Skip to content

Commit 184dd8f

Browse files
soulebsouleb
committed
secretRef take precedence over provider
if secretRef is provided, we do not attempt to resolve oidc Signed-off-by: Soule BA <[email protected]>
1 parent 6d479e5 commit 184dd8f

File tree

3 files changed

+21
-57
lines changed

3 files changed

+21
-57
lines changed

‎controllers/helmchart_controller.go

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -520,10 +520,8 @@ func (r *HelmChartReconciler) buildFromHelmRepository(ctx context.Context, obj *
520520
}
521521

522522
loginOpts = append([]helmreg.LoginOption{}, loginOpt)
523-
}
524-
525-
if repo.Spec.Provider != sourcev1.GenericOCIProvider && repo.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
526-
auth, authErr := oidcAuth(ctxTimeout, repo)
523+
} else if repo.Spec.Provider != sourcev1.GenericOCIProvider && repo.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
524+
auth, authErr := oidcAuthFromAdapter(ctxTimeout, repo.Spec.URL, repo.Spec.Provider)
527525
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
528526
e := &serror.Event{
529527
Err: fmt.Errorf("failed to get credential from %s: %w", repo.Spec.Provider, authErr),
@@ -995,10 +993,8 @@ func (r *HelmChartReconciler) namespacedChartRepositoryCallback(ctx context.Cont
995993
}
996994

997995
loginOpts = append([]helmreg.LoginOption{}, loginOpt)
998-
}
999-
1000-
if repo.Spec.Provider != sourcev1.GenericOCIProvider && repo.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
1001-
auth, authErr := oidcAuth(ctxTimeout, repo)
996+
} else if repo.Spec.Provider != sourcev1.GenericOCIProvider && repo.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
997+
auth, authErr := oidcAuthFromAdapter(ctxTimeout, repo.Spec.URL, repo.Spec.Provider)
1002998
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
1003999
return nil, fmt.Errorf("failed to get credential from %s: %w", repo.Spec.Provider, authErr)
10041000
}

‎controllers/helmrepository_controller_oci.go

Lines changed: 5 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222
"fmt"
2323
"net/url"
2424
"os"
25-
"strings"
2625
"time"
2726

2827
helmgetter "helm.sh/helm/v3/pkg/getter"
@@ -43,12 +42,10 @@ import (
4342

4443
"github.com/fluxcd/pkg/apis/meta"
4544
"github.com/fluxcd/pkg/oci"
46-
"github.com/fluxcd/pkg/oci/auth/login"
4745
"github.com/fluxcd/pkg/runtime/conditions"
4846
helper "github.com/fluxcd/pkg/runtime/controller"
4947
"github.com/fluxcd/pkg/runtime/patch"
5048
"github.com/fluxcd/pkg/runtime/predicates"
51-
"github.com/google/go-containerregistry/pkg/name"
5249

5350
"github.com/fluxcd/source-controller/api/v1beta2"
5451
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
@@ -301,10 +298,8 @@ func (r *HelmRepositoryOCIReconciler) reconcile(ctx context.Context, obj *v1beta
301298
if loginOpt != nil {
302299
loginOpts = append(loginOpts, loginOpt)
303300
}
304-
}
305-
306-
if obj.Spec.Provider != sourcev1.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
307-
auth, authErr := oidcAuth(ctxTimeout, obj)
301+
} else if obj.Spec.Provider != sourcev1.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
302+
auth, authErr := oidcAuthFromAdapter(ctxTimeout, obj.Spec.URL, obj.Spec.Provider)
308303
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
309304
e := fmt.Errorf("failed to get credential from %s: %w", obj.Spec.Provider, authErr)
310305
conditions.MarkFalse(obj, meta.ReadyCondition, sourcev1.AuthenticationFailedReason, e.Error())
@@ -387,41 +382,12 @@ func (r *HelmRepositoryOCIReconciler) eventLogf(ctx context.Context, obj runtime
387382
r.Eventf(obj, eventType, reason, msg)
388383
}
389384

