mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-05 23:46:56 +00:00
851ebe3e65
Removes the need to specify an image pull secret to make use of cloud provider credentials. As I understand it, this should be fine outside of cloud provider contexts. As part of this, I've switched to using authn/kubernetes, which I believe is preferable to k8schain. Signed-off-by: Rob Best <robertbest89@gmail.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com>
68 lines
2 KiB
Go
68 lines
2 KiB
Go
package registryclient
|
|
|
|
import (
|
|
"context"
|
|
|
|
ecr "github.com/awslabs/amazon-ecr-credential-helper/ecr-login"
|
|
"github.com/awslabs/amazon-ecr-credential-helper/ecr-login/api"
|
|
"github.com/chrismellard/docker-credential-acr-env/pkg/credhelper"
|
|
"github.com/google/go-containerregistry/pkg/authn"
|
|
kauth "github.com/google/go-containerregistry/pkg/authn/kubernetes"
|
|
"github.com/google/go-containerregistry/pkg/v1/google"
|
|
"github.com/pkg/errors"
|
|
"k8s.io/client-go/kubernetes"
|
|
)
|
|
|
|
var (
|
|
Secrets []string
|
|
|
|
kubeClient kubernetes.Interface
|
|
kyvernoNamespace string
|
|
kyvernoServiceAccount string
|
|
|
|
amazonKeychain authn.Keychain = authn.NewKeychainFromHelper(ecr.ECRHelper{ClientFactory: api.DefaultClientFactory{}})
|
|
azureKeychain authn.Keychain = authn.NewKeychainFromHelper(credhelper.NewACRCredentialsHelper())
|
|
defaultKeychain authn.Keychain = authn.NewMultiKeychain(
|
|
authn.DefaultKeychain,
|
|
google.Keychain,
|
|
amazonKeychain,
|
|
azureKeychain,
|
|
)
|
|
DefaultKeychain authn.Keychain = defaultKeychain
|
|
)
|
|
|
|
// Initialize loads the image pull secrets and initializes the default auth method for container registry API calls
|
|
func Initialize(client kubernetes.Interface, namespace, serviceAccount string, imagePullSecrets []string) error {
|
|
kubeClient = client
|
|
kyvernoNamespace = namespace
|
|
kyvernoServiceAccount = serviceAccount
|
|
Secrets = imagePullSecrets
|
|
|
|
var kc authn.Keychain
|
|
kcOpts := kauth.Options{
|
|
Namespace: namespace,
|
|
ServiceAccountName: serviceAccount,
|
|
ImagePullSecrets: imagePullSecrets,
|
|
}
|
|
|
|
kc, err := kauth.New(context.Background(), client, kcOpts)
|
|
if err != nil {
|
|
return errors.Wrap(err, "failed to initialize registry keychain")
|
|
}
|
|
|
|
DefaultKeychain = authn.NewMultiKeychain(
|
|
defaultKeychain,
|
|
kc,
|
|
)
|
|
|
|
return nil
|
|
}
|
|
|
|
// UpdateKeychain reinitializes the image pull secrets and default auth method for container registry API calls
|
|
func UpdateKeychain() error {
|
|
var err = Initialize(kubeClient, kyvernoNamespace, kyvernoServiceAccount, Secrets)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|