registryauth

package

v0.22.0 Latest Latest Go to latest Published: Nov 4, 2026 License: Apache-2.0 Imports: 26 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Azure/unbounded

Links

Open Source Insights

Documentation ¶

Overview ¶

Package registryauth installs the stock ACR credential provider when explicitly requested.

Index ¶

Constants
Variables
func EnsureUpstream(runtimeConfig, policy string) (string, bool, error)
func IsACR(host string) bool
func RunNode(ctx context.Context, opts NodeOptions) error
func RunningKubeletArgs(root string) ([]string, error)
type Config
- func Derive(gantry, policy string) (Config, error)
type Installer
- func (i *Installer) Reconcile(ctx context.Context, cfg Config) error
type NodeOptions

Constants ¶

View Source

const (
	ConfigKey           = "node-auth.yaml"
	ProviderName        = "acr-credential-provider"
	ProviderBinary      = "/unbounded/bin/acr-credential-provider"
	ExternalMode        = "external"
	IdentityBindingMode = "aks-identity-binding"
	FlexNodeLabel       = "kubernetes.azure.com/nodepool-type"
	FlexNodeValue       = "FlexNodes"
	IdentityRoleName    = "gantry-acr-pull"
)

Variables ¶

View Source

var ErrKubeletNotRunning = errors.New("no running kubelet found; waiting before configuring node authentication")

Functions ¶

func EnsureUpstream ¶

func EnsureUpstream(runtimeConfig, policy string) (string, bool, error)

EnsureUpstream merges only the explicitly selected registry during attachment. It preserves unrelated runtime fields, registry entries, and YAML comments.

func IsACR ¶

func IsACR(host string) bool

func RunNode ¶

func RunNode(ctx context.Context, opts NodeOptions) error

RunNode installs configuration and upstream's executable. It never handles credentials.

func RunningKubeletArgs ¶

func RunningKubeletArgs(root string) ([]string, error)

Types ¶

type Config ¶

type Config struct {
	Mode         string `json:"mode,omitempty"`
	Registry     string `json:"registry,omitempty"`
	ClientID     string `json:"clientID,omitempty"`
	TenantID     string `json:"tenantID,omitempty"`
	SNIName      string `json:"sniName,omitempty"`
	ProxyAddress string `json:"proxyAddress,omitempty"`
	Audience     string `json:"audience,omitempty"`
	CACert       string `json:"caCert,omitempty"`
}

Config contains installation policy, never access tokens or client secrets. An absent policy leaves customer authentication entirely alone.

func Derive ¶

func Derive(gantry, policy string) (Config, error)

Derive validates the explicitly selected policy against Gantry's actual upstream.

func (Config) AzureConfig ¶

func (c Config) AzureConfig() ([]byte, error)

func (Config) ProviderConfig ¶

func (c Config) ProviderConfig() ([]byte, error)

ProviderConfig configures upstream's identity-binding mode, not its IMDS mode.

func (Config) Validate ¶

func (c Config) Validate() error

type Installer ¶

type Installer struct {
	Root        string
	Executable  string
	HostCommand func(context.Context, ...string) error
	KubeletArgs func() ([]string, error)
}

Installer manages its own files and drop-in without editing the agent's unit.

func (*Installer) Reconcile ¶

func (i *Installer) Reconcile(ctx context.Context, cfg Config) error

type NodeOptions ¶

type NodeOptions struct {
	Root         string
	ConfigJSON   string
	Listen       string
	ProviderPath string
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL