fix: Correctly configure dynamic credential provider

[jimmidyson]

Only allowed a single configuration per provider binary so match up
the image hosts per binary in the config.

Depends on #1039.

[jimmidyson]

UPDATE: No longer depends on #1039.

[dkoshkin]

I ran a test with this branch and seeing the old config, even though this is a stacked PR.

      - content: |
          [host."https://172.18.0.10:5000/v2"]
            ca = "/etc/certs/172.18.0.10:5000.pem"
        path: /etc/containerd/certs.d/_default/hosts.toml
        permissions: "0600"

Rebased with latest changes from the base branch and seeing correct files

     - content: |2+

        path: /etc/containerd/certs.d/_default/hosts.toml
        permissions: "0600"
      - contentFrom:
          secret:
            key: ca.crt
            name: local-registry
        path: /etc/containerd/certs.d/172.18.0.10:5000/ca.crt
        permissions: "0600"
      - content: |
          apiVersion: credentialprovider.d2iq.com/v1alpha1
          kind: DynamicCredentialProviderConfig
          credentialProviderPluginBinDir: /etc/kubernetes/image-credential-provider/
          credentialProviders:
            apiVersion: kubelet.config.k8s.io/v1
            kind: CredentialProviderConfig
            providers:
            - name: static-credential-provider
              args:
              - /etc/kubernetes/static-image-credentials.json
              matchImages:
              - "172.18.0.10:5000"
              - "docker.io"
              defaultCacheDuration: "0s"
              apiVersion: credentialprovider.kubelet.k8s.io/v1
        path: /etc/kubernetes/dynamic-credential-provider-config.yaml
        permissions: "0600"

[dkoshkin]

Mirror config looks good too:

      - content: |
          apiVersion: kubelet.config.k8s.io/v1
          kind: CredentialProviderConfig
          providers:
          - name: dynamic-credential-provider
            args:
            - get-credentials
            - -c
            - /etc/kubernetes/dynamic-credential-provider-config.yaml
            matchImages:
            - "docker.io"
            - "172.18.0.10:5000"
            - "*"
            - "*.*"
            - "*.*.*"
            - "*.*.*.*"
            - "*.*.*.*.*"
            - "*.*.*.*.*.*"
            defaultCacheDuration: "0s"
            apiVersion: credentialprovider.kubelet.k8s.io/v1
        path: /etc/kubernetes/image-credential-provider-config.yaml
        permissions: "0600"
      - content: |
          apiVersion: credentialprovider.d2iq.com/v1alpha1
          kind: DynamicCredentialProviderConfig
          mirror:
            endpoint: 172.18.0.10:5000
            credentialsStrategy: MirrorCredentialsFirst
          credentialProviderPluginBinDir: /etc/kubernetes/image-credential-provider/
          credentialProviders:
            apiVersion: kubelet.config.k8s.io/v1
            kind: CredentialProviderConfig
            providers:
            - name: static-credential-provider
              args:
              - /etc/kubernetes/static-image-credentials.json
              matchImages:
              - "172.18.0.10:5000"
              - "docker.io"
              defaultCacheDuration: "0s"
              apiVersion: credentialprovider.kubelet.k8s.io/v1
        path: /etc/kubernetes/dynamic-credential-provider-config.yaml
        permissions: "0600"
      - contentFrom:
          secret:
            key: static-credential-provider
            name: dkoshkin-mutliple-registires-static-credential-provider-response
        path: /etc/kubernetes/static-image-credentials.json
        permissions: "0600"

The base branch was changed.

[github-actions]

This PR/issue depends on:

• fix: Correctly configure non-mirror registry certificates #1039
  By Dependent Issues (🤖). Happy coding!