From 76e8cba4c20c185e4a3e5d74cf098a43151d03fe Mon Sep 17 00:00:00 2001 From: Xinhe Li Date: Mon, 18 May 2026 02:43:29 +0000 Subject: [PATCH 1/2] fix: update v2 Dockerfile and deployment.yaml for correct binary and args - Remove --platform=$BUILDPLATFORM from Dockerfile (breaks non-buildx builds) - Update deployment.yaml command to use /app/ratify-gatekeeper-provider binary - Update args to use Go flag style (-address, -config, -cert-file, -key-file) - Remove v1-specific args (--enable-crd-manager, --cache-*, --metrics-*, --health-port) Signed-off-by: Xinhe Li --- Dockerfile | 2 +- charts/ratify/templates/deployment.yaml | 25 +++++++++---------------- 2 files changed, 10 insertions(+), 17 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5a87c7386..f377d8d7c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,7 +11,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM --platform=$BUILDPLATFORM golang:1.24-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a AS builder +FROM golang:1.24-alpine@sha256:68932fa6d4d4059845c8f40ad7e654e626f3ebd3706eef7846f319293ab5cb7a AS builder WORKDIR /app diff --git a/charts/ratify/templates/deployment.yaml b/charts/ratify/templates/deployment.yaml index 3c3a630ee..492f7cfa4 100644 --- a/charts/ratify/templates/deployment.yaml +++ b/charts/ratify/templates/deployment.yaml @@ -60,27 +60,20 @@ spec: seccompProfile: type: RuntimeDefault command: - - "/app/ratify" + - "/app/ratify-gatekeeper-provider" args: - - "serve" - - "--http" + - "-address" - ":6001" - - "-c" + - "-config" - "/usr/local/ratify/config.json" - - "--enable-crd-manager" - - --cert-dir=/usr/local/tls + - "-cert-file" + - "/usr/local/tls/tls.crt" + - "-key-file" + - "/usr/local/tls/tls.key" {{- if (lookup "v1" "Secret" .Release.Namespace "gatekeeper-webhook-server-cert") }} - - --ca-cert-file=usr/local/tls/client-ca/ca.crt + - "-gatekeeper-ca-cert-file" + - "/usr/local/tls/client-ca/ca.crt" {{- end }} - - --cache-enabled={{ .Values.provider.cache.enabled }} - - --cache-type={{ default "ristretto" .Values.provider.cache.type }} - - --cache-name={{ default "dapr-redis" .Values.provider.cache.name }} - - --cache-size={{ .Values.provider.cache.cacheSizeMb }} - - --cache-ttl={{ .Values.provider.cache.ttl }} - - --metrics-enabled={{ .Values.instrumentation.metricsEnabled }} - - --metrics-type={{ .Values.instrumentation.metricsType }} - - --metrics-port={{ .Values.instrumentation.metricsPort }} - - --health-port=:{{ .Values.healthPort }} ports: - containerPort: 6001 {{- if .Values.instrumentation.metricsEnabled }} From fac7815a522d359152c8719760faf5468b8bf603 Mon Sep 17 00:00:00 2001 From: Xinhe Li Date: Mon, 18 May 2026 02:53:53 +0000 Subject: [PATCH 2/2] feat: add auth provider support to v2 registry-store Bridge existing v1 auth providers (azureWorkloadIdentity, azureManagedIdentity, dockerConfig, k8Secrets, etc.) into v2's registry-store via an adapter that implements ratify-go's RegistryCredentialGetter interface. Config example: "stores": { "*.azurecr.io": { "type": "registry-store", "parameters": { "authProvider": { "name": "azureWorkloadIdentity" } } } } Static credential still takes precedence if both are specified. Signed-off-by: Xinhe Li --- .../store/factory/registrystore/register.go | 69 +++++++++++++++++-- 1 file changed, 62 insertions(+), 7 deletions(-) diff --git a/internal/store/factory/registrystore/register.go b/internal/store/factory/registrystore/register.go index 279c12f37..52580cc23 100644 --- a/internal/store/factory/registrystore/register.go +++ b/internal/store/factory/registrystore/register.go @@ -22,6 +22,11 @@ import ( "github.com/notaryproject/ratify-go" "github.com/notaryproject/ratify/v2/internal/store/factory" + provider "github.com/ratify-project/ratify/pkg/common/oras/authprovider" + // Register built-in auth providers so they are available via + // CreateAuthProviderFromConfig. The blank imports trigger each + // package's init() which calls provider.Register(). + _ "github.com/ratify-project/ratify/pkg/common/oras/authprovider/azure" ) const registryStoreType = "registry-store" @@ -50,7 +55,14 @@ type options struct { MaxManifestBytes int64 `json:"max_manifest_bytes,omitempty"` // Credential is the credential to use when accessing the registry. + // Takes precedence over AuthProvider if both are specified. Credential credential `json:"credential,omitempty"` + + // AuthProvider configures a named auth provider (e.g. + // "azureWorkloadIdentity", "azureManagedIdentity", "dockerConfig") + // to obtain registry credentials dynamically. + // Ignored if Credential is set. + AuthProvider provider.AuthProviderConfig `json:"authProvider,omitempty"` } func init() { @@ -65,15 +77,29 @@ func init() { return nil, fmt.Errorf("failed to unmarshal store parameters: %w", err) } - registryStoreOpts := ratify.RegistryStoreOptions{ - PlainHTTP: params.PlainHTTP, - UserAgent: params.UserAgent, - MaxBlobBytes: params.MaxBlobBytes, - MaxManifestBytes: params.MaxManifestBytes, - CredentialProvider: &defaultCredGetter{ + var credProvider ratify.RegistryCredentialGetter + + // Static credential takes precedence. + if params.Credential.Password != "" { + credProvider = &defaultCredGetter{ username: params.Credential.Username, password: params.Credential.Password, - }, + } + } else if params.AuthProvider != nil { + // Use the named auth provider (azureWorkloadIdentity, etc.) + ap, err := provider.CreateAuthProviderFromConfig(params.AuthProvider) + if err != nil { + return nil, fmt.Errorf("failed to create auth provider: %w", err) + } + credProvider = &authProviderAdapter{provider: ap} + } + + registryStoreOpts := ratify.RegistryStoreOptions{ + PlainHTTP: params.PlainHTTP, + UserAgent: params.UserAgent, + MaxBlobBytes: params.MaxBlobBytes, + MaxManifestBytes: params.MaxManifestBytes, + CredentialProvider: credProvider, } return ratify.NewRegistryStore(registryStoreOpts), nil @@ -99,3 +125,32 @@ func (d *defaultCredGetter) Get(_ context.Context, _ string) (ratify.RegistryCre Password: d.password, }, nil } + +// authProviderAdapter adapts a v1 [provider.AuthProvider] to the v2 +// [ratify.RegistryCredentialGetter] interface, bridging the existing Azure +// Workload Identity, Managed Identity, k8s Secrets, and other auth provider +// implementations into the v2 registry store. +type authProviderAdapter struct { + provider provider.AuthProvider +} + +// Get obtains credentials from the underlying auth provider for the given +// server address. +func (a *authProviderAdapter) Get(ctx context.Context, serverAddress string) (ratify.RegistryCredential, error) { + authConfig, err := a.provider.Provide(ctx, serverAddress) + if err != nil { + return ratify.RegistryCredential{}, err + } + + // Map v1 AuthConfig fields to v2 RegistryCredential. + // IdentityToken maps to RefreshToken (OAuth2 refresh/identity token). + if authConfig.IdentityToken != "" { + return ratify.RegistryCredential{ + RefreshToken: authConfig.IdentityToken, + }, nil + } + return ratify.RegistryCredential{ + Username: authConfig.Username, + Password: authConfig.Password, + }, nil +}