromGRPC(*service) 95 if err != nil { 96 return nil, err 97 } 98 services = append(services, svcs) 99 } 100 101 return services, nil 102 } 103 104 // GetService returns a service based on an ID or name. 105 func (c *Cluster) GetService(input string, insertDefaults bool) (types.Service, error) { 106 var service *swarmapi.Service 107 if err := c.lockedManagerAction(func(ctx context.Context, state nodeState) error { 108 s, err := getService(ctx, state.controlClient, input, insertDefaults) 109 if err != nil { 110 return err 111 } 112 service = s 113 return nil 114 }); err != nil { 115 return types.Service{}, err 116 } 117 svc, err := convert.ServiceFromGRPC(*service) 118 if err != nil { 119 return types.Service{}, err 120 } 121 return svc, nil 122 } 123 124 // CreateService creates a new service in a managed swarm cluster. 125 func (c *Cluster) CreateService(s types.ServiceSpec, encodedAuth string, queryRegistry bool) (*apitypes.ServiceCreateResponse, error) { 126 var resp *apitypes.ServiceCreateResponse 127 err := c.lockedManagerAction(func(ctx context.Context, state nodeState) error { 128 err := c.populateNetworkID(ctx, state.controlClient, &s) 129 if err != nil { 130 return err 131 } 132 133 serviceSpec, err := convert.ServiceSpecToGRPC(s) 134 if err != nil { 135 return errdefs.InvalidParameter(err) 136 } 137 138 resp = &apitypes.ServiceCreateResponse{} 139 140 switch serviceSpec.Task.Runtime.(type) { 141 case *swarmapi.TaskSpec_Attachment: 142 return fmt.Errorf("invalid task spec: spec type %q not supported", types.RuntimeNetworkAttachment) 143 // handle other runtimes here 144 case *swarmapi.TaskSpec_Generic: 145 switch serviceSpec.Task.GetGeneric().Kind { 146 case string(types.RuntimePlugin): 147 if !c.config.Backend.HasExperimental() { 148 return fmt.Errorf("runtime type %q only supported in experimental", types.RuntimePlugin) 149 } 150 if s.TaskTemplate.PluginSpec == nil { 151 return errors.New("plugin spec must be set") 152 } 153 154 default: 155 return fmt.Errorf("unsupported runtime type: %q", serviceSpec.Task.GetGeneric().Kind) 156 } 157 158 r, err := state.controlClient.CreateService(ctx, &swarmapi.CreateServiceRequest{Spec: &serviceSpec}) 159 if err != nil { 160 return err 161 } 162 163 resp.ID = r.Service.ID 164 case *swarmapi.TaskSpec_Container: 165 ctnr := serviceSpec.Task.GetContainer() 166 if ctnr == nil { 167 return errors.New("service does not use container tasks") 168 } 169 if encodedAuth != "" { 170 ctnr.PullOptions = &swarmapi.ContainerSpec_PullOptions{RegistryAuth: encodedAuth} 171 } 172 173 // retrieve auth config from encoded auth 174 authConfig := &apitypes.AuthConfig{} 175 if encodedAuth != "" { 176 authReader := strings.NewReader(encodedAuth) 177 dec := json.NewDecoder(base64.NewDecoder(base64.URLEncoding, authReader)) 178 if err := dec.Decode(authConfig); err != nil { 179 logrus.Warnf("invalid authconfig: %v", err) 180 } 181 } 182 183 // pin image by digest for API versions < 1.30 184 // TODO(nishanttotla): The check on "DOCKER_SERVICE_PREFER_OFFLINE_IMAGE" 185 // should be removed in the future. Since integration tests only use the 186 // latest API version, so this is no longer required. 