api: support hot reload of registry authentication

Add HTTP API endpoints to update and query daemon configuration at
runtime without restarting nydusd. This is particularly useful for
refreshing registry credentials when tokens expire.

Key changes:
- Add GET/PUT /api/v1/config endpoints for configuration management
- Add config module in utils for centralized configuration updates
- Add smoke test cases for hot reload configuration API
- Update documentation with hot reload usage examples

Signed-off-by: imeoer <yansong.ys@antgroup.com>

Author: imeoer

Cargo.lock

@@ -51,6 +51,9 @@ pub struct DaemonConf {
     pub log_level: String,
 }
 
+// Set/update global configuration.
+pub type Config = std::collections::HashMap<String, String>;
+
 /// Identifier for cached blob objects.
 ///
 /// Domains are used to control the blob sharing scope. All blobs associated with the same domain
@@ -106,6 +109,10 @@ pub enum ApiRequest {
     ExportFsFilesMetrics(Option<String>, bool),
     /// Get information about filesystem inflight requests.
     ExportFsInflightMetrics,
+    /// Get global configuration.
+    GetConfig(Option<String>),
+    /// Update global configuration.
+    UpdateConfig(Option<String>, Config),
 
     // Nydus API v2
     /// Get daemon information excluding filesystem backends.
@@ -193,6 +200,8 @@ pub enum ApiResponsePayload {
     FsBackendInfo(String),
     // Filesystem Inflight Requests, v1.
     FsInflightMetrics(String),
+    // Global configuration, v1.
+    Config(Config),
 
     /// List of blob objects, v2
     BlobObjectList(String),

api/src/http.rs

@@ -7,7 +7,7 @@
 
 use dbs_uhttp::{Method, Request, Response};
 
-use crate::http::{ApiError, ApiRequest, ApiResponse, ApiResponsePayload, HttpError};
+use crate::http::{ApiError, ApiRequest, ApiResponse, ApiResponsePayload, Config, HttpError};
 use crate::http_handler::{
     error_response, extract_query_part, parse_body, success_response, translate_status_code,
     EndpointHandler, HttpResult,
@@ -34,6 +34,10 @@ fn convert_to_response<O: FnOnce(ApiError) -> HttpError>(api_resp: ApiResponse,
                 FsFilesPatterns(d) => success_response(Some(d)),
                 FsBackendInfo(d) => success_response(Some(d)),
                 FsInflightMetrics(d) => success_response(Some(d)),
+                Config(conf) => {
+                    let json = serde_json::to_string(&conf).unwrap_or_else(|_| "{}".to_string());
+                    success_response(Some(json))
+                }
                 _ => panic!("Unexpected response message from API service"),
             }
         }
@@ -166,3 +170,28 @@ impl EndpointHandler for MetricsFsInflightHandler {
         }
     }
 }
+
+/// Update global configuration of the daemon.
+pub struct ConfigHandler {}
+impl EndpointHandler for ConfigHandler {
+    fn handle_request(
+        &self,
+        req: &Request,
+        kicker: &dyn Fn(ApiRequest) -> ApiResponse,
+    ) -> HttpResult {
+        match (req.method(), req.body.as_ref()) {
+            (Method::Get, None) => {
+                let id = extract_query_part(req, "id");
+                let r = kicker(ApiRequest::GetConfig(id));
+                Ok(convert_to_response(r, HttpError::Configure))
+            }
+            (Method::Put, Some(body)) => {
+                let conf: Config = parse_body(body)?;
+                let id = extract_query_part(req, "id");
+                let r = kicker(ApiRequest::UpdateConfig(id, conf));
+                Ok(convert_to_response(r, HttpError::Configure))
+            }
+            _ => Err(HttpError::BadRequest),
+        }
+    }
+}

