@@ -48,8 +48,9 @@ import (
4848
4949 eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
5050 "github.com/fluxcd/pkg/apis/meta"
51- "github.com/fluxcd/pkg/oci"
52- "github.com/fluxcd/pkg/oci/auth/login"
51+ "github.com/fluxcd/pkg/auth"
52+ authutils "github.com/fluxcd/pkg/auth/utils"
53+ "github.com/fluxcd/pkg/cache"
5354 "github.com/fluxcd/pkg/runtime/conditions"
5455 helper "github.com/fluxcd/pkg/runtime/controller"
5556 "github.com/fluxcd/pkg/runtime/patch"
@@ -111,11 +112,12 @@ type ImageRepositoryReconciler struct {
111112 helper.Metrics
112113
113114 ControllerName string
115+ TokenCache * cache.TokenCache
114116 Database interface {
115117 DatabaseWriter
116118 DatabaseReader
117119 }
118- DeprecatedLoginOpts login. ProviderOptions
120+ DeprecatedLoginOpts []auth. Provider
119121
120122 patchOptions []patch.Option
121123}
@@ -350,7 +352,7 @@ func (r *ImageRepositoryReconciler) setAuthOptions(ctx context.Context, obj *ima
350352 // Configure authentication strategy to access the registry.
351353 var options []remote.Option
352354 var authSecret corev1.Secret
353- var auth authn.Authenticator
355+ var authenticator authn.Authenticator
354356 var authErr error
355357
356358 if obj .Spec .SecretRef != nil {
@@ -360,37 +362,49 @@ func (r *ImageRepositoryReconciler) setAuthOptions(ctx context.Context, obj *ima
360362 }, & authSecret ); err != nil {
361363 return nil , err
362364 }
363- auth , authErr = secret .AuthFromSecret (authSecret , ref )
365+ authenticator , authErr = secret .AuthFromSecret (authSecret , ref )
364366 } else {
365367 // Build login provider options and use it to attempt registry login.
366- opts := login.ProviderOptions {}
367- switch obj .GetProvider () {
368- case "aws" :
369- opts .AwsAutoLogin = true
370- case "azure" :
371- opts .AzureAutoLogin = true
372- case "gcp" :
373- opts .GcpAutoLogin = true
374- default :
375- opts = r .DeprecatedLoginOpts
376- }
377- var managerOpts []login.Option
368+ var opts []auth.Option
378369 if proxyURL != nil {
379- managerOpts = append (managerOpts , login .WithProxyURL (proxyURL ))
370+ opts = append (opts , auth .WithProxyURL (* proxyURL ))
371+ }
372+ switch provider := obj .GetProvider (); provider {
373+ case "aws" , "azure" , "gcp" :
374+ // Support new features (service account and cache) only for non-deprecated code paths.
375+ if obj .Spec .ServiceAccountName != "" {
376+ serviceAccount := client.ObjectKey {
377+ Name : obj .Spec .ServiceAccountName ,
378+ Namespace : obj .GetNamespace (),
379+ }
380+ opts = append (opts , auth .WithServiceAccount (serviceAccount , r .Client ))
381+ }
382+ if r .TokenCache != nil {
383+ involvedObject := cache.InvolvedObject {
384+ Kind : imagev1 .ImageRepositoryKind ,
385+ Name : obj .GetName (),
386+ Namespace : obj .GetNamespace (),
387+ Operation : cache .OperationReconcile ,
388+ }
389+ opts = append (opts , auth .WithCache (* r .TokenCache , involvedObject ))
390+ }
391+ authenticator , authErr = authutils .GetArtifactRegistryCredentials (ctx , provider , obj .Spec .Image , opts ... )
392+ default :
393+ // Handle deprecated auto-login controller flags.
394+ for _ , provider := range r .DeprecatedLoginOpts {
395+ if _ , err := provider .ParseArtifactRepository (obj .Spec .Image ); err == nil {
396+ authenticator , authErr = authutils .GetArtifactRegistryCredentials (ctx ,
397+ provider .GetName (), obj .Spec .Image , opts ... )
398+ break
399+ }
400+ }
380401 }
381- manager := login .NewManager (managerOpts ... )
382- auth , authErr = manager .Login (ctx , obj .Spec .Image , ref , opts )
383402 }
384403 if authErr != nil {
385- // If it's not unconfigured provider error, abort reconciliation.
386- // Continue reconciliation if it's unconfigured providers for scanning
387- // public repositories.
388- if ! errors .Is (authErr , oci .ErrUnconfiguredProvider ) {
389- return nil , authErr
390- }
404+ return nil , authErr
391405 }
392- if auth != nil {
393- options = append (options , remote .WithAuth (auth ))
406+ if authenticator != nil {
407+ options = append (options , remote .WithAuth (authenticator ))
394408 }
395409
396410 // Load any provided certificate.
@@ -437,7 +451,7 @@ func (r *ImageRepositoryReconciler) setAuthOptions(ctx context.Context, obj *ima
437451 options = append (options , remote .WithTransport (tr ))
438452 }
439453
440- if obj .Spec .ServiceAccountName != "" {
454+ if authenticator == nil && obj .Spec .ServiceAccountName != "" {
441455 serviceAccount := corev1.ServiceAccount {}
442456 // Lookup service account
443457 if err := r .Get (ctx , types.NamespacedName {
@@ -619,6 +633,10 @@ func (r *ImageRepositoryReconciler) reconcileDelete(ctx context.Context, obj *im
619633 // Remove our finalizer from the list.
620634 controllerutil .RemoveFinalizer (obj , imagev1 .ImageFinalizer )
621635
636+ // Cleanup caches.
637+ r .TokenCache .DeleteEventsForObject (imagev1 .ImageRepositoryKind ,
638+ obj .GetName (), obj .GetNamespace (), cache .OperationReconcile )
639+
622640 // Stop reconciliation as the object is being deleted.
623641 return ctrl.Result {}, nil
624642}
0 commit comments