Skip to content

Commit 70052eb

Browse files
crazy-maxcrazy-max
committed
registry-identities: authenticate Azure ACR and Chainguard
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
1 parent 591e8d7 commit 70052eb

5 files changed

Lines changed: 249 additions & 1 deletion

File tree

‎.github/workflows/bake.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -926,6 +926,29 @@ jobs:
926926
registry-auth: |
927927
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
928928
username: ${{ needs.registry-identities.outputs.dockerhub-oidc-username }}
929+
-
930+
name: Authenticate to Azure
931+
if: ${{ needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
932+
uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
933+
with:
934+
client-id: ${{ needs.registry-identities.outputs.azure-acr-client-id }}
935+
tenant-id: ${{ needs.registry-identities.outputs.azure-acr-tenant-id }}
936+
subscription-id: ${{ needs.registry-identities.outputs.azure-acr-subscription-id }}
937+
-
938+
name: Login to Azure Container Registry
939+
if: ${{ needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
940+
env:
941+
ACR_REGISTRY: ${{ needs.registry-identities.outputs.azure-acr-registry }}
942+
AZURE_CORE_OUTPUT: none
943+
run: az acr login --name "${ACR_REGISTRY%.azurecr.io}"
944+
-
945+
name: Set up chainctl
946+
if: ${{ needs.registry-identities.outputs.chainguard-enabled == 'true' }}
947+
uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 # v0.5.1
948+
with:
949+
identity: ${{ needs.registry-identities.outputs.chainguard-identity }}
950+
apk-host: ${{ needs.registry-identities.outputs.chainguard-apk-host }}
951+
libraries-host: ${{ needs.registry-identities.outputs.chainguard-libraries-host }}
929952
-
930953
name: Login to registry
931954
if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
@@ -1178,6 +1201,29 @@ jobs:
11781201
registry-auth: |
11791202
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
11801203
username: ${{ needs.registry-identities.outputs.dockerhub-oidc-username }}
1204+
-
1205+
name: Authenticate to Azure
1206+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
1207+
uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
1208+
with:
1209+
client-id: ${{ needs.registry-identities.outputs.azure-acr-client-id }}
1210+
tenant-id: ${{ needs.registry-identities.outputs.azure-acr-tenant-id }}
1211+
subscription-id: ${{ needs.registry-identities.outputs.azure-acr-subscription-id }}
1212+
-
1213+
name: Login to Azure Container Registry
1214+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
1215+
env:
1216+
ACR_REGISTRY: ${{ needs.registry-identities.outputs.azure-acr-registry }}
1217+
AZURE_CORE_OUTPUT: none
1218+
run: az acr login --name "${ACR_REGISTRY%.azurecr.io}"
1219+
-
1220+
name: Set up chainctl
1221+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.chainguard-enabled == 'true' }}
1222+
uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 # v0.5.1
1223+
with:
1224+
identity: ${{ needs.registry-identities.outputs.chainguard-identity }}
1225+
apk-host: ${{ needs.registry-identities.outputs.chainguard-apk-host }}
1226+
libraries-host: ${{ needs.registry-identities.outputs.chainguard-libraries-host }}
11811227
-
11821228
name: Login to registry
11831229
if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}