api/src/http_endpoint_v1.rs

@@ -24,8 +24,8 @@ use crate::http_endpoint_common::{
     SendFuseFdHandler, StartHandler, TakeoverFuseFdHandler,
 };
 use crate::http_endpoint_v1::{
-    FsBackendInfo, InfoHandler, MetricsFsAccessPatternHandler, MetricsFsFilesHandler,
-    MetricsFsGlobalHandler, MetricsFsInflightHandler, HTTP_ROOT_V1,
+    ConfigHandler, FsBackendInfo, InfoHandler, MetricsFsAccessPatternHandler,
+    MetricsFsFilesHandler, MetricsFsGlobalHandler, MetricsFsInflightHandler, HTTP_ROOT_V1,
 };
 use crate::http_endpoint_v2::{BlobObjectListHandlerV2, InfoV2Handler, HTTP_ROOT_V2};
 
@@ -158,6 +158,7 @@ lazy_static! {
         r.routes.insert(endpoint_v1!("/metrics/files"), Box::new(MetricsFsFilesHandler{}));
         r.routes.insert(endpoint_v1!("/metrics/inflight"), Box::new(MetricsFsInflightHandler{}));
         r.routes.insert(endpoint_v1!("/metrics/pattern"), Box::new(MetricsFsAccessPatternHandler{}));
+        r.routes.insert(endpoint_v1!("/config"), Box::new(ConfigHandler{}));
 
         // Nydus API, v2
         r.routes.insert(endpoint_v2!("/daemon"), Box::new(InfoV2Handler{}));

