feat: add registry credential helpers feature (#7002)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

charts/kyverno/README.md

@@ -247,6 +247,8 @@ The chart values are organised per component.
 | features.policyExceptions.enabled | bool | `false` | Enables the feature |
 | features.policyExceptions.namespace | string | `""` | Restrict policy exceptions to a single namespace |
 | features.protectManagedResources.enabled | bool | `false` | Enables the feature |
+| features.registryClient.allowInsecure | bool | `false` | Allow insecure registry |
+| features.registryClient.credentialHelpers | list | `["default","google","amazon","azure","github"]` | Enable registry client helpers |
 | features.reports.chunkSize | int | `1000` | Reports chunk size |
 
 ### Admission controller

charts/kyverno/templates/_helpers.tpl

@@ -41,6 +41,10 @@
 {{- with .reports -}}
   {{- $flags = append $flags (print "--reportsChunkSize=" .chunkSize) -}}
 {{- end -}}
+{{- with .registryClient -}}
+  {{- $flags = append $flags (print "--allowInsecureRegistry=" .allowInsecure) -}}
+  {{- $flags = append $flags (print "--registryCredentialHelpers=" (join "," .credentialHelpers)) -}}
+{{- end -}}
 {{- with $flags -}}
   {{- toYaml . -}}
 {{- end -}}

charts/kyverno/templates/admission-controller/deployment.yaml

@@ -154,6 +154,7 @@ spec:
               "forceFailurePolicyIgnore"
               "policyExceptions"
               "protectManagedResources"
+              "registryClient"
             ) | nindent 12 }}
             {{- range $key, $value := .Values.admissionController.container.extraArgs }}
             {{- if $value }}

charts/kyverno/templates/reports-controller/deployment.yaml

@@ -109,6 +109,7 @@ spec:
               "configMapCaching"
               "policyExceptions"
               "reports"
+              "registryClient"
             ) | nindent 12 }}
             {{- range $key, $value := .Values.reportsController.extraArgs }}
             {{- if $value }}

charts/kyverno/values.yaml

@@ -353,6 +353,16 @@ features:
   protectManagedResources:
     # -- Enables the feature
     enabled: false
+  registryClient:
+    # -- Allow insecure registry
+    allowInsecure: false
+    # -- Enable registry client helpers
+    credentialHelpers:
+    - default
+    - google
+    - amazon
+    - azure
+    - github
   reports:
     # -- Reports chunk size
     chunkSize: 1000

cmd/internal/flag.go

@@ -37,9 +37,9 @@ var (
 	// cosign
 	imageSignatureRepository string
 	// registry client
-	imagePullSecrets      string
-	allowInsecureRegistry bool
-	enableHelpers         string
+	imagePullSecrets          string
+	allowInsecureRegistry     bool
+	registryCredentialHelpers string
 	// leader election
 	leaderElectionRetryPeriod time.Duration
 )
@@ -93,7 +93,7 @@ func initCosignFlags() {
 func initRegistryClientFlags() {
 	flag.BoolVar(&allowInsecureRegistry, "allowInsecureRegistry", false, "Whether to allow insecure connections to registries. Don't use this for anything but testing.")
 	flag.StringVar(&imagePullSecrets, "imagePullSecrets", "", "Secret resource names for image registry access credentials.")
-	flag.StringVar(&enableHelpers, "enableHelpers", "", "Credential helpers to enable (default,google,amazon,azure,github), all will be enabled if empty.")
+	flag.StringVar(&registryCredentialHelpers, "registryCredentialHelpers", "", "Credential helpers to enable (default,google,amazon,azure,github), all will be enabled if empty.")
 }
 
 func initLeaderElectionFlags() {

cmd/internal/registry.go

@@ -31,8 +31,8 @@ func setupRegistryClient(ctx context.Context, logger logr.Logger, client kuberne
 	if allowInsecureRegistry {
 		registryOptions = append(registryOptions, registryclient.WithAllowInsecureRegistry())
 	}
-	if len(enableHelpers) > 0 {
-		registryOptions = append(registryOptions, registryclient.WithCredentialHelpers(strings.Split(enableHelpers, ",")...))
+	if len(registryCredentialHelpers) > 0 {
+		registryOptions = append(registryOptions, registryclient.WithCredentialHelpers(strings.Split(registryCredentialHelpers, ",")...))
 	}
 	registryClient, err := registryclient.New(registryOptions...)
 	checkError(logger, err, "failed to create registry client")

config/install-latest-testing.yaml

@@ -35006,6 +35006,8 @@ spec:
             - --enablePolicyException=false
             - --exceptionNamespace=
             - --protectManagedResources=false
+            - --allowInsecureRegistry=false
+            - --registryCredentialHelpers=default,google,amazon,azure,github
           resources: 
             limits:
               memory: 384Mi
@@ -35367,6 +35369,8 @@ spec:
             - --enablePolicyException=false
             - --exceptionNamespace=
             - --reportsChunkSize=1000
+            - --allowInsecureRegistry=false
+            - --registryCredentialHelpers=default,google,amazon,azure,github
           env:
           - name: METRICS_CONFIG
             value: kyverno-metrics