390-
// oidcAuth generates the OIDC credential authenticator based on the specified cloud provider.
391-
func oidcAuth(ctx context.Context, obj *sourcev1.HelmRepository) (helmreg.LoginOption, error) {
392-
url := strings.TrimPrefix(obj.Spec.URL, sourcev1.OCIRepositoryPrefix)
393-
ref, err := name.ParseReference(url)
394-
if err != nil {
395-
return nil, fmt.Errorf("failed to parse URL '%s': %w", obj.Spec.URL, err)
396-
}
397-
398-
loginOpt, err := loginWithManager(ctx, obj.Spec.Provider, url, ref)
399-
if err != nil {
400-
return nil, fmt.Errorf("failed to login to registry '%s': %w", obj.Spec.URL, err)
401-
}
402-
403-
return loginOpt, nil
404-
}
405-
406-
func loginWithManager(ctx context.Context, provider, url string, ref name.Reference) (helmreg.LoginOption, error) {
407-
opts := login.ProviderOptions{}
408-
switch provider {
409-
case sourcev1.AmazonOCIProvider:
410-
opts.AwsAutoLogin = true
411-
case sourcev1.AzureOCIProvider:
412-
opts.AzureAutoLogin = true
413-
case sourcev1.GoogleOCIProvider:
414-
opts.GcpAutoLogin = true
415-
}
416-
417-
auth, err := login.NewManager().Login(ctx, url, ref, opts)
385+
// oidcAuthFromAdapter generates the OIDC credential authenticator based on the specified cloud provider.
386+
func oidcAuthFromAdapter(ctx context.Context, url, provider string) (helmreg.LoginOption, error) {
387+
auth, err := oidcAuth(ctx, url, provider)
418388
if err != nil {
419389
return nil, err
420390
}
421391

422-
if auth == nil {
423-
return nil, nil
424-
}
425-
426392
return registry.OIDCAdaptHelper(auth)
427393
}

‎controllers/ocirepository_controller.go

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -312,8 +312,8 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, obj *sour
312312
}
313313
options = append(options, crane.WithAuthFromKeychain(keychain))
314314

315-
if obj.Spec.Provider != sourcev1.GenericOCIProvider {
316-
auth, authErr := r.oidcAuth(ctxTimeout, obj)
315+
if obj.Spec.Provider != sourcev1.GenericOCIProvider && keychain == nil {
316+
auth, authErr := oidcAuth(ctxTimeout, obj.Spec.URL, obj.Spec.Provider)
317317
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
318318
e := serror.NewGeneric(
319319
fmt.Errorf("failed to get credential from %s: %w", obj.Spec.Provider, authErr),
@@ -593,9 +593,11 @@ func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *sourcev1.OC
593593
}
594594
}
595595

596-
// if no pullsecrets available return DefaultKeyChain
596+
// if no pullsecrets available return nil
597+
// we don't return a DefaultKeyChain as we should not rely on the default
598+
// docker config file
597599
if len(pullSecretNames) == 0 {
598-
return authn.DefaultKeychain, nil
600+
return nil, nil
599601
}
600602

601603
// lookup image pull secrets
@@ -659,15 +661,15 @@ func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *sourcev1.O
659661
}
660662

661663
// oidcAuth generates the OIDC credential authenticator based on the specified cloud provider.
662-
func (r *OCIRepositoryReconciler) oidcAuth(ctx context.Context, obj *sourcev1.OCIRepository) (authn.Authenticator, error) {
663-
url := strings.TrimPrefix(obj.Spec.URL, sourcev1.OCIRepositoryPrefix)
664-
ref, err := name.ParseReference(url)
664+
func oidcAuth(ctx context.Context, url, provider string) (authn.Authenticator, error) {
665+
u := strings.TrimPrefix(url, sourcev1.OCIRepositoryPrefix)
666+
ref, err := name.ParseReference(u)
665667
if err != nil {
666-
return nil, fmt.Errorf("failed to parse URL '%s': %w", obj.Spec.URL, err)
668+
return nil, fmt.Errorf("failed to parse URL '%s': %w", u, err)
667669
}
668670

669671
opts := login.ProviderOptions{}
670-
switch obj.Spec.Provider {
672+
switch provider {
671673
case sourcev1.AmazonOCIProvider:
672674
opts.AwsAutoLogin = true
673675
case sourcev1.AzureOCIProvider:
@@ -676,7 +678,7 @@ func (r *OCIRepositoryReconciler) oidcAuth(ctx context.Context, obj *sourcev1.OC
676678
opts.GcpAutoLogin = true
677679
}
678680

679-
return login.NewManager().Login(ctx, url, ref, opts)
681+
return login.NewManager().Login(ctx, u, ref, opts)
680682
}
681683

682684
// craneOptions sets the auth headers, timeout and user agent

0 commit comments

Comments
 (0)