fluxcd
/
source-controller
mirror of https://github.com/fluxcd/source-controller.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

OCIRepository: Configure proxy for OIDC auth 

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This commit is contained in:
Stefan Prodan 2024-09-10 18:54:32 +03:00
parent cc1762b2e5
commit e3992568f5
No known key found for this signature in database
GPG Key ID: 3299AEB0E4085BAF
3 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
internal/controller/ocirepository_controller.go
View File

@ -354,9 +354,19 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
return sreconcile.ResultEmpty, e return sreconcile.ResultEmpty, e
} }
proxyURL, err := r.getProxyURL(ctx, obj)
if err != nil {
e := serror.NewGeneric(
fmt.Errorf("failed to get proxy address: %w", err),
sourcev1.AuthenticationFailedReason,
)
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
return sreconcile.ResultEmpty, e
}
if _, ok := keychain.(soci.Anonymous); obj.Spec.Provider != ociv1.GenericOCIProvider && ok { if _, ok := keychain.(soci.Anonymous); obj.Spec.Provider != ociv1.GenericOCIProvider && ok {
var authErr error var authErr error
auth, authErr = soci.OIDCAuth(ctxTimeout, obj.Spec.URL, obj.Spec.Provider) auth, authErr = soci.OIDCAuth(ctxTimeout, obj.Spec.URL, obj.Spec.Provider, proxyURL)
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) { if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
e := serror.NewGeneric( e := serror.NewGeneric(
fmt.Errorf("failed to get credential from %s: %w", obj.Spec.Provider, authErr), fmt.Errorf("failed to get credential from %s: %w", obj.Spec.Provider, authErr),
@ -368,7 +378,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
} }
// Generate the transport for remote operations // Generate the transport for remote operations
transport, err := r.transport(ctx, obj) transport, err := r.transport(ctx, obj, proxyURL)
if err != nil { if err != nil {
e := serror.NewGeneric( e := serror.NewGeneric(
fmt.Errorf("failed to generate transport for '%s': %w", obj.Spec.URL, err), fmt.Errorf("failed to generate transport for '%s': %w", obj.Spec.URL, err),
@ -927,7 +937,7 @@ func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *ociv1.OCIRe
// the returned transport will include the TLS client and/or CA certificates. // the returned transport will include the TLS client and/or CA certificates.
// If the insecure flag is set, the transport will skip the verification of the server's certificate. // If the insecure flag is set, the transport will skip the verification of the server's certificate.
// Additionally, if a proxy is specified, transport will use it. // Additionally, if a proxy is specified, transport will use it.
func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *ociv1.OCIRepository) (*http.Transport, error) { func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *ociv1.OCIRepository, proxyURL *url.URL) (*http.Transport, error) {
transport := remote.DefaultTransport.(*http.Transport).Clone() transport := remote.DefaultTransport.(*http.Transport).Clone()
tlsConfig, err := r.getTLSConfig(ctx, obj) tlsConfig, err := r.getTLSConfig(ctx, obj)
@ -938,10 +948,6 @@ func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *ociv1.OCIR
transport.TLSClientConfig = tlsConfig transport.TLSClientConfig = tlsConfig
} }
proxyURL, err := r.getProxyURL(ctx, obj)
if err != nil {
return nil, err
}
if proxyURL != nil { if proxyURL != nil {
transport.Proxy = http.ProxyURL(proxyURL) transport.Proxy = http.ProxyURL(proxyURL)
} }

2
internal/helm/getter/client_opts.go
View File

@ -137,7 +137,7 @@ func GetClientOpts(ctx context.Context, c client.Client, obj *sourcev1.HelmRepos
} }
} }
} else if obj.Spec.Provider != sourcev1beta2.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI && ociRepo { } else if obj.Spec.Provider != sourcev1beta2.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI && ociRepo {
authenticator, authErr := soci.OIDCAuth(ctx, obj.Spec.URL, obj.Spec.Provider) authenticator, authErr := soci.OIDCAuth(ctx, obj.Spec.URL, obj.Spec.Provider, nil)
if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) { if authErr != nil && !errors.Is(authErr, oci.ErrUnconfiguredProvider) {
return nil, "", fmt.Errorf("failed to get credential from '%s': %w", obj.Spec.Provider, authErr) return nil, "", fmt.Errorf("failed to get credential from '%s': %w", obj.Spec.Provider, authErr)
} }

5
internal/oci/auth.go
View File

@ -19,6 +19,7 @@ package oci
import ( import (
"context" "context"
"fmt" "fmt"
"net/url"
"strings" "strings"
"github.com/fluxcd/pkg/oci/auth/login" "github.com/fluxcd/pkg/oci/auth/login"
@ -40,7 +41,7 @@ func (a Anonymous) Resolve(_ authn.Resource) (authn.Authenticator, error) {
} }
// OIDCAuth generates the OIDC credential authenticator based on the specified cloud provider. // OIDCAuth generates the OIDC credential authenticator based on the specified cloud provider.
func OIDCAuth(ctx context.Context, url, provider string) (authn.Authenticator, error) { func OIDCAuth(ctx context.Context, url, provider string, proxyURL *url.URL) (authn.Authenticator, error) {
u := strings.TrimPrefix(url, sourcev1.OCIRepositoryPrefix) u := strings.TrimPrefix(url, sourcev1.OCIRepositoryPrefix)
ref, err := name.ParseReference(u) ref, err := name.ParseReference(u)
if err != nil { if err != nil {
@ -57,5 +58,5 @@ func OIDCAuth(ctx context.Context, url, provider string) (authn.Authenticator, e
opts.GcpAutoLogin = true opts.GcpAutoLogin = true
} }
return login.NewManager().Login(ctx, u, ref, opts) return login.NewManager(login.WithProxyURL(proxyURL)).Login(ctx, u, ref, opts)
} }