OCPNODE-3753: CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication #1861

QiWang19 · 2025-10-13T13:54:56Z

Propose a new CRIOCredentialProviderConfig CRD that enables use namespace-scoped secrets for mirror registry authentication.

openshift-ci · 2025-10-13T13:55:00Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

QiWang19 · 2025-10-13T13:55:45Z

/test all

saschagrunert

Great write-up, it nicely summarizes the whole effort!

...ments/api-review/imagecredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

...ments/api-review/imagecredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

...ments/api-review/imagecredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

QiWang19 · 2025-10-14T23:12:54Z

@saschagrunert PTAL

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

saschagrunert

Overall LGTM 👍

openshift-ci · 2025-10-15T09:17:59Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: saschagrunert
Once this PR has been reviewed and has the lgtm label, please assign dhellmann for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

saschagrunert · 2025-10-15T09:28:26Z

/lgtm

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

…ication Signed-off-by: Qi Wang <[email protected]>

openshift-ci-robot · 2025-10-15T19:47:58Z

@QiWang19: This pull request references OCPNODE-3753 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

In response to this:

Propose a new CRIOCredentialProviderConfig CRD that enables use namespace-scoped secrets for mirror registry authentication.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-10-15T20:21:43Z

@QiWang19: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

saschagrunert · 2025-10-16T07:59:12Z

/lgtm

lyman9966 · 2025-10-17T08:51:52Z

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

+  name: system:serviceaccount:app-team-alpha:app-service-account
+```
+
+3. Cluster Admin configures cluster-wide `CRIOCredentialProviderConfig` object specifying source registries that should trigger `crio-credential-provider`


Suggested change

3. Cluster Admin configures cluster-wide `CRIOCredentialProviderConfig` object specifying source registries that should trigger `crio-credential-provider`

4. Cluster Admin configures cluster-wide `CRIOCredentialProviderConfig` object specifying source registries that should trigger `crio-credential-provider`

lyman9966 · 2025-10-17T08:52:41Z

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

+
+2. Machine Config Operator container runtime config controller
+
+    - Extend the container runtime config controller to manage the `CRIOCredentialProviderConfig` objects


Suggested change

- Extend the container runtime config controller to manage the `CRIOCredentialProviderConfig` objects

- Extends the container runtime config controller to manage the `CRIOCredentialProviderConfig` objects

lyman9966 · 2025-10-17T09:03:59Z

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

+
+ - resolves mirrors from `/etc/containers/registries.conf` for source image repository(docker.io/nginx)
+
+ - Finds mirror pull secrets in Pod namespace (team-alpha-mirror-secret) by using the service account token from the request


Suggested change

- Finds mirror pull secrets in Pod namespace (team-alpha-mirror-secret) by using the service account token from the request

- Finds mirror pull secrets in Pod namespace (app-team-alpha-mirror-secret) by using the service account token from the request

lyman9966 · 2025-10-17T09:48:28Z

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

+
+4. CRI-O image pull:
+
+  - Detects the file `/etc/crio/auth/<NAMESPACE>-<IMAGE_NAME_SHA256>.json` exists, uses the auth file for image pull authentication


In previous 'Component Changes & Interactions' part, it describes:
If the auth file generated by crio-credential-provider exists, moves the auth file from /etc/crio/auth/<NAMESPACE>-<IMAGE_NAME_SHA256>.json to a unique temporary location (/etc/crio/auth/in-use/<NAMESPACE>-<IMAGE_NAME_SHA256>-<UUID>.json) for each image pull

So it's better to add the part of moving auth file to a unique temporary directory

lyman9966 · 2025-10-17T09:54:07Z

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

+    apiVersion: credentialprovider.kubelet.k8s.io/v1
+```
+
+##### Step 2: Application Deployment


I'm not sure if this enhancement have strict formatting requirements. It seems the font and color of titles at each level are not consistent. It's better to standardize.

I think it's just a problem of github, not the content.

bitoku · 2025-10-22T14:32:04Z

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md

+
+ - Generates a short-lived authentication file for each image pull at `/etc/crio/auth/<NAMESPACE>-<IMAGE_NAME_SHA256>.json`, which includes mirror credentials, source registry credentials, and any global pull secrets.
+
+ - Returns empty `CredentialProviderResponse` to kubelet


What was the reason why we return empty credential instead of returning the token in the response?

