Merge pull request #2934 from stmcginnis/cred-prov-env

Enable environment variables for Kubernetes credential providers
bottlerocket-os · Apr 10, 2023 · 570d90b · 570d90b
2 parents b59757b + 2fcb890
commit 570d90b
Show file tree

Hide file tree

Showing 7 changed files with 65 additions and 16 deletions.
diff --git a/README.md b/README.md
@@ -434,6 +434,11 @@ The following settings are optional and allow you to further configure your clus
     "*.dkr.ecr.us-east-2.amazonaws.com",
     "*.dkr.ecr.us-west-2.amazonaws.com"
   ]
+
+  [settings.kubernetes.credential-providers.ecr-credential-provider.environment]
+  # The following are not used with ecr-credential-provider, but are provided for illustration
+  "KEY" = "abc123xyz"
+  "GOMAXPROCS" = "2"
   ```
 
   **Note:** `ecr-credential-provider` is currently the only supported provider.

diff --git a/packages/kubernetes-1.22/credential-provider-config-yaml b/packages/kubernetes-1.22/credential-provider-config-yaml
@@ -11,13 +11,21 @@ providers:
 {{/each}}
     defaultCacheDuration: "{{default "12h" this.cache-duration}}"
     apiVersion: credentialprovider.kubelet.k8s.io/v1alpha1
-{{#if (eq @key "ecr-credential-provider")}}
+{{#if (or (eq @key "ecr-credential-provider") this.environment)}}
     env:
+{{#if this.environment}}
+{{#each this.environment}}
+      - name: {{@key}}
+        value: '{{this}}'
+{{/each}}
+{{/if}}
+{{#if (eq @key "ecr-credential-provider")}}
       - name: HOME
-        value: /root
+        value: '/root'
 {{#if @root.settings.aws.profile}}
       - name: AWS_PROFILE
-        value: {{@root.settings.aws.profile}}
+        value: '{{@root.settings.aws.profile}}'
+{{/if}}
 {{/if}}
 {{/if}}
 {{/if}}

diff --git a/packages/kubernetes-1.23/credential-provider-config-yaml b/packages/kubernetes-1.23/credential-provider-config-yaml
@@ -11,13 +11,21 @@ providers:
 {{/each}}
     defaultCacheDuration: "{{default "12h" this.cache-duration}}"
     apiVersion: credentialprovider.kubelet.k8s.io/v1alpha1
-{{#if (eq @key "ecr-credential-provider")}}
+{{#if (or (eq @key "ecr-credential-provider") this.environment)}}
     env:
+{{#if this.environment}}
+{{#each this.environment}}
+      - name: {{@key}}
+        value: '{{this}}'
+{{/each}}
+{{/if}}
+{{#if (eq @key "ecr-credential-provider")}}
       - name: HOME
-        value: /root
+        value: '/root'
 {{#if @root.settings.aws.profile}}
       - name: AWS_PROFILE
-        value: {{@root.settings.aws.profile}}
+        value: '{{@root.settings.aws.profile}}'
+{{/if}}
 {{/if}}
 {{/if}}
 {{/if}}

diff --git a/packages/kubernetes-1.24/credential-provider-config-yaml b/packages/kubernetes-1.24/credential-provider-config-yaml
@@ -11,13 +11,21 @@ providers:
 {{/each}}
     defaultCacheDuration: "{{default "12h" this.cache-duration}}"
     apiVersion: credentialprovider.kubelet.k8s.io/v1alpha1
-{{#if (eq @key "ecr-credential-provider")}}
+{{#if (or (eq @key "ecr-credential-provider") this.environment)}}
     env:
+{{#if this.environment}}
+{{#each this.environment}}
+      - name: {{@key}}
+        value: '{{this}}'
+{{/each}}
+{{/if}}
+{{#if (eq @key "ecr-credential-provider")}}
       - name: HOME
-        value: /root
+        value: '/root'
 {{#if @root.settings.aws.profile}}
       - name: AWS_PROFILE
-        value: {{@root.settings.aws.profile}}
+        value: '{{@root.settings.aws.profile}}'
+{{/if}}
 {{/if}}
 {{/if}}
 {{/if}}

diff --git a/packages/kubernetes-1.25/credential-provider-config-yaml b/packages/kubernetes-1.25/credential-provider-config-yaml
@@ -11,13 +11,21 @@ providers:
 {{/each}}
     defaultCacheDuration: "{{default "12h" this.cache-duration}}"
     apiVersion: credentialprovider.kubelet.k8s.io/v1beta1
-{{#if (eq @key "ecr-credential-provider")}}
+{{#if (or (eq @key "ecr-credential-provider") this.environment)}}
     env:
+{{#if this.environment}}
+{{#each this.environment}}
+      - name: {{@key}}
+        value: '{{this}}'
+{{/each}}
+{{/if}}
+{{#if (eq @key "ecr-credential-provider")}}
       - name: HOME
-        value: /root
+        value: '/root'
 {{#if @root.settings.aws.profile}}
       - name: AWS_PROFILE
-        value: {{@root.settings.aws.profile}}
+        value: '{{@root.settings.aws.profile}}'
+{{/if}}
 {{/if}}
 {{/if}}
 {{/if}}

diff --git a/packages/kubernetes-1.26/credential-provider-config-yaml b/packages/kubernetes-1.26/credential-provider-config-yaml
@@ -11,13 +11,21 @@ providers:
 {{/each}}
     defaultCacheDuration: "{{default "12h" this.cache-duration}}"
     apiVersion: credentialprovider.kubelet.k8s.io/v1
-{{#if (eq @key "ecr-credential-provider")}}
+{{#if (or (eq @key "ecr-credential-provider") this.environment)}}
     env:
+{{#if this.environment}}
+{{#each this.environment}}
+      - name: {{@key}}
+        value: '{{this}}'
+{{/each}}
+{{/if}}
+{{#if (eq @key "ecr-credential-provider")}}
       - name: HOME
-        value: /root
+        value: '/root'
 {{#if @root.settings.aws.profile}}
       - name: AWS_PROFILE
-        value: {{@root.settings.aws.profile}}
+        value: '{{@root.settings.aws.profile}}'
+{{/if}}
 {{/if}}
 {{/if}}
 {{/if}}

diff --git a/sources/models/src/modeled_types/kubernetes.rs b/sources/models/src/modeled_types/kubernetes.rs
@@ -7,6 +7,7 @@ use serde::de::Error as _;
 use serde_json::Value;
 use snafu::{ensure, ResultExt};
 use std::borrow::Borrow;
+use std::collections::HashMap;
 use std::convert::TryFrom;
 use std::fmt;
 use std::fmt::{Display, Formatter};
@@ -1315,12 +1316,15 @@ mod test_cluster_dns_ip {
     }
 }
 
+type EnvVarMap = HashMap<SingleLineString, SingleLineString>;
+
 /// CredentialProvider contains the settings for a credential provider for use
 /// in CredentialProviderConfig.
-#[derive(Debug, Clone, Eq, PartialEq, Hash, Serialize, Deserialize)]
+#[derive(Debug, Clone, Eq, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "kebab-case")]
 pub struct CredentialProvider {
     enabled: bool,
     image_patterns: Vec<SingleLineString>,
     cache_duration: Option<KubernetesDurationValue>,
+    environment: Option<EnvVarMap>,
 }