@@ -51,6 +51,8 @@ import (
5151
5252 eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
5353 "github.com/fluxcd/pkg/apis/meta"
54+ "github.com/fluxcd/pkg/auth"
55+ "github.com/fluxcd/pkg/cache"
5456 "github.com/fluxcd/pkg/oci"
5557 "github.com/fluxcd/pkg/runtime/conditions"
5658 helper "github.com/fluxcd/pkg/runtime/controller"
@@ -141,6 +143,7 @@ type OCIRepositoryReconciler struct {
141143
142144 Storage * Storage
143145 ControllerName string
146+ TokenCache * cache.TokenCache
144147 requeueDependency time.Duration
145148
146149 patchOptions []patch.Option
@@ -175,6 +178,7 @@ func (r *OCIRepositoryReconciler) SetupWithManagerAndOptions(mgr ctrl.Manager, o
175178// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=ocirepositories/status,verbs=get;update;patch
176179// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=ocirepositories/finalizers,verbs=get;create;update;patch;delete
177180// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
181+ // +kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create
178182
179183func (r * OCIRepositoryReconciler ) Reconcile (ctx context.Context , req ctrl.Request ) (result ctrl.Result , retErr error ) {
180184 start := time .Now ()
@@ -328,7 +332,7 @@ func (r *OCIRepositoryReconciler) reconcile(ctx context.Context, sp *patch.Seria
328332// If this fails, it records v1beta2.FetchFailedCondition=True on the object and returns early.
329333func (r * OCIRepositoryReconciler ) reconcileSource (ctx context.Context , sp * patch.SerialPatcher ,
330334 obj * ociv1.OCIRepository , metadata * sourcev1.Artifact , dir string ) (sreconcile.Result , error ) {
331- var auth authn.Authenticator
335+ var authenticator authn.Authenticator
332336
333337 ctxTimeout , cancel := context .WithTimeout (ctx , obj .Spec .Timeout .Duration )
334338 defer cancel ()
@@ -363,9 +367,29 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
363367 }
364368
365369 if _ , ok := keychain .(soci.Anonymous ); obj .Spec .Provider != ociv1 .GenericOCIProvider && ok {
370+ var opts []auth.Option
371+ if obj .Spec .ServiceAccountName != "" {
372+ serviceAccount := client.ObjectKey {
373+ Name : obj .Spec .ServiceAccountName ,
374+ Namespace : obj .GetNamespace (),
375+ }
376+ opts = append (opts , auth .WithServiceAccount (serviceAccount , r .Client ))
377+ }
378+ if r .TokenCache != nil {
379+ involvedObject := cache.InvolvedObject {
380+ Kind : ociv1 .OCIRepositoryKind ,
381+ Name : obj .GetName (),
382+ Namespace : obj .GetNamespace (),
383+ Operation : cache .OperationReconcile ,
384+ }
385+ opts = append (opts , auth .WithCache (* r .TokenCache , involvedObject ))
386+ }
387+ if proxyURL != nil {
388+ opts = append (opts , auth .WithProxyURL (* proxyURL ))
389+ }
366390 var authErr error
367- auth , authErr = soci .OIDCAuth (ctxTimeout , obj .Spec .URL , obj .Spec .Provider , proxyURL )
368- if authErr != nil && ! errors . Is ( authErr , oci . ErrUnconfiguredProvider ) {
391+ authenticator , authErr = soci .OIDCAuth (ctxTimeout , obj .Spec .URL , obj .Spec .Provider , opts ... )
392+ if authErr != nil {
369393 e := serror .NewGeneric (
370394 fmt .Errorf ("failed to get credential from %s: %w" , obj .Spec .Provider , authErr ),
371395 sourcev1 .AuthenticationFailedReason ,
@@ -386,7 +410,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
386410 return sreconcile .ResultEmpty , e
387411 }
388412
389- opts := makeRemoteOptions (ctx , transport , keychain , auth )
413+ opts := makeRemoteOptions (ctx , transport , keychain , authenticator )
390414
391415 // Determine which artifact revision to pull
392416 ref , err := r .getArtifactRef (obj , opts )
@@ -446,7 +470,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
446470 conditions .GetObservedGeneration (obj , sourcev1 .SourceVerifiedCondition ) != obj .Generation ||
447471 conditions .IsFalse (obj , sourcev1 .SourceVerifiedCondition ) {
448472
449- result , err := r .verifySignature (ctx , obj , ref , keychain , auth , transport , opts ... )
473+ result , err := r .verifySignature (ctx , obj , ref , keychain , authenticator , transport , opts ... )
450474 if err != nil {
451475 provider := obj .Spec .Verify .Provider
452476 if obj .Spec .Verify .SecretRef == nil && obj .Spec .Verify .Provider == "cosign" {
@@ -1225,6 +1249,10 @@ func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *ociv
12251249 // Remove our finalizer from the list
12261250 controllerutil .RemoveFinalizer (obj , sourcev1 .SourceFinalizer )
12271251
1252+ // Cleanup caches.
1253+ r .TokenCache .DeleteEventsForObject (ociv1 .OCIRepositoryKind ,
1254+ obj .GetName (), obj .GetNamespace (), cache .OperationReconcile )
1255+
12281256 // Stop reconciliation as the object is being deleted
12291257 return sreconcile .ResultEmpty , nil
12301258}
0 commit comments