I think we discussed it somewhere, but I forgot where it was.

The kubelet will ignore the credentials within the response if it does not match the original image (without tag or digest). Means the we cannot pass the credentials there.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 13, 2025

QiWang19 changed the title ~~ImageCredentialProviderConfig API for Namespace-Scoped Mirror Authent…~~ ImageCredentialProviderConfig for Namespace-Scoped Mirror Authentication Oct 13, 2025

saschagrunert reviewed Oct 14, 2025

View reviewed changes

QiWang19 force-pushed the crio-credential-config branch from 060f30d to 7d1b2f9 Compare October 14, 2025 23:04

QiWang19 marked this pull request as ready for review October 14, 2025 23:12

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 14, 2025

openshift-ci bot requested review from bear-redhat and dhellmann October 14, 2025 23:12

lyman9966 reviewed Oct 15, 2025

View reviewed changes

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md Outdated Show resolved Hide resolved

saschagrunert approved these changes Oct 15, 2025

View reviewed changes

openshift-ci bot assigned saschagrunert Oct 15, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 15, 2025

bitoku mentioned this pull request Oct 15, 2025

[release-1.34] Backport credential provider support cri-o/cri-o#9512

Open

bitoku reviewed Oct 15, 2025

View reviewed changes

...ements/api-review/criocredentialproviderconfig-for-namespace-scoped-mirror-authentication.md Show resolved Hide resolved

QiWang19 changed the title ~~ImageCredentialProviderConfig for Namespace-Scoped Mirror Authentication~~ CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication Oct 15, 2025

ImageCredentialProviderConfig API for Namespace-Scoped Mirror Authent…

14465a6

…ication Signed-off-by: Qi Wang <[email protected]>

QiWang19 force-pushed the crio-credential-config branch from 7d1b2f9 to 14465a6 Compare October 15, 2025 19:02

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 15, 2025

QiWang19 changed the title ~~CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication~~ OCPNODE-3753: CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication Oct 15, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 15, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 16, 2025

lyman9966 reviewed Oct 17, 2025

View reviewed changes

bitoku reviewed Oct 22, 2025

View reviewed changes

	3. Cluster Admin configures cluster-wide `CRIOCredentialProviderConfig` object specifying source registries that should trigger `crio-credential-provider`
	4. Cluster Admin configures cluster-wide `CRIOCredentialProviderConfig` object specifying source registries that should trigger `crio-credential-provider`


		2. Machine Config Operator container runtime config controller

		- Extend the container runtime config controller to manage the `CRIOCredentialProviderConfig` objects

	- Extend the container runtime config controller to manage the `CRIOCredentialProviderConfig` objects
	- Extends the container runtime config controller to manage the `CRIOCredentialProviderConfig` objects


		- resolves mirrors from `/etc/containers/registries.conf` for source image repository(docker.io/nginx)

		- Finds mirror pull secrets in Pod namespace (team-alpha-mirror-secret) by using the service account token from the request


		4. CRI-O image pull:

		- Detects the file `/etc/crio/auth/<NAMESPACE>-<IMAGE_NAME_SHA256>.json` exists, uses the auth file for image pull authentication


		- Generates a short-lived authentication file for each image pull at `/etc/crio/auth/<NAMESPACE>-<IMAGE_NAME_SHA256>.json`, which includes mirror credentials, source registry credentials, and any global pull secrets.

		- Returns empty `CredentialProviderResponse` to kubelet

OCPNODE-3753: CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication #1861

Are you sure you want to change the base?

OCPNODE-3753: CRIOCredentialProviderConfig for Namespace-Scoped Mirror Authentication #1861

Conversation

QiWang19 commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Oct 13, 2025

Uh oh!

QiWang19 commented Oct 13, 2025

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

QiWang19 commented Oct 14, 2025

Uh oh!

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Oct 15, 2025

Uh oh!

saschagrunert commented Oct 15, 2025

Uh oh!

Uh oh!

openshift-ci-robot commented Oct 15, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Oct 15, 2025

Uh oh!

saschagrunert commented Oct 16, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

QiWang19 commented Oct 13, 2025 •

edited

Loading

openshift-ci-robot commented Oct 15, 2025 •

edited by openshift-ci bot

Loading