Skip to content

Commit 73d0a2e

Browse files
soulebsouleb
committed
secretRef take precedence over provider
if secretRef is provided, we do not attempt to resolve oidc Signed-off-by: Soule BA <[email protected]>
1 parent 6d479e5 commit 73d0a2e

File tree

4 files changed

+28
-57
lines changed

4 files changed

+28
-57
lines changed

‎controllers/helmchart_controller.go

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -520,10 +520,8 @@ func (r *HelmChartReconciler) buildFromHelmRepository(ctx context.Context, obj *
520520
}
521521

522522
loginOpts = append([]helmreg.LoginOption{}, loginOpt)
523-
}
524-
525-
if repo.Spec.Provider != sourcev1.GenericOCIProvider && repo.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
526-
auth, authErr := oidcAuth(ctxTimeout, repo)
523+
} else if repo.Spec.Provider != sourcev1.GenericOCIProvider && repo.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
524+
auth, authErr := oidcAuthFromAdapter(ctxTimeout, repo.Spec.URL, repo.Spec.Provider)
527525
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
528526
e := &serror.Event{
529527
Err: fmt.Errorf("failed to get credential from %s: %w", repo.Spec.Provider, authErr),
@@ -995,10 +993,8 @@ func (r *HelmChartReconciler) namespacedChartRepositoryCallback(ctx context.Cont
995993
}
996994

997995
loginOpts = append([]helmreg.LoginOption{}, loginOpt)
998-
}
999-
1000-
if repo.Spec.Provider != sourcev1.GenericOCIProvider && repo.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
1001-
auth, authErr := oidcAuth(ctxTimeout, repo)
996+
} else if repo.Spec.Provider != sourcev1.GenericOCIProvider && repo.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
997+
auth, authErr := oidcAuthFromAdapter(ctxTimeout, repo.Spec.URL, repo.Spec.Provider)
1002998
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
1003999
return nil, fmt.Errorf("failed to get credential from %s: %w", repo.Spec.Provider, authErr)
10041000
}

‎controllers/helmrepository_controller_oci.go

Lines changed: 5 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222
"fmt"
2323
"net/url"
2424
"os"
25-
"strings"
2625
"time"
2726

2827
helmgetter "helm.sh/helm/v3/pkg/getter"
@@ -43,12 +42,10 @@ import (
4342

4443
"github.com/fluxcd/pkg/apis/meta"
4544
"github.com/fluxcd/pkg/oci"
46-
"github.com/fluxcd/pkg/oci/auth/login"
4745
"github.com/fluxcd/pkg/runtime/conditions"
4846
helper "github.com/fluxcd/pkg/runtime/controller"
4947
"github.com/fluxcd/pkg/runtime/patch"
5048
"github.com/fluxcd/pkg/runtime/predicates"
51-
"github.com/google/go-containerregistry/pkg/name"
5249

5350
"github.com/fluxcd/source-controller/api/v1beta2"
5451
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
@@ -301,10 +298,8 @@ func (r *HelmRepositoryOCIReconciler) reconcile(ctx context.Context, obj *v1beta
301298
if loginOpt != nil {
302299
loginOpts = append(loginOpts, loginOpt)
303300
}
304-
}
305-
306-
if obj.Spec.Provider != sourcev1.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
307-
auth, authErr := oidcAuth(ctxTimeout, obj)
301+
} else if obj.Spec.Provider != sourcev1.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
302+
auth, authErr := oidcAuthFromAdapter(ctxTimeout, obj.Spec.URL, obj.Spec.Provider)
308303
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
309304
e := fmt.Errorf("failed to get credential from %s: %w", obj.Spec.Provider, authErr)
310305
conditions.MarkFalse(obj, meta.ReadyCondition, sourcev1.AuthenticationFailedReason, e.Error())
@@ -387,41 +382,12 @@ func (r *HelmRepositoryOCIReconciler) eventLogf(ctx context.Context, obj runtime
387382
r.Eventf(obj, eventType, reason, msg)
388383
}
389384

390-
// oidcAuth generates the OIDC credential authenticator based on the specified cloud provider.
391-
func oidcAuth(ctx context.Context, obj *sourcev1.HelmRepository) (helmreg.LoginOption, error) {
392-
url := strings.TrimPrefix(obj.Spec.URL, sourcev1.OCIRepositoryPrefix)
393-
ref, err := name.ParseReference(url)
394-
if err != nil {
395-
return nil, fmt.Errorf("failed to parse URL '%s': %w", obj.Spec.URL, err)
396-
}
397-
398-
loginOpt, err := loginWithManager(ctx, obj.Spec.Provider, url, ref)
399-
if err != nil {
400-
return nil, fmt.Errorf("failed to login to registry '%s': %w", obj.Spec.URL, err)
401-
}
402-
403-
return loginOpt, nil
404-
}
405-
406-
func loginWithManager(ctx context.Context, provider, url string, ref name.Reference) (helmreg.LoginOption, error) {
407-
opts := login.ProviderOptions{}
408-
switch provider {
409-
case sourcev1.AmazonOCIProvider:
410-
opts.AwsAutoLogin = true
411-
case sourcev1.AzureOCIProvider:
412-
opts.AzureAutoLogin = true
413-
case sourcev1.GoogleOCIProvider:
414-
opts.GcpAutoLogin = true
415-
}
416-
417-
auth, err := login.NewManager().Login(ctx, url, ref, opts)
385+
// oidcAuthFromAdapter generates the OIDC credential authenticator based on the specified cloud provider.
386+
func oidcAuthFromAdapter(ctx context.Context, url, provider string) (helmreg.LoginOption, error) {
387+
auth, err := oidcAuth(ctx, url, provider)
418388
if err != nil {
419389
return nil, err
420390
}
421391

