Registry credentials configuration

addons/machinecontroller/machine-controller.yaml

@@ -646,6 +646,20 @@ data:
   "ca.crt": |
 {{ .Certificates.KubernetesCA | b64enc | indent 4 }}
 
+{{ if .RegistryCredentials }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kubeone-registry-credentials
+  namespace: kube-system
+data:
+{{ range .RegistryCredentials }}
+  {{ .RegistryName }}: |
+{{ mustToRawJson .Auth | b64enc | indent 4 }}
+{{ end }}
+{{ end }}
+
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration

docs/api_reference/v1beta2.en.md

@@ -1,6 +1,6 @@
 +++
 title = "v1beta2 API Reference"
-date = 2022-01-10T17:50:56+01:00
+date = 2022-01-11T11:06:38+02:00
 weight = 11
 +++
 ## v1beta2
@@ -20,6 +20,7 @@ weight = 11
 * [ContainerRuntimeContainerd](#containerruntimecontainerd)
 * [ContainerRuntimeDocker](#containerruntimedocker)
 * [ContainerdRegistry](#containerdregistry)
+* [ContainerdRegistryAuthConfig](#containerdregistryauthconfig)
 * [ContainerdTLSConfig](#containerdtlsconfig)
 * [ControlPlaneConfig](#controlplaneconfig)
 * [DNSConfig](#dnsconfig)
@@ -237,6 +238,20 @@ ContainerdRegistry defines endpoints and security for given container registry
 | ----- | ----------- | ------ | -------- |
 | mirrors | List of registry mirrors to use | []string | false |
 | tlsConfig | TLSConfig for the registry | *[ContainerdTLSConfig](#containerdtlsconfig) | false |
+| auth | Registry authentication | *[ContainerdRegistryAuthConfig](#containerdregistryauthconfig) | false |
+
+[Back to Group](#v1beta2)
+
+### ContainerdRegistryAuthConfig
+
+Containerd per-registry credentials config
+
+| Field | Description | Scheme | Required |
+| ----- | ----------- | ------ | -------- |
+| username |  | string | false |
+| password |  | string | false |
+| auth |  | string | false |
+| identityToken |  | string | false |
 
 [Back to Group](#v1beta2)
 

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/iancoleman/orderedmap v0.2.0
 	github.com/imdario/mergo v0.3.12
 	github.com/koron-go/prefixw v0.0.0-20181013140428-271b207a7572
-	github.com/kubermatic/machine-controller v1.40.1
+	github.com/kubermatic/machine-controller v1.41.0
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de
 	github.com/pkg/errors v0.9.1
 	github.com/pmezard/go-difflib v1.0.0

pkg/addons/applier.go

@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"io/fs"
 	"os"
+	"sort"
 	"strings"
 
 	"github.com/MakeNowJust/heredoc/v2"
@@ -66,11 +67,17 @@ type templateData struct {
 	CSIMigration                        bool
 	CSIMigrationFeatureGates            string
 	MachineControllerCredentialsEnvVars string
+	RegistryCredentials                 []registryCredentialsContainer
 	InternalImages                      *internalImages
 	Resources                           map[string]string
 	Params                              map[string]string
 }
 
+type registryCredentialsContainer struct {
+	RegistryName string
+	Auth         kubeoneapi.ContainerdRegistryAuthConfig
+}
+
 func newAddonsApplier(s *state.State) (*applier, error) {
 	var localFS fs.FS
 
@@ -155,6 +162,28 @@ func newAddonsApplier(s *state.State) (*applier, error) {
 		}
 	}
 
+	regCredentials := []registryCredentialsContainer{}
+
+	if s.Cluster.ContainerRuntime.Containerd != nil {
+		regNames := []string{}
+
+		for reg := range s.Cluster.ContainerRuntime.Containerd.Registries {
+			regNames = append(regNames, reg)
+		}
+
+		sort.Strings(regNames)
+
+		for _, reg := range regNames {
+			regConfig := s.Cluster.ContainerRuntime.Containerd.Registries[reg]
+			if regConfig.Auth != nil {
+				regCredentials = append(regCredentials, registryCredentialsContainer{
+					RegistryName: reg,
+					Auth:         *regConfig.Auth,
+				})
+			}
+		}
+	}
+
 	data := templateData{
 		Config: s.Cluster,
 		Certificates: map[string]string{
@@ -170,6 +199,7 @@ func newAddonsApplier(s *state.State) (*applier, error) {
 		CSIMigration:                        csiMigration,
 		CSIMigrationFeatureGates:            csiMigrationFeatureGates,
 		MachineControllerCredentialsEnvVars: string(credsEnvVarsMC),
+		RegistryCredentials:                 regCredentials,
 		InternalImages: &internalImages{
 			pauseImage: s.PauseImage,
 			resolver:   s.Images.Get,

pkg/apis/kubeone/helpers.go

@@ -28,6 +28,10 @@ import (
 	"github.com/pkg/errors"
 )
 
