Fix implicit GCR auth (#1856)

* Fix implicit GCR auth

* boilerplate

cmd/warmer/cmd/root.go

@@ -19,13 +19,11 @@ package cmd
 import (
 	"fmt"
 	"os"
-	"strings"
 	"time"
 
 	"github.com/GoogleContainerTools/kaniko/pkg/cache"
 	"github.com/GoogleContainerTools/kaniko/pkg/config"
 	"github.com/GoogleContainerTools/kaniko/pkg/logging"
-	"github.com/GoogleContainerTools/kaniko/pkg/util"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
@@ -65,20 +63,6 @@ var RootCmd = &cobra.Command{
 				exit(errors.Wrap(err, "Failed to create cache directory"))
 			}
 		}
-		isGCR := false
-		for _, image := range opts.Images {
-			if strings.Contains(image, "gcr.io") || strings.Contains(image, ".pkg.dev") {
-				isGCR = true
-				break
-			}
-		}
-		// Historically kaniko was pre-configured by default with gcr credential helper,
-		// in here we keep the backwards compatibility by enabling the GCR helper only
-		// when gcr.io (or pkg.dev) is in one of the destinations.
-		if isGCR {
-			util.ConfigureGCR("")
-		}
-
 		if err := cache.WarmCache(opts); err != nil {
 			exit(errors.Wrap(err, "Failed warming cache"))
 		}

pkg/creds/creds_darwin.go

@@ -17,20 +17,33 @@ limitations under the License.
 package creds
 
 import (
+	"log"
 	"sync"
 
 	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/v1/google"
 )
 
 var (
-	setupKeyChainOnce sync.Once
-	keyChain          authn.Keychain
+	setupKeychainOnce sync.Once
+	keychain          authn.Keychain
 )
 
 // GetKeychain returns a keychain for accessing container registries.
 func GetKeychain() authn.Keychain {
-	setupKeyChainOnce.Do(func() {
-		keyChain = authn.NewMultiKeychain(authn.DefaultKeychain)
+	setupKeychainOnce.Do(func() {
+		keychain = authn.DefaultKeychain
+
+		// Historically kaniko was pre-configured by default with gcr
+		// credential helper, in here we keep the backwards
+		// compatibility by enabling the GCR helper only when gcr.io
+		// (or pkg.dev) is in one of the destinations.
+		gauth, err := google.NewEnvAuthenticator()
+		if err != nil {
+			log.Printf("Failed to setup Google env authenticator, ignoring: %v", err)
+		} else {
+			keychain = authn.NewMultiKeychain(authn.DefaultKeychain, gcrKeychain{gauth})
+		}
 	})
-	return keyChain
+	return keychain
 }

pkg/creds/creds_linux.go

@@ -23,18 +23,30 @@ import (
 	"github.com/genuinetools/bpfd/proc"
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/google/go-containerregistry/pkg/authn/k8schain"
+	"github.com/google/go-containerregistry/pkg/v1/google"
 	"github.com/sirupsen/logrus"
 )
 
 var (
-	setupKeyChainOnce sync.Once
-	keyChain          authn.Keychain
+	setupKeychainOnce sync.Once
+	keychain          authn.Keychain
 )
 
 // GetKeychain returns a keychain for accessing container registries.
 func GetKeychain() authn.Keychain {
-	setupKeyChainOnce.Do(func() {
-		keyChain = authn.NewMultiKeychain(authn.DefaultKeychain)
+	setupKeychainOnce.Do(func() {
+		keychain = authn.DefaultKeychain
+
+		// Historically kaniko was pre-configured by default with gcr
+		// credential helper, in here we keep the backwards
+		// compatibility by enabling the GCR helper only when gcr.io
+		// (or pkg.dev) is in one of the destinations.
+		gauth, err := google.NewEnvAuthenticator()
+		if err != nil {
+			logrus.Warnf("Failed to setup Google env authenticator, ignoring: %v", err)
+		} else {
+			keychain = authn.NewMultiKeychain(authn.DefaultKeychain, gcrKeychain{gauth})
+		}
 
 		// Add the Kubernetes keychain if we're on Kubernetes
 		if proc.GetContainerRuntime(0, 0) == proc.RuntimeKubernetes {
@@ -43,8 +55,8 @@ func GetKeychain() authn.Keychain {
 				logrus.Warnf("Error setting up k8schain. Using default keychain %s", err)
 				return
 			}
-			keyChain = authn.NewMultiKeychain(keyChain, k8sc)
+			keychain = authn.NewMultiKeychain(keychain, k8sc)
 		}
 	})
-	return keyChain
+	return keychain
 }

pkg/creds/gcr_keychain.go

@@ -0,0 +1,37 @@
+/*
+Copyright 2021 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package creds
+
+import (
+	"strings"
+
+	"github.com/google/go-containerregistry/pkg/authn"
+)
+
+type gcrKeychain struct {
+	authr authn.Authenticator
+}
+
+func (g gcrKeychain) Resolve(r authn.Resource) (authn.Authenticator, error) {
+	if r.RegistryStr() == "gcr.io" ||
+		strings.HasSuffix(r.RegistryStr(), ".gcr.io") ||
+		strings.HasSuffix(r.RegistryStr(), ".pkg.dev") {
+
+		return g.authr, nil
+	}
+	return authn.Anonymous, nil
+}

pkg/executor/push.go

@@ -95,14 +95,6 @@ func CheckPushPermissions(opts *config.KanikoOptions) error {
 		}
 
 		registryName := destRef.Repository.Registry.Name()
-		// Historically kaniko was pre-configured by default with gcr credential helper,
-		// in here we keep the backwards compatibility by enabling the GCR helper only
-		// when gcr.io (or pkg.dev) is in one of the destinations.
-		if registryName == "gcr.io" || strings.HasSuffix(registryName, ".gcr.io") || strings.HasSuffix(registryName, ".pkg.dev") {
-			if err := util.ConfigureGCR(fmt.Sprintf("--registries=%s", registryName)); err != nil {
-				return err
-			}
-		}
 		if opts.Insecure || opts.InsecureRegistries.Contains(registryName) {
 			newReg, err := name.NewRegistry(registryName, name.WeakValidation, name.Insecure)
 			if err != nil {

pkg/util/gcr_util.go

@@ -17,15 +17,8 @@ limitations under the License.
 package util
 
 import (
-	"bytes"
-	"fmt"
 	"os"
-	"os/exec"
 	"path/filepath"
-
-	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
-	"github.com/spf13/afero"
 )
 
 // DockerConfLocation returns the file system location of the Docker
@@ -49,21 +42,3 @@ func DockerConfLocation() string {
 	}
 	return string(os.PathSeparator) + filepath.Join("kaniko", ".docker", configFile)
 }
-
-func ConfigureGCR(flags string) error {
-	// Checking for existence of docker.config as it's normally required for
-	// authenticated registries and prevent overwriting user provided docker conf
-	_, err := afero.NewOsFs().Stat(DockerConfLocation())
-	dockerConfNotExists := os.IsNotExist(err)
-	if dockerConfNotExists {
-		cmd := exec.Command("docker-credential-gcr", "configure-docker", flags)
-		var out bytes.Buffer
-		cmd.Stderr = &out
-		if err := cmd.Run(); err != nil {
-			return errors.Wrap(err, fmt.Sprintf("error while configuring docker-credential-gcr helper: %s : %s", cmd.String(), out.String()))
-		}
-	} else {
-		logrus.Warnf("\nSkip running docker-credential-gcr as user provided docker configuration exists at %s", DockerConfLocation())
-	}
-	return nil
-}