AKS credentials for ACR

registry/azure.go

@@ -0,0 +1,53 @@
+package registry
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"strings"
+)
+
+const (
+    // Mount volume from hostpath.
+    azureCloudConfigJsonFile = "/etc/kubernetes/azure.json"
+)
+
+type azureCloudConfig struct {
+    AADClientId string `json:"aadClientId"`
+    AADClientSecret string `json:"aadClientSecret"`
+}
+
+// Fetch Azure Active Directory clientid/secret pair from azure.json, usable for container registry authentication.
+//
+// Note: azure.json is populated by AKS/AKS-Engine script kubernetesconfigs.sh. The file is then passed to kubelet via
+// --azure-container-registry-config=/etc/kubernetes/azure.json, parsed by kubernetes/kubernetes' azure_credentials.go
+// https://github.com/kubernetes/kubernetes/issues/58034 seeks to deprecate this kubelet command-line argument, possibly
+// replacing it with managed identity for the Node VMs. See https://github.com/Azure/acr/blob/master/docs/AAD-OAuth.md
+func GetAzureCloudConfigAADToken(host string) (creds, error) {
+    jsonFile, err := ioutil.ReadFile(azureCloudConfigJsonFile)
+    if err != nil {
+        return creds{}, err
+    }
+
+    var token azureCloudConfig
+
+    err = json.Unmarshal(jsonFile, &token)
+    if err != nil {
+        return creds{}, err
+    }
+
+    return creds{
+        registry:   host,
+        provenance: "azure.json",
+        username:   token.AADClientId,
+        password:   token.AADClientSecret}, nil
+}
+
+// List from https://github.com/kubernetes/kubernetes/blob/master/pkg/credentialprovider/azure/azure_credentials.go
+func HostIsAzureContainerRegistry(host string) (bool) {
+    for _, v := range []string{".azurecr.io", ".azurecr.cn", ".azurecr.de", ".azurecr.us"} {
+        if strings.HasSuffix(host, v) {
+            return true
+        }
+    }
+    return false
+}

registry/azure_test.go

@@ -0,0 +1,56 @@
+package registry
+
+import (
+	"testing"
+)
+
+func Test_HostIsAzureContainerRegistry(t *testing.T) {
+	for _, v := range []struct {
+		host        string
+		isACR       bool
+	}{
+		{
+			host:  "azurecr.io",
+			isACR: false,
+		},
+		{
+			host:  "",
+			isACR: false,
+		},
+		{
+			host:  "gcr.io",
+			isACR: false,
+		},
+		{
+			host:  "notazurecr.io",
+			isACR: false,
+		},
+		{
+			host:  "example.azurecr.io.not",
+			isACR: false,
+		},
+		// Public cloud
+		{
+			host:  "example.azurecr.io",
+			isACR: true,
+		},
+		// Sovereign clouds
+		{
+			host:  "example.azurecr.cn",
+			isACR: true,
+		},
+		{
+			host:  "example.azurecr.de",
+			isACR: true,
+		},
+		{
+			host:  "example.azurecr.us",
+			isACR: true,
+		},
+	} {
+		result := HostIsAzureContainerRegistry(v.host)
+		if result != v.isACR {
+			t.Fatalf("For test %q, expected isACR = %v but got %v", v.host, v.isACR, result)
+		}
+	}
+}

registry/credentials.go

@@ -144,6 +144,13 @@ func (cs Credentials) credsFor(host string) creds {
 			return cred
 		}
 	}
+
+    if HostIsAzureContainerRegistry(host) {
+        if cred, err := GetAzureCloudConfigAADToken(host); err == nil {
+            return cred
+        }
+    }
+
 	return creds{}
 }