‎.github/workflows/build.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -826,6 +826,29 @@ jobs:
826826
registry-auth: |
827827
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
828828
username: ${{ needs.registry-identities.outputs.dockerhub-oidc-username }}
829+
-
830+
name: Authenticate to Azure
831+
if: ${{ needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
832+
uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
833+
with:
834+
client-id: ${{ needs.registry-identities.outputs.azure-acr-client-id }}
835+
tenant-id: ${{ needs.registry-identities.outputs.azure-acr-tenant-id }}
836+
subscription-id: ${{ needs.registry-identities.outputs.azure-acr-subscription-id }}
837+
-
838+
name: Login to Azure Container Registry
839+
if: ${{ needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
840+
env:
841+
ACR_REGISTRY: ${{ needs.registry-identities.outputs.azure-acr-registry }}
842+
AZURE_CORE_OUTPUT: none
843+
run: az acr login --name "${ACR_REGISTRY%.azurecr.io}"
844+
-
845+
name: Set up chainctl
846+
if: ${{ needs.registry-identities.outputs.chainguard-enabled == 'true' }}
847+
uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 # v0.5.1
848+
with:
849+
identity: ${{ needs.registry-identities.outputs.chainguard-identity }}
850+
apk-host: ${{ needs.registry-identities.outputs.chainguard-apk-host }}
851+
libraries-host: ${{ needs.registry-identities.outputs.chainguard-libraries-host }}
829852
-
830853
name: Login to registry
831854
if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
@@ -1074,6 +1097,29 @@ jobs:
10741097
registry-auth: |
10751098
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
10761099
username: ${{ needs.registry-identities.outputs.dockerhub-oidc-username }}
1100+
-
1101+
name: Authenticate to Azure
1102+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
1103+
uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
1104+
with:
1105+
client-id: ${{ needs.registry-identities.outputs.azure-acr-client-id }}
1106+
tenant-id: ${{ needs.registry-identities.outputs.azure-acr-tenant-id }}
1107+
subscription-id: ${{ needs.registry-identities.outputs.azure-acr-subscription-id }}
1108+
-
1109+
name: Login to Azure Container Registry
1110+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
1111+
env:
1112+
ACR_REGISTRY: ${{ needs.registry-identities.outputs.azure-acr-registry }}
1113+
AZURE_CORE_OUTPUT: none
1114+
run: az acr login --name "${ACR_REGISTRY%.azurecr.io}"
1115+
-
1116+
name: Set up chainctl
1117+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.chainguard-enabled == 'true' }}
1118+
uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 # v0.5.1
1119+
with:
1120+
identity: ${{ needs.registry-identities.outputs.chainguard-identity }}
1121+
apk-host: ${{ needs.registry-identities.outputs.chainguard-apk-host }}
1122+
libraries-host: ${{ needs.registry-identities.outputs.chainguard-libraries-host }}
10771123
-
10781124
name: Login to registry
10791125
if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}

‎.github/workflows/setup-registry-identities.yml‎

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,33 @@ on:
5252
dockerhub-oidc-connection-id:
5353
description: "Docker Hub OIDC connection ID"
5454
value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-connection-id }}
55+
azure-acr-enabled:
56+
description: "Whether an Azure ACR registry identity was configured"
57+
value: ${{ jobs.setup-registry-identities.outputs.azure-acr-enabled }}
58+
azure-acr-registry:
59+
description: "Azure Container Registry host"
60+
value: ${{ jobs.setup-registry-identities.outputs.azure-acr-registry }}
61+
azure-acr-client-id:
62+
description: "Azure federated identity client ID"
63+
value: ${{ jobs.setup-registry-identities.outputs.azure-acr-client-id }}
64+
azure-acr-tenant-id:
65+
description: "Azure tenant ID"
66+
value: ${{ jobs.setup-registry-identities.outputs.azure-acr-tenant-id }}
67+
azure-acr-subscription-id:
68+
description: "Azure subscription ID"
69+
value: ${{ jobs.setup-registry-identities.outputs.azure-acr-subscription-id }}
70+
chainguard-enabled:
71+
description: "Whether a Chainguard registry identity was configured"
72+
value: ${{ jobs.setup-registry-identities.outputs.chainguard-enabled }}
73+
chainguard-identity:
74+
description: "Chainguard identity to assume"
75+
value: ${{ jobs.setup-registry-identities.outputs.chainguard-identity }}
76+
chainguard-apk-host:
77+
description: "Chainguard APK host"
78+
value: ${{ jobs.setup-registry-identities.outputs.chainguard-apk-host }}
79+
chainguard-libraries-host:
80+
description: "Chainguard Libraries host"
81+
value: ${{ jobs.setup-registry-identities.outputs.chainguard-libraries-host }}
5582

