fix: image registries with a CA

Author: dkoshkin

pkg/handlers/generic/mutation/imageregistries/credentials/credential_provider_config_files.go

@@ -11,6 +11,7 @@ import (
 	"path"
 	"text/template"
 
+	corev1 "k8s.io/api/core/v1"
 	credentialproviderv1 "k8s.io/kubelet/pkg/apis/credentialprovider/v1"
 	cabpkv1 "sigs.k8s.io/cluster-api/bootstrap/kubeadm/api/v1beta1"
 
@@ -28,6 +29,8 @@ const (
 	kubeletDynamicCredentialProviderConfigOnRemote = "/etc/kubernetes/dynamic-credential-provider-config.yaml"
 
 	azureCloudConfigFilePath = "/etc/kubernetes/azure.json"
+
+	secretKeyForCACert = "ca.crt"
 )
 
 var (
@@ -47,10 +50,11 @@ var (
 )
 
 type providerConfig struct {
-	URL      string
-	Username string
-	Password string
-	Mirror   bool
+	URL       string
+	Username  string
+	Password  string
+	HasCACert bool
+	Mirror    bool
 }
 
 func (c providerConfig) isCredentialsEmpty() bool {
@@ -249,3 +253,12 @@ func fileFromTemplate(
 		Permissions: "0600",
 	}, nil
 }
+
+func secretHasCACert(secret *corev1.Secret) bool {
+	if secret == nil {
+		return false
+	}
+
+	_, ok := secret.Data[secretKeyForCACert]
+	return ok
+}

pkg/handlers/generic/mutation/imageregistries/credentials/inject.go

@@ -116,7 +116,7 @@ func (h *imageRegistriesPatchHandler) Mutate(
 	}
 
 	if globalMirrorErr == nil {
-		mirrorCredentials, generateErr := mirrorConfigFromGlobalImageRegistryMirror(
+		mirrorCredentials, generateErr := mirrorWithOptionalCredentialsFromGlobalImageRegistryMirror(
 			ctx,
 			h.client,
 			globalMirror,
@@ -332,12 +332,13 @@ func registryWithOptionalCredentialsFromImageRegistryCredentials(
 	if secret != nil {
 		registryWithOptionalCredentials.Username = string(secret.Data["username"])
 		registryWithOptionalCredentials.Password = string(secret.Data["password"])
+		registryWithOptionalCredentials.HasCACert = secretHasCACert(secret)
 	}
 
 	return registryWithOptionalCredentials, nil
 }
 
-func mirrorConfigFromGlobalImageRegistryMirror(
+func mirrorWithOptionalCredentialsFromGlobalImageRegistryMirror(
 	ctx context.Context,
 	c ctrlclient.Client,
 	mirror v1alpha1.GlobalImageRegistryMirror,
@@ -365,6 +366,7 @@ func mirrorConfigFromGlobalImageRegistryMirror(
 	if secret != nil {
 		mirrorCredentials.Username = string(secret.Data["username"])
 		mirrorCredentials.Password = string(secret.Data["password"])
+		mirrorCredentials.HasCACert = secretHasCACert(secret)
 	}
 
 	return mirrorCredentials, nil
@@ -438,12 +440,14 @@ func createSecretIfNeeded(
 // This handler reads input from two user provided variables: globalImageRegistryMirror and imageRegistries.
 // We expect if imageRegistries is set it will either have static credentials
 // or be for a registry where the credential plugin returns the credentials, ie ECR, GCR, ACR, etc,
+// or have no credentials set but to contain a CA cert,
 // and if that is not the case we assume the users missed setting static credentials and return an error.
 // However, in addition to passing credentials with the globalImageRegistryMirror variable,
 // it can also be used to only set Containerd mirror configuration,
 // in that case it valid for static credentials to not be set and will return false, no error
 // and this handler will skip generating any credential plugin related configuration.
 func needImageRegistryCredentialsConfiguration(configs []providerConfig) (bool, error) {
+	var needConfiguration bool
 	for _, config := range configs {
 		requiresStaticCredentials, err := config.requiresStaticCredentials()
 		if err != nil {
@@ -452,17 +456,16 @@ func needImageRegistryCredentialsConfiguration(configs []providerConfig) (bool,
 		}
 		// verify the credentials are actually set if the plugin requires static credentials
 		if config.isCredentialsEmpty() && requiresStaticCredentials {
-			// not setting credentials for a mirror is valid
-			// but if it's the only configuration then return false here and exit the handler early
-			if config.Mirror {
-				if len(configs) == 1 {
-					return false, nil
-				}
-			} else {
-				return false, fmt.Errorf("invalid image registry: %s: %w", config.URL, ErrCredentialsNotFound)
+			if config.Mirror || config.HasCACert {
+				// not setting credentials for a mirror is valid
+				// not setting credentials for a registry with a CA cert is valid
+				continue
 			}
+			return false, fmt.Errorf("invalid image registry: %s: %w", config.URL, ErrCredentialsNotFound)
+
 		}
+		needConfiguration = true
 	}
 
-	return true, nil
+	return needConfiguration, nil
 }