@di-framework/tenant-cli 6.0.9 → 6.0.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +31 -4
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -60,7 +60,14 @@ push and pull, a viewer may only pull.
|
|
|
60
60
|
|
|
61
61
|
`GET /v1/deploy/registry` (viewer or developer) returns `RegistryInfo`: the registry `url` (an
|
|
62
62
|
origin: scheme + host[:port], no path), an optional `repositoryPrefix`, `auth` (`basic-identity`)
|
|
63
|
-
and a fixed `username` hint.
|
|
63
|
+
and a fixed `username` hint (`token`). The tenant controller reads the origin from
|
|
64
|
+
`TENANT_CONTROLLER_REGISTRY_URL` (`{tenant}` is replaced by the tenant), which the platform sets
|
|
65
|
+
when its `tenantAuth.registry` config is present; otherwise the endpoint answers 503
|
|
66
|
+
`no registry is configured for this tenant`. While a registry is configured but not served (a
|
|
67
|
+
host conflict or a suspended tenant) it answers 503 `the tenant registry is not available; see
|
|
68
|
+
the Tenant's TenantAuthReady condition`. The origin must be `https://`; plain `http://` is
|
|
69
|
+
accepted only for loopback (`localhost`, `127.0.0.0/8`, `[::1]`) and in-cluster hosts (`*.svc`,
|
|
70
|
+
`*.svc.cluster.local`).
|
|
64
71
|
|
|
65
72
|
Log in against the host of `url`, not the full URL, then push to
|
|
66
73
|
`<host>/<repositoryPrefix>/<name>:<tag>`:
|
|
@@ -71,11 +78,31 @@ docker login <host>
|
|
|
71
78
|
oras push <host>/<repositoryPrefix>/<name>:<tag> ...
|
|
72
79
|
```
|
|
73
80
|
|
|
74
|
-
An `http:` origin means plain HTTP: pass `oras --plain-http` or
|
|
75
|
-
|
|
81
|
+
An `http:` origin means plain HTTP (loopback or in-cluster only): pass `oras --plain-http` or
|
|
82
|
+
`wash --insecure`. The platform serves the registry over HTTPS through the gateway, since the Basic
|
|
83
|
+
password is an identity credential. Its certificate is the tenant controller's, so trust the
|
|
84
|
+
tenant's CA (ConfigMap `tenant-controller-ca`) as you do for the controller, for example
|
|
85
|
+
`oras login --ca-file` or `/etc/docker/certs.d/<host>/ca.crt`.
|
|
76
86
|
|
|
77
87
|
Identity access tokens expire, so a stored `docker login` stops working; a `dik_` API key suits CI.
|
|
78
88
|
|
|
89
|
+
### Which reference a workload uses
|
|
90
|
+
|
|
91
|
+
Push to the registry's public origin (`url` above), but reference the same repository on the
|
|
92
|
+
in-cluster pull host in the workload you deploy: tenant hosts pull from
|
|
93
|
+
`tenant-registry.di-runtime-<tenant>.svc` (no port), with a platform-managed pull credential, not
|
|
94
|
+
from the public origin, which is a gateway or port-forward address the hosts cannot use. Both
|
|
95
|
+
names serve the same repositories:
|
|
96
|
+
|
|
97
|
+
```text
|
|
98
|
+
oras push registry.acme.localhost:28180/web:1.0.0 ... # push (your credential)
|
|
99
|
+
# workload component image:
|
|
100
|
+
tenant-registry.di-runtime-acme.svc/web@sha256:<digest> # pull (the tenant's hosts)
|
|
101
|
+
```
|
|
102
|
+
|
|
103
|
+
`/v1/deploy` and `/v1/deploy/preview` refuse (`422`) a bundle whose component or service image
|
|
104
|
+
names the public origin, and the problem `detail` gives the in-cluster reference to use instead.
|
|
105
|
+
|
|
79
106
|
## Commands
|
|
80
107
|
|
|
81
108
|
```text
|
|
@@ -114,4 +141,4 @@ instead of opening it.
|
|
|
114
141
|
build that produces it is shared with `cli-plugin-platform` and is the next step.
|
|
115
142
|
- The controller: `../tenant-auth` serves `services create` and `services proxy`; operations it
|
|
116
143
|
does not implement yet answer 501. The controller grows the endpoints behind this contract, importing the generated routes from `src/api/generated`.
|
|
117
|
-
- The `proxy` session URL is an HTTP passthrough the controller serves outside the document (`/v1/services/<service>/proxy/<session>/...`); WebSocket is not supported yet. The session URL takes its origin from the Host the caller reached (the controller has no configured public URL); the passthrough uses a 60 s idle timeout, keeps relative `Location` redirects under the session URL, and marks every request as external with `X-Forwarded-*` so workload control paths stay closed.
|
|
144
|
+
- The `proxy` session URL is an HTTP passthrough the controller serves outside the document (`/v1/services/<service>/proxy/<session>/...`); WebSocket is not supported yet. The session URL takes its origin from the Host the caller reached (the controller has no configured public URL); the passthrough uses a 60 s idle timeout, keeps relative `Location` redirects under the session URL, and marks every request as external with `X-Forwarded-*` so workload control paths stay closed. It sends `Host: <service>-<env>` (the session's env), the host the deploy lane sets as `config.host` on the bundle's `wasi:http` host interface; a bundle must leave `config.host` out or set it to that value.
|