187 if os.Getenv("DOCKER_SERVICE_PREFER_OFFLINE_IMAGE") != "1" && queryRegistry { 188 digestImage, err := c.imageWithDigestString(ctx, ctnr.Image, authConfig) 189 if err != nil { 190 logrus.Warnf("unable to pin image %s to digest: %s", ctnr.Image, err.Error()) 191 // warning in the client response should be concise 192 resp.Warnings = append(resp.Warnings, digestWarning(ctnr.Image)) 193 194 } else if ctnr.Image != digestImage { 195 logrus.Debugf("pinning image %s by digest: %s", ctnr.Image, digestImage) 196 ctnr.Image = digestImage 197 198 } else { 199 logrus.Debugf("creating service using supplied digest reference %s", ctnr.Image) 200 201 } 202 203 // Replace the context with a fresh one. 204 // If we timed out while communicating with the 205 // registry, then "ctx" will already be expired, which 206 // would cause UpdateService below to fail. Reusing 207 // "ctx" could make it impossible to create a service 208 // if the registry is slow or unresponsive. 209 var cancel func() 210 ctx, cancel = c.getRequestContext() 211 defer cancel() 212 } 213 214 r, err := state.controlClient.CreateService(ctx, &swarmapi.CreateServiceRequest{Spec: &serviceSpec}) 215 if err != nil { 216 return err 217 } 218 219 resp.ID = r.Service.ID 220 } 221 return nil 222 }) 223 224 return resp, err 225 } 226 227 // UpdateService updates existing service to match new properties. 228 func (c *Cluster) UpdateService(serviceIDOrName string, version uint64, spec types.ServiceSpec, flags apitypes.ServiceUpdateOptions, queryRegistry bool) (*apitypes.ServiceUpdateResponse, error) { 229 var resp *apitypes.ServiceUpdateResponse 230 231 err := c.lockedManagerAction(func(ctx context.Context, state nodeState) error { 232 233 err := c.populateNetworkID(ctx, state.controlClient, &spec) 234 if err != nil { 235 return err 236 } 237 238 serviceSpec, err := convert.ServiceSpecToGRPC(spec) 239 if err != nil { 240 return errdefs.InvalidParameter(err) 241 } 242 243 currentService, err := getService(ctx, state.controlClient, serviceIDOrName, false) 244 if err != nil { 245 return err 246 } 247 248 resp = &apitypes.ServiceUpdateResponse{} 249 250 switch serviceSpec.Task.Runtime.(type) { 251 case *swarmapi.TaskSpec_Attachment: 252 return fmt.Errorf("invalid task spec: spec type %q not supported", types.RuntimeNetworkAttachment) 253 case *swarmapi.TaskSpec_Generic: 254 switch serviceSpec.Task.GetGeneric().Kind { 255 case string(types.RuntimePlugin): 256 if spec.TaskTemplate.PluginSpec == nil { 257 return errors.New("plugin spec must be set") 258 } 259 } 260 case *swarmapi.TaskSpec_Container: 261 newCtnr := serviceSpec.Task.GetContainer() 262 if newCtnr == nil { 263 return errors.New("service does not use container tasks") 264 } 265 266 encodedAuth := flags.EncodedRegistryAuth 267 if encodedAuth != "" { 268 newCtnr.PullOptions = &swarmapi.ContainerSpec_PullOptions{RegistryAuth: encodedAuth} 269 } else { 270 // this is needed because if the encodedAuth isn't being updated then we 271 // shouldn't lose it, and continue to use the one that was already present 272 var ctnr *swarmapi.ContainerSpec 273 switch flags.RegistryAuthFrom { 274 case apitypes.RegistryAuthFromSpec, "": 275 ctnr = currentService.Spec.Task.GetContainer() 276 case apitypes.RegistryAuthFromPreviousSpec: 277 if currentService.PreviousSpec == nil { 278 return errors.New("service does not have a previous spec") 279 } 280 ctnr = currentService.PreviousSpec.Task.GetContainer() 281 default: 282 return errors.New("unsupported registryAuthFrom value") 283 } 284 if ctnr == nil { 285 return errors.New("service does not use container tasks") 286 } 287 newCtnr.PullOptions = ctnr.PullOptions 288 // update encodedAuth so it can be used to pin image by digest 289 if ctnr.PullOptions != nil { 290 encodedAuth = ctnr.PullOptions.RegistryAuth 291 } 292 } 293 294 // retrieve auth config from encoded auth 295 authConfig := &apitypes.AuthConfig{} 296 if encodedAuth != "" { 297 if err := json.NewDecoder(base64.NewDecoder(base64.URLEncoding, strings.NewReader(encodedAuth))).Decode(authConfig); err != nil { 298 logrus.Warnf("invalid authconfig: %v", err) 299 } 300 } 301 302 // pin image by digest for API versions < 1.30 303 // TODO(nishanttotla): The check on "DOCKER_SERVICE_PREFER_OFFLINE_IMAGE" 304 // should be removed in the future. Since integration tests only use the 305 // latest API version, so this is no longer required. 