From ec3804cc6f1f77a2da57a092cccd18e5c9216bb1 Mon Sep 17 00:00:00 2001 From: Matheus Pimenta Date: Thu, 5 Jun 2025 19:07:12 +0100 Subject: [PATCH] Introduce support for shelling out to Azure binaries in authentication Signed-off-by: Matheus Pimenta --- cmd/flux/oci.go | 8 +++++++- cmd/flux/push_artifact.go | 10 ++++++++-- go.mod | 3 ++- go.sum | 6 ++++-- 4 files changed, 21 insertions(+), 6 deletions(-) diff --git a/cmd/flux/oci.go b/cmd/flux/oci.go index 3dd61f0b..d919c9de 100644 --- a/cmd/flux/oci.go +++ b/cmd/flux/oci.go @@ -23,12 +23,18 @@ import ( "github.com/google/go-containerregistry/pkg/crane" + "github.com/fluxcd/pkg/auth" + "github.com/fluxcd/pkg/auth/azure" authutils "github.com/fluxcd/pkg/auth/utils" ) // loginWithProvider gets a crane authentication option for the given provider and URL. func loginWithProvider(ctx context.Context, url, provider string) (crane.Option, error) { - authenticator, err := authutils.GetArtifactRegistryCredentials(ctx, provider, url) + var opts []auth.Option + if provider == azure.ProviderName { + opts = append(opts, auth.WithAllowShellOut()) + } + authenticator, err := authutils.GetArtifactRegistryCredentials(ctx, provider, url, opts...) if err != nil { return nil, fmt.Errorf("could not login to provider %s with url %s: %w", provider, url, err) } diff --git a/cmd/flux/push_artifact.go b/cmd/flux/push_artifact.go index a03ea7ae..41fef563 100644 --- a/cmd/flux/push_artifact.go +++ b/cmd/flux/push_artifact.go @@ -34,6 +34,8 @@ import ( "github.com/spf13/cobra" "sigs.k8s.io/yaml" + "github.com/fluxcd/pkg/auth" + "github.com/fluxcd/pkg/auth/azure" authutils "github.com/fluxcd/pkg/auth/utils" "github.com/fluxcd/pkg/oci" sourcev1 "github.com/fluxcd/source-controller/api/v1" @@ -225,9 +227,13 @@ func pushArtifactCmdRun(cmd *cobra.Command, args []string) error { opts = append(opts, crane.WithAuth(authenticator)) } - if pushArtifactArgs.provider.String() != sourcev1.GenericOCIProvider { + if provider := pushArtifactArgs.provider.String(); provider != sourcev1.GenericOCIProvider { logger.Actionf("logging in to registry with provider credentials") - authenticator, err = authutils.GetArtifactRegistryCredentials(ctx, pushArtifactArgs.provider.String(), url) + var authOpts []auth.Option + if provider == azure.ProviderName { + authOpts = append(authOpts, auth.WithAllowShellOut()) + } + authenticator, err = authutils.GetArtifactRegistryCredentials(ctx, provider, url, authOpts...) if err != nil { return fmt.Errorf("error during login with provider: %w", err) } diff --git a/go.mod b/go.mod index c82327dc..4cf20691 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/fluxcd/notification-controller/api v1.6.0 github.com/fluxcd/pkg/apis/event v0.17.0 github.com/fluxcd/pkg/apis/meta v1.12.0 - github.com/fluxcd/pkg/auth v0.16.0 + github.com/fluxcd/pkg/auth v0.17.0 github.com/fluxcd/pkg/chartutil v1.3.0 github.com/fluxcd/pkg/envsubst v1.4.0 github.com/fluxcd/pkg/git v0.31.0 @@ -87,6 +87,7 @@ require ( github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect github.com/aws/aws-sdk-go-v2/service/ecr v1.43.3 // indirect + github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.33.0 // indirect github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect diff --git a/go.sum b/go.sum index f9b71ecf..2b85e059 100644 --- a/go.sum +++ b/go.sum @@ -59,6 +59,8 @@ github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo= github.com/aws/aws-sdk-go-v2/service/ecr v1.43.3 h1:YyH8Hk73bYzdbvf6S8NF5z/fb/1stpiMnFSfL6jSfRA= github.com/aws/aws-sdk-go-v2/service/ecr v1.43.3/go.mod h1:iQ1skgw1XRK+6Lgkb0I9ODatAP72WoTILh0zXQ5DtbU= +github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.33.0 h1:wA2O6pZ2r5smqJunFP4hp7qptMW4EQxs8O6RVHPulOE= +github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.33.0/go.mod h1:RZL7ov7c72wSmoM8bIiVxRHgcVdzhNkVW2J36C8RF4s= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM= @@ -179,8 +181,8 @@ github.com/fluxcd/pkg/apis/kustomize v1.10.0 h1:47EeSzkQvlQZdH92vHMe2lK2iR8aOSEJ github.com/fluxcd/pkg/apis/kustomize v1.10.0/go.mod h1:UsqMV4sqNa1Yg0pmTsdkHRJr7bafBOENIJoAN+3ezaQ= github.com/fluxcd/pkg/apis/meta v1.12.0 h1:XW15TKZieC2b7MN8VS85stqZJOx+/b8jATQ/xTUhVYg= github.com/fluxcd/pkg/apis/meta v1.12.0/go.mod h1:+son1Va60x2eiDcTwd7lcctbI6C+K3gM7R+ULmEq1SI= -github.com/fluxcd/pkg/auth v0.16.0 h1:YEjSaNqlpYoXfoFAGhU/Z8y0322nGsT24W6zCh+sbGw= -github.com/fluxcd/pkg/auth v0.16.0/go.mod h1:+BRnAO61Nr6fACEjJS6eNRdOk1nXhX/FCPylYn1ypNc= +github.com/fluxcd/pkg/auth v0.17.0 h1:jgum55f5K7Db6yI2bi4WeKojTzQS9KxlHCC0CsFs5x8= +github.com/fluxcd/pkg/auth v0.17.0/go.mod h1:4h6s8VBNuec3tWd4xIReLw8BYPOKaIegjNMEbA4ikTU= github.com/fluxcd/pkg/cache v0.9.0 h1:EGKfOLMG3fOwWnH/4Axl5xd425mxoQbZzlZoLfd8PDk= github.com/fluxcd/pkg/cache v0.9.0/go.mod h1:jMwabjWfsC5lW8hE7NM3wtGNwSJ38Javx6EKbEi7INU= github.com/fluxcd/pkg/chartutil v1.3.0 h1:Zoc+AIyKL4YU4PaLL/iGv9VRLujeWT2Mvj4BLGFGKlg=