auth: add auth/registry package for OCI registry auth

Add package `auth/registry` which provides a package level method
`GetAuthenticator()` that returns an authenticator for a specific OCI
registry.

Signed-off-by: Sanskar Jaiswal <[email protected]>

auth/cache.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2023 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"sync"
+	"time"
+)
+
+var once sync.Once
+var cache Store
+
+// InitCache intializes the pacakge cache with the provided cache object.
+// Consumers that want automatic caching when using `GetRegistryAuthenticator()`
+// or `GetGitCredentials()` must call this before. It should only be called once,
+// all subsequent calls will be a no-op.
+func InitCache(s Store) {
+	once.Do(func() {
+		cache = s
+	})
+}
+
+// GetCache returns a handle to the package level cache.
+func GetCache() Store {
+	return cache
+}
+
+// Store is a general purpose key value store.
+type Store interface {
+	Set(key string, val interface{}, ttl time.Duration) error
+	Get(key string) (interface{}, bool)
+}

auth/internal/testutils/dummy_store.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2023 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testutils
+
+import (
+	"time"
+
+	"github.com/fluxcd/pkg/auth"
+)
+
+type dummyCache struct {
+	items map[string]interface{}
+}
+
+func NewDummyCache() auth.Store {
+	return &dummyCache{
+		items: make(map[string]interface{}),
+	}
+}
+
+var _ auth.Store = &dummyCache{}
+
+func (c *dummyCache) Set(key string, item interface{}, _ time.Duration) error {
+	c.items[key] = item
+	return nil
+}
+
+func (c *dummyCache) Get(key string) (interface{}, bool) {
+	item, ok := c.items[key]
+	return item, ok
+}

auth/options.go

@@ -0,0 +1,57 @@
+/*
+Copyright 2023 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"github.com/fluxcd/pkg/auth/aws"
+	"github.com/fluxcd/pkg/auth/azure"
+	"github.com/fluxcd/pkg/auth/gcp"
+	"github.com/fluxcd/pkg/auth/github"
+	corev1 "k8s.io/api/core/v1"
+)
+
+const (
+	ProviderAWS    = "aws"
+	ProviderAzure  = "azure"
+	ProviderGCP    = "gcp"
+	ProviderGitHub = "github"
+)
+
+// AuthOptions contains options that can be used for authentication.
+type AuthOptions struct {
+	// Secret contains information that can be used to obtain the required
+	// set of credentials.
+	Secret *corev1.Secret
+
+	// ProviderOptions specifies the options to configure various authentication
+	// providers.
+	ProviderOptions ProviderOptions
+
+	// CacheKey is the key to use for caching the authentication credentials.
+	// Consumers must make sure to call `InitCache()` in order for caching to
+	// be enabled.
+	CacheKey string
+}
+
+// ProviderOptions contains options to configure various authentication
+// providers.
+type ProviderOptions struct {
+	AwsOpts    []aws.ProviderOptFunc
+	AzureOpts  []azure.ProviderOptFunc
+	GcpOpts    []gcp.ProviderOptFunc
+	GitHubOpts []github.ProviderOptFunc
+}

auth/registry/authenticator.go

@@ -0,0 +1,88 @@
+/*
+Copyright 2023 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package registry
+
+import (
+	"context"
+	"time"
+
+	"github.com/fluxcd/pkg/auth"
+	"github.com/fluxcd/pkg/auth/aws"
+	"github.com/fluxcd/pkg/auth/azure"
+	"github.com/fluxcd/pkg/auth/gcp"
+	"github.com/google/go-containerregistry/pkg/authn"
+)
+
+// GetAuthenticator returns an authenticator that can provide credentials to
+// access the provided registry.
+// If caching is enabled and authOpts.CacheKey is not blank, the authentication
+// config is cached according to the ttl advertised by the registry provider.
+func GetAuthenticator(ctx context.Context, registry string, provider string, authOpts *auth.AuthOptions) (authn.Authenticator, error) {
+	var authConfig authn.AuthConfig
+
+	cache := auth.GetCache()
+	if cache != nil && authOpts != nil && authOpts.CacheKey != "" {
+		val, found := cache.Get(authOpts.CacheKey)
+		if found {
+			authConfig = val.(authn.AuthConfig)
+			return authn.FromConfig(authConfig), nil
+		}
+	}
+
+	var err error
+	var expiresIn time.Duration
+	switch provider {
+	case auth.ProviderAWS:
+		var opts []aws.ProviderOptFunc
+		if authOpts != nil {
+			opts = authOpts.ProviderOptions.AwsOpts
+		}
+		awsProvider := aws.NewProvider(opts...)
+		authConfig, expiresIn, err = awsProvider.GetECRAuthConfig(ctx, registry)
+	case auth.ProviderAzure:
+		var opts []azure.ProviderOptFunc
+		scopeOpt := azure.GetScopeProiderOption(registry)
+		if scopeOpt != nil {
+			opts = append(opts, scopeOpt)
+		}
+		if authOpts != nil {
+			opts = authOpts.ProviderOptions.AzureOpts
+		}
+
+		azureProvider := azure.NewProvider(opts...)
+		authConfig, expiresIn, err = azureProvider.GetACRAuthConfig(ctx, registry)
+	case auth.ProviderGCP:
+		var opts []gcp.ProviderOptFunc
+		if authOpts != nil {
+			opts = authOpts.ProviderOptions.GcpOpts
+		}
+		gcpProvider := gcp.NewProvider(opts...)
+		authConfig, expiresIn, err = gcpProvider.GetGARAuthConfig(ctx)
+	default:
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if cache != nil && authOpts != nil && authOpts.CacheKey != "" {
+		if err := cache.Set(authOpts.CacheKey, authConfig, expiresIn); err != nil {
+			return nil, err
+		}
+	}
+	return authn.FromConfig(authConfig), nil
+}