-
Notifications
You must be signed in to change notification settings - Fork 932
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for fetching images across all projects #14260
base: main
Are you sure you want to change the base?
Add support for fetching images across all projects #14260
Conversation
Signed-off-by: Kadin Sayani <kadin.sayani@canonical.com>
Signed-off-by: Kadin Sayani <kadin.sayani@canonical.com>
Heads up @mionaalex - the "Documentation" label was applied to this issue. |
…all projects Signed-off-by: Kadin Sayani <kadin.sayani@canonical.com>
Signed-off-by: Kadin Sayani <kadin.sayani@canonical.com>
80348bf
to
9c8ceab
Compare
} | ||
|
||
for _, projectName := range projects { | ||
images, err := doImagesGet(ctx, tx, true, projectName, public, clauses, hasPermission) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why is the recursion
parameter hardcoded to true? And yet in imagesGet
it is passed to doImagesGet via the util.IsRecursionRequest(r)
call?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For the images endpoint there is an option to fetch image fingerprints or image structs (based on the recursion parameter). For this new feature, I've hardcoded recursion to true to match the spec of fetching all image structs across all projects. I'm assuming image structs are required since the GH issue requirements specify a need for image.Name
. We don't want to change the behaviour of doImagesGet()
with this change, so when the all-projects
parameter is set to false
, util.IsRecursionRequest(r)
is passed into doImagesGet()
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is expected that this API endpoint behaves in the same way as other endpoints in LXD, namely that all-projects
influences which resources are returned, and recursion
controls whether or not they are returned as a URL list or as a struct. The all-projects
parameter should not change the format that the resources are returned in, so hardcoding true
here seems wrong to me.
Also ive assigned you some Incus imports related to all-projects to consider whilst you're working on this.
Finally we should ask @markylaing to advise on what authz checks we should be making to ensure we dont list access to the wrong images.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sounds good 👍 I’ll take a look at those Incus imports tomorrow - thanks for pointing them out!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I reviewed the Incus imports. Their implementation also includes support for a --all-projects
flag in the CLI. It appears that they’ve extended this feature to other client interactions, such as networks and profiles. I think it's a good idea to adjust this PR to incorporate Incus cherry-picks relating to fetching images across all projects, along with the appropriate LXD authentication checks, to guarantee trusted client access. After that, I'll take a look at the other PR's which expand the --all-projects
feature to other endpoints.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sounds good thanks!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The all-projects parameter should only change which resources are returned, it should not change the output format.
Resolves #14126.
This PR adds support for fetching images across all projects by adding a query parameter
all-projects
anddoGetImagesAllProjects()
. I've also added a client function tolxd_images.go
if we ever want to use this feature in the LXD CLI.