feat: add imageRegistryCredentials handler

pkg/handlers/generic/mutation/imageregistries/credentials/credential_provider_config_files.go

@@ -44,8 +44,8 @@ var (
 	//go:embed templates/static-credential-provider.json.gotmpl
 	staticCredentialProviderConfigPatch []byte
 
-	//go:embed templates/image-credential-provider-config.yaml.gotmpl
-	imageCredentialProviderConfigPatch []byte
+	//go:embed templates/kubelet-image-credential-provider-config.yaml.gotmpl
+	kubeletImageCredentialProviderConfigPatch []byte
 
 	//go:embed templates/install-kubelet-credential-providers.sh.gotmpl
 	installKubeletCredentialProvidersScript []byte
@@ -87,7 +87,7 @@ func templateFilesForImageCredentialProviderConfigs(credentials providerInput) (
 func templateKubeletCredentialProviderConfig(credentials providerInput) (*cabpkv1.File, error) {
 	return templateCredentialProviderConfig(
 		credentials,
-		imageCredentialProviderConfigPatch,
+		kubeletImageCredentialProviderConfigPatch,
 		kubeletImageCredentialProviderConfigOnRemote,
 		kubeletCredentialProvider,
 	)
@@ -113,9 +113,9 @@ func templateCredentialProviderConfig(
 		host string,
 	) (providerBinary string, providerArgs []string, providerAPIVersion string, err error),
 ) (*cabpkv1.File, error) {
-	mirrorURL, err := url.ParseRequestURI(credentials.URL)
+	registryURL, err := url.ParseRequestURI(credentials.URL)
 	if err != nil {
-		return nil, fmt.Errorf("failed parsing registry mirror: %w", err)
+		return nil, fmt.Errorf("failed parsing registry URL: %w", err)
 	}
 
 	t := template.New("")
@@ -127,14 +127,14 @@ func templateCredentialProviderConfig(
 		return nil, fmt.Errorf("failed to parse go template: %w", err)
 	}
 
-	mirrorHostWithPath := mirrorURL.Host
-	if mirrorURL.Path != "" {
-		mirrorHostWithPath = path.Join(mirrorURL.Host, mirrorURL.Path)
+	registryHostWithPath := registryURL.Host
+	if registryURL.Path != "" {
+		registryHostWithPath = path.Join(registryURL.Host, registryURL.Path)
 	}
 
 	providerBinary, providerArgs, providerAPIVersion, err := providerFunc(
 		!credentials.isCredentialsEmpty(),
-		mirrorHostWithPath,
+		registryHostWithPath,
 	)
 	if err != nil {
 		return nil, err
@@ -144,12 +144,12 @@ func templateCredentialProviderConfig(
 	}
 
 	templateInput := struct {
-		MirrorHost         string
+		RegistryHost       string
 		ProviderBinary     string
 		ProviderArgs       []string
 		ProviderAPIVersion string
 	}{
-		MirrorHost:         mirrorHostWithPath,
+		RegistryHost:       registryHostWithPath,
 		ProviderBinary:     providerBinary,
 		ProviderArgs:       providerArgs,
 		ProviderAPIVersion: providerAPIVersion,

pkg/handlers/generic/mutation/imageregistries/credentials/credential_provider_config_files_test.go

@@ -36,7 +36,6 @@ providers:
   - -c
   - /etc/kubernetes/dynamic-credential-provider-config.yaml
   matchImages:
-  - "123456789.dkr.ecr.us-east-1.amazonaws.com"
   - "*"
   - "*.*"
   - "*.*.*"
@@ -70,7 +69,6 @@ providers:
   - -c
   - /etc/kubernetes/dynamic-credential-provider-config.yaml
   matchImages:
-  - "myregistry.com"
   - "*"
   - "*.*"
   - "*.*.*"
@@ -113,9 +111,6 @@ func Test_templateDynamicCredentialProviderConfig(t *testing.T) {
 				Content: `apiVersion: credentialprovider.d2iq.com/v1alpha1
 kind: DynamicCredentialProviderConfig
 credentialProviderPluginBinDir: /etc/kubernetes/image-credential-provider/
-mirror:
-  endpoint: "123456789.dkr.ecr.us-east-1.amazonaws.com"
-  credentialsStrategy: MirrorCredentialsOnly
 credentialProviders:
   apiVersion: kubelet.config.k8s.io/v1beta1
   kind: CredentialProviderConfig
@@ -146,9 +141,6 @@ credentialProviders:
 				Content: `apiVersion: credentialprovider.d2iq.com/v1alpha1
 kind: DynamicCredentialProviderConfig
 credentialProviderPluginBinDir: /etc/kubernetes/image-credential-provider/
-mirror:
-  endpoint: "myregistry.com"
-  credentialsStrategy: MirrorCredentialsOnly
 credentialProviders:
   apiVersion: kubelet.config.k8s.io/v1beta1
   kind: CredentialProviderConfig

pkg/handlers/generic/mutation/imageregistries/credentials/credentials_secret.go

@@ -40,7 +40,7 @@ func generateCredentialsSecretFile(credentials providerInput, ownerName string)
 	}
 }
 