5683
env:
5784
RUNTIME_MODULE: "@docker/github-builder-runtime@0.102.0"
@@ -83,6 +110,15 @@ jobs:
83110
dockerhub-oidc-registry: ${{ steps.validate.outputs.dockerhub-oidc-registry }}
84111
dockerhub-oidc-username: ${{ steps.validate.outputs.dockerhub-oidc-username }}
85112
dockerhub-oidc-connection-id: ${{ steps.validate.outputs.dockerhub-oidc-connection-id }}
113+
azure-acr-enabled: ${{ steps.validate.outputs.azure-acr-enabled }}
114+
azure-acr-registry: ${{ steps.validate.outputs.azure-acr-registry }}
115+
azure-acr-client-id: ${{ steps.validate.outputs.azure-acr-client-id }}
116+
azure-acr-tenant-id: ${{ steps.validate.outputs.azure-acr-tenant-id }}
117+
azure-acr-subscription-id: ${{ steps.validate.outputs.azure-acr-subscription-id }}
118+
chainguard-enabled: ${{ steps.validate.outputs.chainguard-enabled }}
119+
chainguard-identity: ${{ steps.validate.outputs.chainguard-identity }}
120+
chainguard-apk-host: ${{ steps.validate.outputs.chainguard-apk-host }}
121+
chainguard-libraries-host: ${{ steps.validate.outputs.chainguard-libraries-host }}
86122
steps:
87123
-
88124
name: Install dependencies
@@ -145,6 +181,15 @@ jobs:
145181
core.setOutput('dockerhub-oidc-registry', '');
146182
core.setOutput('dockerhub-oidc-username', '');
147183
core.setOutput('dockerhub-oidc-connection-id', '');
184+
core.setOutput('azure-acr-enabled', 'false');
185+
core.setOutput('azure-acr-registry', '');
186+
core.setOutput('azure-acr-client-id', '');
187+
core.setOutput('azure-acr-tenant-id', '');
188+
core.setOutput('azure-acr-subscription-id', '');
189+
core.setOutput('chainguard-enabled', 'false');
190+
core.setOutput('chainguard-identity', '');
191+
core.setOutput('chainguard-apk-host', '');
192+
core.setOutput('chainguard-libraries-host', '');
148193
};
149194
150195
const registryLogin = core.getBooleanInput('registry-login');
@@ -164,7 +209,7 @@ jobs:
164209
const { RegistryIdentities } = require('@docker/github-builder-runtime/lib/github-builder/registry-identities');
165210
166211
try {
167-
const { awsEcr, gcpWif, dockerhubOidc } = RegistryIdentities.parse(registryIdentities);
212+
const { awsEcr, gcpWif, dockerhubOidc, azureAcr, chainguard } = RegistryIdentities.parse(registryIdentities);
168213
if (awsEcr) {
169214
core.info(`Configured aws-ecr registry identity for ${awsEcr.registry}`);
170215
}
@@ -174,6 +219,12 @@ jobs:
174219
if (dockerhubOidc) {
175220
core.info(`Configured dockerhub registry identity for ${dockerhubOidc.registry}`);
176221
}
222+
if (azureAcr) {
223+
core.info(`Configured azure-acr registry identity for ${azureAcr.registry}`);
224+
}
225+
if (chainguard) {
226+
core.info(`Configured chainguard registry identity ${chainguard.identity}`);
227+
}
177228
178229
core.setOutput('aws-ecr-enabled', awsEcr ? 'true' : 'false');
179230
core.setOutput('aws-ecr-registry', awsEcr?.registry || '');
@@ -188,6 +239,15 @@ jobs:
188239
core.setOutput('dockerhub-oidc-registry', dockerhubOidc?.registry || '');
189240
core.setOutput('dockerhub-oidc-username', dockerhubOidc?.username || '');
190241
core.setOutput('dockerhub-oidc-connection-id', dockerhubOidc?.connectionID || '');
242+
core.setOutput('azure-acr-enabled', azureAcr ? 'true' : 'false');
243+
core.setOutput('azure-acr-registry', azureAcr?.registry || '');
244+
core.setOutput('azure-acr-client-id', azureAcr?.clientId || '');
245+
core.setOutput('azure-acr-tenant-id', azureAcr?.tenantId || '');
246+
core.setOutput('azure-acr-subscription-id', azureAcr?.subscriptionId || '');
247+
core.setOutput('chainguard-enabled', chainguard ? 'true' : 'false');
248+
core.setOutput('chainguard-identity', chainguard?.identity || '');
249+
core.setOutput('chainguard-apk-host', chainguard?.apkHost || '');
250+
core.setOutput('chainguard-libraries-host', chainguard?.librariesHost || '');
191251
} catch (error) {
192252
core.setFailed(error.message || error);
193253
}