306 if os.Getenv("DOCKER_SERVICE_PREFER_OFFLINE_IMAGE") != "1" && queryRegistry { 307 digestImage, err := c.imageWithDigestString(ctx, newCtnr.Image, authConfig) 308 if err != nil { 309 logrus.Warnf("unable to pin image %s to digest: %s", newCtnr.Image, err.Error()) 310 // warning in the client response should be concise 311 resp.Warnings = append(resp.Warnings, digestWarning(newCtnr.Image)) 312 } else if newCtnr.Image != digestImage { 313 logrus.Debugf("pinning image %s by digest: %s", newCtnr.Image, digestImage) 314 newCtnr.Image = digestImage 315 } else { 316 logrus.Debugf("updating service using supplied digest reference %s", newCtnr.Image) 317 } 318 319 // Replace the context with a fresh one. 320 // If we timed out while communicating with the 321 // registry, then "ctx" will already be expired, which 322 // would cause UpdateService below to fail. Reusing 323 // "ctx" could make it impossible to update a service 324 // if the registry is slow or unresponsive. 325 var cancel func() 326 ctx, cancel = c.getRequestContext() 327 defer cancel() 328 } 329 } 330 331 var rollback swarmapi.UpdateServiceRequest_Rollback 332 switch flags.Rollback { 333 case "", "none": 334 rollback = swarmapi.UpdateServiceRequest_NONE 335 case "previous": 336 rollback = swarmapi.UpdateServiceRequest_PREVIOUS 337 default: 338 return fmt.Errorf("unrecognized rollback option %s", flags.Rollback) 339 } 340 341 _, err = state.controlClient.UpdateService( 342 ctx, 343 &swarmapi.UpdateServiceRequest{ 344 ServiceID: currentService.ID, 345 Spec: &serviceSpec, 346 ServiceVersion: &swarmapi.Version{ 347 Index: version, 348 }, 349 Rollback: rollback, 350 }, 351 ) 352 return err 353 }) 354 return resp, err 355 } 356 357 // RemoveService removes a service from a managed swarm cluster. 358 func (c *Cluster) RemoveService(input string) error { 359 return c.lockedManagerAction(func(ctx context.Context, state nodeState) error { 360 service, err := getService(ctx, state.controlClient, input, false) 361 if err != nil { 362 return err 363 } 364 365 _, err = state.controlClient.RemoveService(ctx, &swarmapi.RemoveServiceRequest{ServiceID: service.ID}) 366 return err 367 }) 368 } 369 370 // ServiceLogs collects service logs and writes them back to `config.OutStream` 371 func (c *Cluster) ServiceLogs(ctx context.Context, selector *backend.LogSelector, config *apitypes.ContainerLogsOptions) (<-chan *backend.LogMessage, error) { 372 c.mu.RLock() 373 defer c.mu.RUnlock() 374 375 state := c.currentNodeState() 376 if !state.IsActiveManager() { 377 return nil, c.errNoManager(state) 378 } 379 380 swarmSelector, err := convertSelector(ctx, state.controlClient, selector) 381 if err != nil { 382 return nil, errors.Wrap(err, "error making log selector") 383 } 384 385 // set the streams we'll use 386 stdStreams := []swarmapi.LogStream{} 387 if config.ShowStdout { 388 stdStreams = append(stdStreams, swarmapi.LogStreamStdout) 389 } 390 if config.ShowStderr { 391 stdStreams = append(stdStreams, swarmapi.LogStreamStderr) 392 } 393 394 // Get tail value squared away - the number of previous log lines we look at 395 var tail int64 396 // in