init: initial commit

main/configs/k3s/credentialprovider.yaml

@@ -0,0 +1,10 @@
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: CredentialProviderConfig
+providers:
+  - name: yc-credential-provider
+    apiVersion: credentialprovider.kubelet.k8s.io/v1
+    matchImages:
+      - "cr.yandex"
+      - "cr.cloud.yandex.net"
+      - "container-registry.cloud.yandex.net"
+    defaultCacheDuration: "1h"

main/configs/k3s/yc-credential-provider

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+command -v jq >/dev/null || { echo "jq required" >&2; exit 1; }
+command -v yc >/dev/null || { echo "yc required" >&2; exit 1; }
+
+req=$(cat)
+image=$(printf '%s' "$req" | jq -r '.image // empty')
+
+if [[ -z "$image" ]]; then
+  echo "no image in request" >&2
+  exit 1
+fi
+
+registry=${image%%/*}
+if [[ -z "$registry" ]]; then
+  registry="$image"
+fi
+
+creds_json=$(printf '%s' "$image" | yc container docker-credential get 2>/dev/null) || {
+  echo "yc docker-credential failed" >&2
+  exit 1
+}
+
+username=$(printf '%s' "$creds_json" | jq -r '.Username // empty')
+secret=$(printf '%s' "$creds_json" | jq -r '.Secret // empty')
+
+if [[ -z "$username" || -z "$secret" ]]; then
+  echo "failed to parse yc output" >&2
+  exit 1
+fi
+
+jq -n \
+  --arg api "credentialprovider.kubelet.k8s.io/v1" \
+  --arg kind "CredentialProviderResponse" \
+  --arg reg "$registry" \
+  --arg user "$username" \
+  --arg pass "$secret" \
+  --arg cache "6h" \
+  --arg keyType "Registry" \
+'{
+  apiVersion: $api,
+  kind: $kind,
+  auth: { ($reg): { username: $user, password: $pass } },
+  cacheDuration: $cache,
+  cacheKeyType: $keyType
+}'