‎.github/workflows/verify.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,29 @@ jobs:
161161
registry-auth: |
162162
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
163163
username: ${{ needs.registry-identities.outputs.dockerhub-oidc-username }}
164+
-
165+
name: Authenticate to Azure
166+
if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
167+
uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
168+
with:
169+
client-id: ${{ needs.registry-identities.outputs.azure-acr-client-id }}
170+
tenant-id: ${{ needs.registry-identities.outputs.azure-acr-tenant-id }}
171+
subscription-id: ${{ needs.registry-identities.outputs.azure-acr-subscription-id }}
172+
-
173+
name: Login to Azure Container Registry
174+
if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
175+
env:
176+
ACR_REGISTRY: ${{ needs.registry-identities.outputs.azure-acr-registry }}
177+
AZURE_CORE_OUTPUT: none
178+
run: az acr login --name "${ACR_REGISTRY%.azurecr.io}"
179+
-
180+
name: Set up chainctl
181+
if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'image' && needs.registry-identities.outputs.chainguard-enabled == 'true' }}
182+
uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 # v0.5.1
183+
with:
184+
identity: ${{ needs.registry-identities.outputs.chainguard-identity }}
185+
apk-host: ${{ needs.registry-identities.outputs.chainguard-apk-host }}
186+
libraries-host: ${{ needs.registry-identities.outputs.chainguard-libraries-host }}
164187
-
165188
name: Login to registry
166189
if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}

‎README.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ ___
2323
* [Docker Hub OIDC](#docker-hub-oidc)
2424
* [AWS ECR](#aws-ecr)
2525
* [Google Artifact Registry](#google-artifact-registry)
26+
* [Azure Container Registry](#azure-container-registry)
27+
* [Chainguard](#chainguard)
2628
* [Runner mapping](#runner-mapping)
2729
* [Metadata templates](#metadata-templates)
2830

@@ -567,6 +569,77 @@ the full repository path. The workflow requests an access token from
567569
`google-github-actions/auth` and passes it directly to `docker/login-action`
568570
with the `oauth2accesstoken` username inside the same job.
569571

572+
#### Azure Container Registry
573+
574+
Azure Container Registry authentication is configured with `type: azure-acr`.
575+
Grant `id-token: write` and configure a federated credential for the GitHub
576+
workflow on the Azure identity. The identity also needs permission to pull or
577+
push images in the registry:
578+
579+
```yaml
580+
jobs:
581+
build:
582+
uses: docker/github-builder/.github/workflows/build.yml@v1
583+
permissions:
584+
contents: read
585+
id-token: write
586+
with:
587+
output: image
588+
push: true
589+
meta-images: myregistry.azurecr.io/my-image
590+
registry-identities: |
591+
- type: azure-acr
592+
registry: myregistry.azurecr.io
593+
client_id: 00000000-0000-0000-0000-000000000000
594+
tenant_id: 00000000-0000-0000-0000-000000000000
595+
subscription_id: 00000000-0000-0000-0000-000000000000
596+
```
597+
598+
| Name | Type | Required | Description |
599+
|-------------------|--------|----------|----------------------------------------------------|
600+
| `type` | String | Yes | Must be `azure-acr`. |
601+
| `registry` | String | Yes | ACR login server, such as `myregistry.azurecr.io`. |
602+
| `client_id` | String | Yes | Federated identity client ID. |
603+
| `tenant_id` | String | Yes | Azure tenant ID. |
604+
| `subscription_id` | String | Yes | Azure subscription ID. |
605+
606+
The `registry` value must be an ACR login server ending in `.azurecr.io`; the
607+
workflow removes that suffix to obtain the name for `az acr login`. It logs in
608+
with `azure/login` first, inside each job that needs the registry. No client
609+
secret crosses the reusable workflow boundary.
610+
611+
#### Chainguard
612+
613+
Chainguard authentication is configured with `type: chainguard`. Grant
614+
`id-token: write` and configure the identity to trust the GitHub workflow:
615+
616+
```yaml
617+
jobs:
618+
bake:
619+
uses: docker/github-builder/.github/workflows/bake.yml@v1
620+
permissions:
621+
contents: read
622+
id-token: write
623+
with:
624+
output: image
625+
push: true
626+
meta-images: cgr.dev/my-organization/my-image
627+
registry-identities: |
628+
- type: chainguard
629+
identity: my-organization/my-identity
630+
```
631+
632+
| Name | Type | Required | Description |
633+
|------------------|--------|----------|--------------------------------------------------|
634+
| `type` | String | Yes | Must be `chainguard`. |
635+
| `identity` | String | Yes | Chainguard identity to assume. |
636+
| `apk_host` | String | No | APK host. Defaults to `apk.cgr.dev`. |
637+
| `libraries_host` | String | No | Libraries host. Defaults to `libraries.cgr.dev`. |
638+
639+
The workflow runs `chainguard-dev/setup-chainctl` inside each job that needs
640+
registry access. The identity must be authorized for the configured APK and
641+
Libraries hosts as well as the target registry.
642+
570643
### Runner mapping
571644

572645
The `runner` input accepts either a single GitHub-hosted Linux runner label or a

0 commit comments

Comments
 (0)