ContainerLogs, if the tail value is ANYTHING non-integer, we just set 397 // it to -1 (all). i don't agree with that, but i also think no tail value 398 // should be legitimate. if you don't pass tail, we assume you want "all" 399 if config.Tail == "all" || config.Tail == "" { 400 // tail of 0 means send all logs on the swarmkit side 401 tail = 0 402 } else { 403 t, err := strconv.Atoi(config.Tail) 404 if err != nil { 405 return nil, errors.New("tail value must be a positive integer or \"all\"") 406 } 407 if t < 0 { 408 return nil, errors.New("negative tail values not supported") 409 } 410 // we actually use negative tail in swarmkit to represent messages 411 // backwards starting from the beginning. also, -1 means no logs. so, 412 // basically, for api compat with docker container logs, add one and 413 // flip the sign. we error above if you try to negative tail, which 414 // isn't supported by docker (and would error deeper in the stack 415 // anyway) 416 // 417 // See the logs protobuf for more information 418 tail = int64(-(t + 1)) 419 } 420 421 // get the since value - the time in the past we're looking at logs starting from 422 var sinceProto *gogotypes.Timestamp 423 if config.Since != "" { 424 s, n, err := timetypes.ParseTimestamps(config.Since, 0) 425 if err != nil { 426 return nil, errors.Wrap(err, "could not parse since timestamp") 427 } 428 since := time.Unix(s, n) 429 sinceProto, err = gogotypes.TimestampProto(since) 430 if err != nil { 431 return nil, errors.Wrap(err, "could not parse timestamp to proto") 432 } 433 } 434 435 stream, err := state.logsClient.SubscribeLogs(ctx, &swarmapi.SubscribeLogsRequest{ 436 Selector: swarmSelector, 437 Options: &swarmapi.LogSubscriptionOptions{ 438 Follow: config.Follow, 439 Streams: stdStreams, 440 Tail: tail, 441 Since: sinceProto, 442 }, 443 }) 444 if err != nil { 445 return nil, err 446 } 447 448 messageChan := make(chan *backend.LogMessage, 1) 449 go func() { 450 defer close(messageChan) 451 for { 452 // Check the context before doing anything. 453 select { 454 case <-ctx.Done(): 455 return 456 default: 457 } 458 subscribeMsg, err := stream.Recv() 459 if err == io.EOF { 460 return 461 } 462 // if we're not io.EOF, push the message in and return 463 if err != nil { 464 select { 465 case <-ctx.Done(): 466 case messageChan <- &backend.LogMessage{Err: err}: 467 } 468 return 469 } 470 471 for _, msg := range subscribeMsg.Messages { 472 // make a new message 473 m := new(backend.LogMessage) 474 m.Attrs = make([]backend.LogAttr, 0, len(msg.Attrs)+3) 475 // add the timestamp, adding the error if it fails 476 m.Timestamp, err = gogotypes.TimestampFromProto(msg.Timestamp) 477 if err != nil { 478 m.Err = err 479 } 480 481 nodeKey := contextPrefix + ".node.id" 482 serviceKey := contextPrefix + ".service.id" 483 taskKey := contextPrefix + ".task.id" 484 485 // copy over all of the details 486 for _, d := range msg.Attrs { 487 switch d.Key { 488 case nodeKey, serviceKey, taskKey: 489 // we have the final say over context details (in case there 490 // is a conflict (if the user added a detail with a context's 491 // key for some reason)) 492 default: 493 m.Attrs = append(m.Attrs, backend.LogAttr{Key: d.Key, Value: d.Value}) 494 } 495 } 496 m.Attrs = append(m.Attrs, 497 backend.LogAttr{Key: nodeKey, Value: msg.Context.NodeID}, 498 backend.LogAttr{Key: serviceKey, Value: msg.Context.ServiceID}, 499 backend.LogAttr{Key: taskKey, Value: msg.Context.TaskID}, 500 ) 501 502 switch msg.Stream { 503 case swarmapi.LogStreamStdout: 504 m.Source = "stdout" 505 case swarmapi.LogStreamStderr: 