Add support for fetching images across all projects #14260
Conversation
Signed-off-by: Kadin Sayani <kadin.sayani@canonical.com>
Signed-off-by: Kadin Sayani <kadin.sayani@canonical.com>
github-actions
bot
added
Documentation
|
Heads up @mionaalex - the "Documentation" label was applied to this issue. |
…all projects Signed-off-by: Kadin Sayani <kadin.sayani@canonical.com>
Signed-off-by: Kadin Sayani <kadin.sayani@canonical.com>
kadinsayani
force-pushed
the
14126-add-all-projects-support-to-fetch-images
branch
from
80348bf
to
9c8ceab
Compare
| } | ||
|
|
||
| for _, projectName := range projects { | ||
| images, err := doImagesGet(ctx, tx, true, projectName, public, clauses, hasPermission) |
There was a problem hiding this comment.
Why is the recursion parameter hardcoded to true? And yet in imagesGet it is passed to doImagesGet via the util.IsRecursionRequest(r) call?
There was a problem hiding this comment.
For the images endpoint there is an option to fetch image fingerprints or image structs (based on the recursion parameter). For this new feature, I've hardcoded recursion to true to match the spec of fetching all image structs across all projects. I'm assuming image structs are required since the GH issue requirements specify a need for image.Name. We don't want to change the behaviour of doImagesGet() with this change, so when the all-projects parameter is set to false, util.IsRecursionRequest(r) is passed into doImagesGet().
There was a problem hiding this comment.
It is expected that this API endpoint behaves in the same way as other endpoints in LXD, namely that all-projects influences which resources are returned, and recursion controls whether or not they are returned as a URL list or as a struct. The all-projects parameter should not change the format that the resources are returned in, so hardcoding true here seems wrong to me.
Also ive assigned you some Incus imports related to all-projects to consider whilst you're working on this.
Finally we should ask @markylaing to advise on what authz checks we should be making to ensure we dont list access to the wrong images.
There was a problem hiding this comment.
Sounds good 👍 I’ll take a look at those Incus imports tomorrow - thanks for pointing them out!
There was a problem hiding this comment.
I reviewed the Incus imports. Their implementation also includes support for a --all-projects flag in the CLI. It appears that they’ve extended this feature to other client interactions, such as networks and profiles. I think it's a good idea to adjust this PR to incorporate Incus cherry-picks relating to fetching images across all projects, along with the appropriate LXD authentication checks, to guarantee trusted client access. After that, I'll take a look at the other PR's which expand the --all-projects feature to other endpoints.
Resolves #14126.
This PR adds support for fetching images across all projects by adding a query parameter
all-projectsanddoGetImagesAllProjects(). I've also added a client function tolxd_images.goif we ever want to use this feature in the LXD CLI.