api/src/http_handler.rs

@@ -454,3 +454,48 @@ mnt
 ├── pseudo_1
 └── pseudo_2
 ```
+
+### Hot Reload Configuration
+
+Nydusd supports hot reloading of configuration without restarting the daemon. This is useful for updating credentials or other settings at runtime.
+
+#### Update Configuration
+
+To update configuration (e.g., registry authentication):
+
+```shell
+curl --unix-socket /path/to/api.sock \
+  -X PUT "http://localhost/api/v1/config?id=/" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "registry_auth": "<base64_encoded_auth>"
+  }'
+```
+
+#### Query Current Configuration
+
+To retrieve the current configuration:
+
+```shell
+curl --unix-socket /path/to/api.sock \
+  -X GET "http://localhost/api/v1/config?id=/"
+```
+
+Example response:
+
+```json
+{
+  "registry_auth": "<base64_encoded_auth>"
+}
+```
+
+> **Note**: The `id` parameter specifies which mountpoint to configure. Use `/` for the root mountpoint or specify a sub-mountpoint path for multi-mount scenarios.
+
+#### Supported Configuration Fields
+
+The following fields can be updated via the hot reload API:
+
+| Field           | Description                                                               |
+| --------------- | ------------------------------------------------------------------------- |
+| `registry_auth` | Base64-encoded `username:password` credential for registry authentication |
+

docs/nydusd.md

@@ -79,25 +79,30 @@ pub struct Rafs {
 
 impl Rafs {
     /// Create a new instance of `Rafs`.
-    pub fn new(cfg: &Arc<ConfigV2>, id: &str, path: &Path) -> RafsResult<(Self, RafsIoReader)> {
+    pub fn new(
+        cfg: &Arc<ConfigV2>,
+        mountpoint: &str,
+        metadata_path: &Path,
+    ) -> RafsResult<(Self, RafsIoReader)> {
         // Assume all meta/data blobs are accessible, otherwise it will always cause IO errors.
         cfg.internal.set_blob_accessible(true);
 
         let cache_cfg = cfg.get_cache_config().map_err(RafsError::LoadConfig)?;
         let rafs_cfg = cfg.get_rafs_config().map_err(RafsError::LoadConfig)?;
-        let (sb, reader) = RafsSuper::load_from_file(path, cfg.clone(), false)
+        let (sb, reader) = RafsSuper::load_from_file(metadata_path, cfg.clone(), false)
             .map_err(RafsError::FillSuperBlock)?;
         let blob_infos = sb.superblock.get_blob_infos();
-        let device = BlobDevice::new(cfg, &blob_infos).map_err(RafsError::CreateDevice)?;
+        let device =
+            BlobDevice::new(cfg, &blob_infos, mountpoint).map_err(RafsError::CreateDevice)?;
 
         if cfg.is_chunk_validation_enabled() && sb.meta.has_inlined_chunk_digest() {
             sb.superblock.set_blob_device(device.clone());
         }
 
         let rafs = Rafs {
-            id: id.to_string(),
+            id: mountpoint.to_string(),
             device,
-            ios: metrics::FsIoStats::new(id),
+            ios: metrics::FsIoStats::new(mountpoint),
             sb: Arc::new(sb),
 
             initialized: false,
@@ -140,7 +145,12 @@ impl Rafs {
     }
 
     /// Update storage backend for blobs.
-    pub fn update(&self, r: &mut RafsIoReader, conf: &Arc<ConfigV2>) -> RafsResult<()> {
+    pub fn update(
+        &self,
+        r: &mut RafsIoReader,
+        conf: &Arc<ConfigV2>,
+        mountpoint: &str,
+    ) -> RafsResult<()> {
         info!("update");
         if !self.initialized {
             warn!("Rafs is not yet initialized");
@@ -159,7 +169,7 @@ impl Rafs {
         // step 2: update device (only localfs is supported)
         let blob_infos = self.sb.superblock.get_blob_infos();
         self.device
-            .update(conf, &blob_infos, self.fs_prefetch)
+            .update(conf, &blob_infos, self.fs_prefetch, mountpoint)
             .map_err(RafsError::SwapBackend)?;
         info!("update device is successful");
 

rafs/src/fs.rs

@@ -847,7 +847,7 @@ impl RafsSuper {
     /// The `BlobDevice` object is needed to get meta information from RAFS V6 data blobs.
     pub fn create_blob_device(&self, config: Arc<ConfigV2>) -> Result<()> {
         let blobs = self.superblock.get_blob_infos();
-        let device = BlobDevice::new(&config, &blobs)?;
+        let device = BlobDevice::new(&config, &blobs, "/")?;
         self.superblock.set_blob_device(device);
         Ok(())
     }

rafs/src/metadata/mod.rs

@@ -500,7 +500,7 @@ impl DataBlob {
     pub fn new(config: &Arc<DataBlobConfig>) -> Result<Self> {
         let blob_id = config.blob_info().blob_id();
         let blob = BLOB_FACTORY
-            .new_blob_cache(config.config_v2(), &config.blob_info)
+            .new_blob_cache(config.config_v2(), &config.blob_info, "/")
             .inspect_err(|_e| {
                 warn!(
                     "blob_cache: failed to create cache object for blob {}",

service/src/blob_cache.rs

@@ -573,7 +573,7 @@ impl FsCacheHandler {
         let mut blob_info = config.blob_info().deref().clone();
         blob_info.set_fscache_file(Some(file));
         let blob_ref = Arc::new(blob_info);
-        BLOB_FACTORY.new_blob_cache(config.config_v2(), &blob_ref)
+        BLOB_FACTORY.new_blob_cache(config.config_v2(), &blob_ref, "/")
     }
 
     fn fill_bootstrap_cache(bootstrap: Arc<FsCacheBootstrap>) -> Result<u64> {

service/src/fs_cache.rs

@@ -146,7 +146,7 @@ pub trait FsService: Send + Sync {
         let rafs_cfg = ConfigV2::from_str(&cmd.config).map_err(RafsError::LoadConfig)?;
         let rafs_cfg = Arc::new(rafs_cfg);
 
-        rafs.update(&mut bootstrap, &rafs_cfg)
+        rafs.update(&mut bootstrap, &rafs_cfg, &cmd.mountpoint)
             .map_err(|e| match e {
                 RafsError::Unsupported => Error::Unsupported,
                 e => Error::Rafs(e),