506 m.Source = "stderr" 507 } 508 m.Line = msg.Data 509 510 // there could be a case where the reader stops accepting 511 // messages and the context is canceled. we need to check that 512 // here, or otherwise we risk blocking forever on the message 513 // send. 514 select { 515 case <-ctx.Done(): 516 return 517 case messageChan <- m: 518 } 519 } 520 } 521 }() 522 return messageChan, nil 523 } 524 525 // convertSelector takes a backend.LogSelector, which contains raw names that 526 // may or may not be valid, and converts them to an api.LogSelector proto. It 527 // returns an error if something fails 528 func convertSelector(ctx context.Context, cc swarmapi.ControlClient, selector *backend.LogSelector) (*swarmapi.LogSelector, error) { 529 // don't rely on swarmkit to resolve IDs, do it ourselves 530 swarmSelector := &swarmapi.LogSelector{} 531 for _, s := range selector.Services { 532 service, err := getService(ctx, cc, s, false) 533 if err != nil { 534 return nil, err 535 } 536 c := service.Spec.Task.GetContainer() 537 if c == nil { 538 return nil, errors.New("logs only supported on container tasks") 539 } 540 swarmSelector.ServiceIDs = append(swarmSelector.ServiceIDs, service.ID) 541 } 542 for _, t := range selector.Tasks { 543 task, err := getTask(ctx, cc, t) 544 if err != nil { 545 return nil, err 546 } 547 c := task.Spec.GetContainer() 548 if c == nil { 549 return nil, errors.New("logs only supported on container tasks") 550 } 551 swarmSelector.TaskIDs = append(swarmSelector.TaskIDs, task.ID) 552 } 553 return swarmSelector, nil 554 } 555 556 // imageWithDigestString takes an image such as name or name:tag 557 // and returns the image pinned to a digest, such as name@sha256:34234 558 func (c *Cluster) imageWithDigestString(ctx context.Context, image string, authConfig *apitypes.AuthConfig) (string, error) { 559 ref, err := reference.ParseAnyReference(image) 560 if err != nil { 561 return "", err 562 } 563 namedRef, ok := ref.(reference.Named) 564 if !ok { 565 if _, ok := ref.(reference.Digested); ok { 566 return image, nil 567 } 568 return "", errors.Errorf("unknown image reference format: %s", image) 569 } 570 // only query registry if not a canonical reference (i.e. with digest) 571 if _, ok := namedRef.(reference.Canonical); !ok { 572 namedRef = reference.TagNameOnly(namedRef) 573 574 taggedRef, ok := namedRef.(reference.NamedTagged) 575 if !ok { 576 return "", errors.Errorf("image reference not tagged: %s", image) 577 } 578 579 repo, _, err := c.config.ImageBackend.GetRepository(ctx, taggedRef, authConfig) 580 if err != nil { 581 return "", err 582 } 583 dscrptr, err := repo.Tags(ctx).Get(ctx, taggedRef.Tag()) 584 if err != nil { 585 return "", err 586 } 587 588 namedDigestedRef, err := reference.WithDigest(taggedRef, dscrptr.Digest) 589 if err != nil { 590 return "", err 591 } 592 // return familiar form until interface updated to return type 593 return reference.FamiliarString(namedDigestedRef), nil 594 } 595 // reference already contains a digest, so just return it 596 return reference.FamiliarString(ref), nil 597 } 598 599 // digestWarning constructs a formatted warning string 600 // using the image name that could not be pinned by digest. The 601 // formatting is hardcoded, but could me made smarter in the future 602 func digestWarning(image string) string { 603 return fmt.Sprintf("image %s could not be accessed on a registry to record\nits digest. Each node will access %s independently,\npossibly leading to different nodes running different\nversions of the image.\n", image, image) 604 }