422-
if auth == nil {
423-
return nil, nil
424-
}
425-
426392
return registry.OIDCAdaptHelper(auth)
427393
}

‎controllers/ocirepository_controller.go

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ import (
6161
"github.com/fluxcd/pkg/version"
6262
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
6363
serror "github.com/fluxcd/source-controller/internal/error"
64+
"github.com/fluxcd/source-controller/internal/helm/registry"
6465
sreconcile "github.com/fluxcd/source-controller/internal/reconcile"
6566
"github.com/fluxcd/source-controller/internal/reconcile/summarize"
6667
"github.com/fluxcd/source-controller/internal/util"
@@ -312,8 +313,8 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, obj *sour
312313
}
313314
options = append(options, crane.WithAuthFromKeychain(keychain))
314315

315-
if obj.Spec.Provider != sourcev1.GenericOCIProvider {
316-
auth, authErr := r.oidcAuth(ctxTimeout, obj)
316+
if _, ok := keychain.(registry.Anonymous); obj.Spec.Provider != sourcev1.GenericOCIProvider && ok {
317+
auth, authErr := oidcAuth(ctxTimeout, obj.Spec.URL, obj.Spec.Provider)
317318
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
318319
e := serror.NewGeneric(
319320
fmt.Errorf("failed to get credential from %s: %w", obj.Spec.Provider, authErr),
@@ -593,9 +594,9 @@ func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *sourcev1.OC
593594
}
594595
}
595596

596-
// if no pullsecrets available return DefaultKeyChain
597+
// if no pullsecrets available return an AnonymousKeychain
597598
if len(pullSecretNames) == 0 {
598-
return authn.DefaultKeychain, nil
599+
return registry.Anonymous{}, nil
599600
}
600601

601602
// lookup image pull secrets
@@ -659,15 +660,15 @@ func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *sourcev1.O
659660
}
660661

661662
// oidcAuth generates the OIDC credential authenticator based on the specified cloud provider.
662-
func (r *OCIRepositoryReconciler) oidcAuth(ctx context.Context, obj *sourcev1.OCIRepository) (authn.Authenticator, error) {
663-
url := strings.TrimPrefix(obj.Spec.URL, sourcev1.OCIRepositoryPrefix)
664-
ref, err := name.ParseReference(url)
663+
func oidcAuth(ctx context.Context, url, provider string) (authn.Authenticator, error) {
664+
u := strings.TrimPrefix(url, sourcev1.OCIRepositoryPrefix)
665+
ref, err := name.ParseReference(u)
665666
if err != nil {
666-
return nil, fmt.Errorf("failed to parse URL '%s': %w", obj.Spec.URL, err)
667+
return nil, fmt.Errorf("failed to parse URL '%s': %w", u, err)
667668
}
668669

669670
opts := login.ProviderOptions{}
670-
switch obj.Spec.Provider {
671+
switch provider {
671672
case sourcev1.AmazonOCIProvider:
672673
opts.AwsAutoLogin = true
673674
case sourcev1.AzureOCIProvider:
@@ -676,7 +677,7 @@ func (r *OCIRepositoryReconciler) oidcAuth(ctx context.Context, obj *sourcev1.OC
676677
opts.GcpAutoLogin = true
677678
}
678679

679-
return login.NewManager().Login(ctx, url, ref, opts)
680+
return login.NewManager().Login(ctx, u, ref, opts)
680681
}
681682

682683
// craneOptions sets the auth headers, timeout and user agent

‎internal/helm/registry/auth.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,14 @@ import (
2828
corev1 "k8s.io/api/core/v1"
2929
)
3030

31+
// Anonymous is an authenticator that always returns an anonymous authenticator.
32+
type Anonymous authn.AuthConfig
33+
34+
// Resolve implements authn.Authenticator.
35+
func (a Anonymous) Resolve(_ authn.Resource) (authn.Authenticator, error) {
36+
return authn.Anonymous, nil
37+
}
38+
3139
// LoginOptionFromSecret derives authentication data from a Secret to login to an OCI registry. This Secret
3240
// may either hold "username" and "password" fields or be of the corev1.SecretTypeDockerConfigJson type and hold
3341
// a corev1.DockerConfigJsonKey field with a complete Docker configuration. If both, "username" and "password" are

0 commit comments

Comments
 (0)