Introduce k0s airgap bundle-artifacts

This sub-command introduces a "k0s native" way to create airgap
artifact bundles. The current way to do this requires either a Docker
or containerd daemon. Even then, there are certain scenarios where the
created bundles don't contain all the necessary tags, i.e. when images
are referenced by both their tag and their digest.

Signed-off-by: Tom Wieczorek <[email protected]>

cmd/airgap/airgap.go

@@ -19,16 +19,24 @@ package airgap
 import (
 	"github.com/k0sproject/k0s/pkg/config"
 
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )
 
 func NewAirgapCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "airgap",
-		Short: "Manage airgap setup",
-		Args:  cobra.NoArgs,
-		RunE:  func(*cobra.Command, []string) error { return pflag.ErrHelp }, // Enforce arg validation
+		Short: "Tooling for airgapped installations",
+		Long: `Tooling for airgapped installations.
+
+For example, to create an image bundle that contains the images required for
+the current configuration, use the following command:
+
+    k0s airgap list-images | k0s airgap bundle-artifacts -v -o image-bundle.tar
+`,
+		Args: cobra.NoArgs,
+		RunE: func(*cobra.Command, []string) error { return pflag.ErrHelp }, // Enforce arg validation
 	}
 
 	var deprecatedFlags pflag.FlagSet
@@ -40,7 +48,9 @@ func NewAirgapCmd() *cobra.Command {
 		cmd.PersistentFlags().AddFlag(f)
 	})
 
-	cmd.AddCommand(NewAirgapListImagesCmd())
+	log := logrus.StandardLogger()
+	cmd.AddCommand(newAirgapListImagesCmd())
+	cmd.AddCommand(newAirgapBundleArtifactsCmd(log, nil))
 
 	return cmd
 }

cmd/airgap/bundleartifacts.go

@@ -0,0 +1,191 @@
+/*
+Copyright 2024 k0s authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package airgap
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"iter"
+	"os"
+	"os/signal"
+	"slices"
+	"strconv"
+	"strings"
+	"syscall"
+
+	"github.com/k0sproject/k0s/internal/pkg/file"
+	"github.com/k0sproject/k0s/pkg/airgap"
+
+	"k8s.io/kubectl/pkg/util/term"
+
+	"github.com/containerd/platforms"
+	"github.com/distribution/reference"
+	imagespecv1 "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+func newAirgapBundleArtifactsCmd(log logrus.FieldLogger, rewriteBundleRef airgap.RewriteRefFunc) *cobra.Command {
+	var (
+		outPath  string
+		platform = platforms.DefaultSpec()
+		bundler  = airgap.OCIArtifactsBundler{
+			Log:           log,
+			RewriteTarget: rewriteBundleRef,
+		}
+	)
+
+	cmd := &cobra.Command{
+		Use:   "bundle-artifacts [flags] [names...]",
+		Short: "Bundles artifacts needed for airgapped installations into a tarball",
+		Long: `Bundles artifacts needed for airgapped installations into a tarball. Fetches the
+artifacts from their OCI registries and bundles them into an OCI Image Layout
+archive (written to standard output by default). Reads names from standard input
+if no names are given on the command line.`,
+		RunE: func(cmd *cobra.Command, args []string) (err error) {
+			ctx, cancel := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
+			defer cancel()
+
+			cmd.SilenceUsage = true
+
+			bundler.PlatformMatcher = platforms.Only(platform)
+
+			var out io.Writer
+			if outPath == "" {
+				out = cmd.OutOrStdout()
+				if term.IsTerminal(out) {
+					return errors.New("cowardly refusing to write binary data to a terminal")
+				}
+			} else {
+				f, openErr := file.AtomicWithTarget(outPath).Open()
+				if openErr != nil {
+					return openErr
+				}
+				defer func() {
+					if err == nil {
+						err = f.Finish()
+					} else if closeErr := f.Close(); closeErr != nil {
+						err = errors.Join(err, closeErr)
+					}
+				}()
+				out = f
+			}
+
+			var refs []reference.Named
+			if len(args) > 0 {
+				refs, err = parseArtifactRefsFromSeq(slices.Values(args))
+			} else {
+				refs, err = parseArtifactRefsFromReader(cmd.InOrStdin())
+			}
+			if err != nil {
+				return err
+			}
+
+			buffered := bufio.NewWriter(out)
+			if err := bundler.Run(ctx, refs, out); err != nil {
+				return err
+			}
+			return buffered.Flush()
+		},
+	}
+
+	cmd.Flags().StringVarP(&outPath, "output", "o", "", "output file path (writes to standard output if omitted)")
+	cmd.Flags().Var((*insecureRegistryFlag)(&bundler.InsecureRegistries), "insecure-registries", "one of "+strings.Join(insecureRegistryFlagValues[:], ", "))
+	cmd.Flags().Var((*platformFlag)(&platform), "platform", "the platform to export")
+	cmd.Flags().StringArrayVar(&bundler.RegistriesConfigPaths, "registries-config", nil, "paths to the authentication files for OCI registries (uses the standard Docker config if omitted)")
+
+	return cmd
+}
+
+func parseArtifactRefsFromReader(in io.Reader) ([]reference.Named, error) {
+	words := bufio.NewScanner(in)
+	words.Split(bufio.ScanWords)
+	refs, err := parseArtifactRefsFromSeq(func(yield func(string) bool) {
+		for words.Scan() {
+			if !yield(words.Text()) {
+				return
+			}
+		}
+	})
+	if err := errors.Join(err, words.Err()); err != nil {
+		return nil, err
+	}
+
+	return refs, nil
+}
+
+func parseArtifactRefsFromSeq(refs iter.Seq[string]) (collected []reference.Named, _ error) {
+	for ref := range refs {
+		parsed, err := reference.ParseNormalizedNamed(ref)
+		if err != nil {
+			return nil, fmt.Errorf("while parsing %s: %w", ref, err)
+		}
+		collected = append(collected, parsed)
+	}
+	return collected, nil
+}
+
+type insecureRegistryFlag airgap.InsecureOCIRegistryKind
+
+var insecureRegistryFlagValues = [...]string{
+	airgap.NoInsecureOCIRegistry:    "no",
+	airgap.SkipTLSVerifyOCIRegistry: "skip-tls-verify",
+	airgap.PlainHTTPOCIRegistry:     "plain-http",
+}
+
+func (insecureRegistryFlag) Type() string {
+	return "string"
+}
+
+func (i insecureRegistryFlag) String() string {
+	if i := int(i); i < len(insecureRegistryFlagValues) {
+		return insecureRegistryFlagValues[i]
+	} else {
+		return strconv.Itoa(i)
+	}
+}
+
+func (i *insecureRegistryFlag) Set(value string) error {
+	idx := slices.Index(insecureRegistryFlagValues[:], value)
+	if idx >= 0 {
+		*(*airgap.InsecureOCIRegistryKind)(i) = airgap.InsecureOCIRegistryKind(idx)
+		return nil
+	}
+
+	return errors.New("must be one of " + strings.Join(insecureRegistryFlagValues[:], ", "))
+}
+
+type platformFlag imagespecv1.Platform
+
+func (p *platformFlag) Type() string {
+	return "string"
+}
+
+func (p *platformFlag) String() string {
+	return platforms.FormatAll(*(*imagespecv1.Platform)(p))
+}
+
+func (p *platformFlag) Set(value string) error {
+	platform, err := platforms.Parse(value)
+	if err != nil {
+		return err
+	}
+	*(*imagespecv1.Platform)(p) = platform
+	return nil
+}