-// generateCredentialsSecret generates a Secret containing the credentials for the image registry mirror.
+// generateCredentialsSecret generates a Secret containing the credentials for the image registry.
 // The function needs the cluster name to add the required move and cluster name labels.
 func generateCredentialsSecret(
 	credentials providerInput, clusterName, ownerName, namespace string,
@@ -73,19 +73,19 @@ func generateCredentialsSecret(
 }
 
 func kubeletStaticCredentialProviderSecretContents(credentials providerInput) (string, error) {
-	mirrorURL, err := url.ParseRequestURI(credentials.URL)
+	registryURL, err := url.ParseRequestURI(credentials.URL)
 	if err != nil {
-		return "", fmt.Errorf("failed parsing registry mirror: %w", err)
+		return "", fmt.Errorf("failed parsing registry URL: %w", err)
 	}
 
 	templateInput := struct {
-		MirrorHost string
-		Username   string
-		Password   string
+		RegistryHost string
+		Username     string
+		Password     string
 	}{
-		MirrorHost: mirrorURL.Host,
-		Username:   credentials.Username,
-		Password:   credentials.Password,
+		RegistryHost: registryURL.Host,
+		Username:     credentials.Username,
+		Password:     credentials.Password,
 	}
 	t, err := template.New("").Parse(string(staticCredentialProviderConfigPatch))
 	if err != nil {

pkg/handlers/generic/mutation/imageregistries/credentials/templates/dynamic-credential-provider-config.yaml.gotmpl

@@ -1,13 +1,6 @@
 apiVersion: credentialprovider.d2iq.com/v1alpha1
 kind: DynamicCredentialProviderConfig
 credentialProviderPluginBinDir: /etc/kubernetes/image-credential-provider/
-{{- with .MirrorHost }}
-{{- if and (ne . "registry-1.docker.io") (ne . "docker.io") }}
-mirror:
-  endpoint: {{ printf "%q" . }}
-  credentialsStrategy: MirrorCredentialsOnly
-{{- end }}
-{{- end }}
 credentialProviders:
   apiVersion: kubelet.config.k8s.io/v1beta1
   kind: CredentialProviderConfig
@@ -20,7 +13,7 @@ credentialProviders:
     {{- end }}
     {{- end }}
     matchImages:
-    {{- with .MirrorHost }}
+    {{- with .RegistryHost }}
     - {{ printf "%q" . }}
     {{- if eq . "registry-1.docker.io" }}
     - "docker.io"

pkg/handlers/generic/mutation/imageregistries/credentials/templates/image-credential-provider-config.yaml.gotmpl → pkg/handlers/generic/mutation/imageregistries/credentials/templates/kubelet-image-credential-provider-config.yaml.gotmpl

@@ -9,7 +9,6 @@ providers:
   {{- end }}
   {{- end }}
   matchImages:
-  - {{ printf "%q" .MirrorHost }}
   - "*"
   - "*.*"
   - "*.*.*"

pkg/handlers/generic/mutation/imageregistries/credentials/templates/static-credential-provider.json.gotmpl

@@ -4,8 +4,8 @@
   "cacheKeyType":"Image",
   "cacheDuration":"0s",
   "auth":{
-    {{- if .MirrorHost }}
-    {{ printf "%q" .MirrorHost }}: {"username": {{ printf "%q" .Username }}, "password": {{ printf "%q" .Password }}}{{ if eq .MirrorHost "registry-1.docker.io" }},
+    {{- if .RegistryHost }}
+    {{ printf "%q" .RegistryHost }}: {"username": {{ printf "%q" .Username }}, "password": {{ printf "%q" .Password }}}{{ if eq .RegistryHost "registry-1.docker.io" }},
     "docker.io": {"username": {{ printf "%q" .Username }}, "password": {{ printf "%q" .Password }}}
     {{- end }}
     {{- end }}