+const (
+	credentialSecretName = "kube-system/kubeone-registry-credentials" //nolint:gosec
+)
+
 // Leader returns the first configured host. Only call this after
 // validating the cluster config to ensure a leader exists.
 func (c KubeOneCluster) Leader() (HostConfig, error) {
@@ -100,9 +104,11 @@ func (crc ContainerRuntimeConfig) MachineControllerFlags() []string {
 		// -node-containerd-registry-mirrors=k8s.gcr.io=http://somewhere
 		// -node-insecure-registries=docker.io,k8s.gcr.io
 		var (
-			registryNames []string
-			insecureSet   = map[string]struct{}{}
+			registryNames                 []string
+			insecureSet                   = map[string]struct{}{}
+			registryCredentialsSecretFlag bool
 		)
+
 		for registry := range crc.Containerd.Registries {
 			registryNames = append(registryNames, registry)
 		}
@@ -121,6 +127,16 @@ func (crc ContainerRuntimeConfig) MachineControllerFlags() []string {
 					fmt.Sprintf("-node-containerd-registry-mirrors=%s=%s", registryName, mirror),
 				)
 			}
+
+			if containerdRegistry.Auth != nil {
+				registryCredentialsSecretFlag = true
+			}
+		}
+
+		if registryCredentialsSecretFlag {
+			mcFlags = append(mcFlags,
+				fmt.Sprintf("-node-registry-credentials-secret=%s", credentialSecretName),
+			)
 		}
 
 		if len(insecureSet) > 0 {

pkg/apis/kubeone/types.go

@@ -93,6 +93,17 @@ type ContainerdRegistry struct {
 
 	// TLSConfig for the registry
 	TLSConfig *ContainerdTLSConfig `json:"tlsConfig,omitempty"`
+
+	// Registry authentication
+	Auth *ContainerdRegistryAuthConfig `json:"auth,omitempty"`
+}
+
+// Containerd per-registry credentials config
+type ContainerdRegistryAuthConfig struct {
+	Username      string `json:"username,omitempty"`
+	Password      string `json:"password,omitempty"`
+	Auth          string `json:"auth,omitempty"`
+	IdentityToken string `json:"identityToken,omitempty"`
 }
 
 // Configures containerd TLS for a registry

pkg/apis/kubeone/v1beta2/types.go

@@ -91,6 +91,17 @@ type ContainerdRegistry struct {
 
 	// TLSConfig for the registry
 	TLSConfig *ContainerdTLSConfig `json:"tlsConfig,omitempty"`
+
+	// Registry authentication
+	Auth *ContainerdRegistryAuthConfig `json:"auth,omitempty"`
+}
+
+// Containerd per-registry credentials config
+type ContainerdRegistryAuthConfig struct {
+	Username      string `json:"username,omitempty"`
+	Password      string `json:"password,omitempty"`
+	Auth          string `json:"auth,omitempty"`
+	IdentityToken string `json:"identityToken,omitempty"`
 }
 
 // Configures containerd TLS for a registry

pkg/cmd/config.go

@@ -610,6 +610,12 @@ containerRuntime:
   #     docker.io:
   #       mirrors:
   #       - http://plain-text2.tld
+  #       auth:
+  #         # all of the following fields are optional
+  #         username: "u5er"
+  #         password: "myc00lp455w0rd"
+  #         auth: "base64(user:password)"
+  #         identityToken: ""
   #     "*":
   #       mirrors:
   #       - https://secure.tld

pkg/containerruntime/containerd_config.go

@@ -63,7 +63,15 @@ type containerdRegistryMirror struct {
 }
 
 type containerdRegistryConfig struct {
-	TLS *containerdRegistryTLSConfig `toml:"tls"`
+	TLS  *containerdRegistryTLSConfig `toml:"tls"`
+	Auth *containerdRegistryAuth      `toml:"auth"`
+}
+
+type containerdRegistryAuth struct {
+	Username      string `toml:"username"`
+	Password      string `toml:"password"`
+	Auth          string `toml:"auth"`
+	IdentityToken string `toml:"identitytoken"`
 }
 
 type containerdRegistryTLSConfig struct {
@@ -118,6 +126,17 @@ func marshalContainerdConfig(cluster *kubeone.KubeOneCluster) (string, error) {
 					},
 				}
 			}
+
+			if registry.Auth != nil {
+				regConfig := criPlugin.Registry.Configs[registryName]
+				regConfig.Auth = &containerdRegistryAuth{
+					Username:      registry.Auth.Username,
+					Password:      registry.Auth.Password,
+					Auth:          registry.Auth.Auth,
+					IdentityToken: registry.Auth.IdentityToken,
+				}
+				criPlugin.Registry.Configs[registryName] = regConfig
+			}
 		}
 	}