feat: Replace podmand with oras in backup container

Signed-off-by: Ales Raszka <[email protected]>

Author: Allda

apis/controller/v1alpha1/devworkspaceoperatorconfig_types.go

@@ -78,9 +78,15 @@ type RegistryConfig struct {
 	// +kubebuilder:validation:Required
 	Path string `json:"path,omitempty"`
 	// AuthSecret is the name of a Kubernetes secret of
-	// type kubernetes.io/dockerconfigjson
+	// type kubernetes.io/dockerconfigjson.
+	// The secret is expected to be in the same namespace
+	// as the DevWorkspaceOperatorCongfig.
 	// +kubebuilder:validation:Optional
 	AuthSecret string `json:"authSecret,omitempty"`
+
+	// ExtraArgs are additional arguments passed to the oras CLI
+	// +kubebuilder:validation:Optional
+	ExtraArgs string `json:"extraArgs,omitempty"`
 }
 
 type BackupCronJobConfig struct {

controllers/backupcronjob/backupcronjob_controller.go

@@ -365,9 +365,10 @@ func (r *BackupCronJobReconciler) createBackupJob(
 									Value: "/workspace/" + workspacePath,
 								},
 								{Name: "DEVWORKSPACE_BACKUP_REGISTRY", Value: backUpConfig.Registry.Path},
-								{Name: "PODMAN_PUSH_OPTIONS", Value: "--tls-verify=false"},
+								{Name: "ORAS_EXTRA_ARGS", Value: backUpConfig.Registry.ExtraArgs},
 							},
-							Image: images.GetProjectBackupImage(),
+							Image:           images.GetProjectBackupImage(),
+							ImagePullPolicy: "Always",
 							Args: []string{
 								"/workspace-recovery.sh",
 								"--backup",
@@ -383,7 +384,7 @@ func (r *BackupCronJobReconciler) createBackupJob(
 								},
 							},
 							SecurityContext: &corev1.SecurityContext{
-								RunAsUser: ptr.To[int64](1000),
+								AllowPrivilegeEscalation: ptr.To[bool](false),
 							},
 						},
 					},
@@ -422,12 +423,12 @@ func (r *BackupCronJobReconciler) createBackupJob(
 		})
 		job.Spec.Template.Spec.Containers[0].VolumeMounts = append(job.Spec.Template.Spec.Containers[0].VolumeMounts, corev1.VolumeMount{
 			Name:      "registry-auth-secret",
-			MountPath: "/home/podman/.docker",
+			MountPath: "/tmp/.docker",
 			ReadOnly:  true,
 		})
 		job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{
 			Name:  "REGISTRY_AUTH_FILE",
-			Value: "/home/podman/.docker/.dockerconfigjson",
+			Value: "/tmp/.docker/.dockerconfigjson",
 		})
 
 	}

controllers/backupcronjob/backupcronjob_controller_test.go

@@ -320,7 +320,8 @@ var _ = Describe("BackupCronJobReconciler", func() {
 							Enable:   &enabled,
 							Schedule: schedule,
 							Registry: &controllerv1alpha1.RegistryConfig{
-								Path: "fake-registry",
+								Path:      "fake-registry",
+								ExtraArgs: "--exta-arg1",
 							},
 						},
 					},
@@ -349,7 +350,7 @@ var _ = Describe("BackupCronJobReconciler", func() {
 				{Name: "WORKSPACE_ID", Value: "id-recent"},
 				{Name: "BACKUP_SOURCE_PATH", Value: "/workspace/id-recent/projects"},
 				{Name: "DEVWORKSPACE_BACKUP_REGISTRY", Value: "fake-registry"},
-				{Name: "PODMAN_PUSH_OPTIONS", Value: "--tls-verify=false"},
+				{Name: "ORAS_EXTRA_ARGS", Value: "--exta-arg1"},
 			}
 			Expect(container.Env).Should(ContainElements(expectedEnvs), "container env vars should include vars neeeded for backup")
 

deploy/bundle/manifests/controller.devfile.io_devworkspaceoperatorconfigs.yaml

@@ -451,6 +451,9 @@ func mergeConfig(from, to *controller.OperatorConfiguration) {
 				if from.Workspace.BackupCronJob.Registry.AuthSecret != "" {
 					to.Workspace.BackupCronJob.Registry.AuthSecret = from.Workspace.BackupCronJob.Registry.AuthSecret
 				}
+				if from.Workspace.BackupCronJob.Registry.ExtraArgs != "" {
+					to.Workspace.BackupCronJob.Registry.ExtraArgs = from.Workspace.BackupCronJob.Registry.ExtraArgs
+				}
 			}
 		}