feat(misconf): enabled China configuration for ACRs (#7156)

aquasecurity · Jul 16, 2024 · d1ec89d · d1ec89d
1 parent 2a577a7
commit d1ec89d
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 9 deletions.
diff --git a/pkg/fanal/image/registry/azure/azure.go b/pkg/fanal/image/registry/azure/azure.go
@@ -8,6 8,8 @@ import (
  "strings"
 
  "github.com/Azure/azure-sdk-for-go/profiles/preview/preview/containerregistry/runtime/containerregistry"
  "github.com/Azure/azure-sdk-for-go/sdk/azcore"
  "github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
  "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
  "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
  "golang.org/x/xerrors"
@@ -17,28 19,41 @@ import (
 
 type Registry struct {
  domain string
  scope string
  cloud cloud.Configuration
 }
 
 const (
- azureURL = ".azurecr.io"
- scope = "https://management.azure.com/.default"
- scheme = "https"
  azureURL = ".azurecr.io"
  chinaAzureURL = ".azurecr.cn"
  scope = "https://management.azure.com/.default"
  chinaScope = "https://management.chinacloudapi.cn/.default"
  scheme = "https"
 )
 
 func (r *Registry) CheckOptions(domain string, _ types.RegistryOptions) error {
- if !strings.HasSuffix(domain, azureURL) {
- return xerrors.Errorf("Azure registry: %w", types.InvalidURLPattern)
  if strings.HasSuffix(domain, azureURL) {
  r.domain = domain
  r.scope = scope
  r.cloud = cloud.AzurePublic
  return nil
  } else if strings.HasSuffix(domain, chinaAzureURL) {
  r.domain = domain
  r.scope = chinaScope
  r.cloud = cloud.AzureChina
  return nil
  }
- r.domain = domain
- return nil
 
  return xerrors.Errorf("Azure registry: %w", types.InvalidURLPattern)
 }
 
 func (r *Registry) GetCredential(ctx context.Context) (string, string, error) {
- cred, err := azidentity.NewDefaultAzureCredential(nil)
  opts := azcore.ClientOptions{Cloud: r.cloud}
  cred, err := azidentity.NewDefaultAzureCredential(&azidentity.DefaultAzureCredentialOptions{ClientOptions: opts})
  if err != nil {
  return "", "", xerrors.Errorf("unable to generate acr credential error: %w", err)
  }
- aadToken, err := cred.GetToken(ctx, policy.TokenRequestOptions{Scopes: []string{scope}})
  aadToken, err := cred.GetToken(ctx, policy.TokenRequestOptions{Scopes: []string{r.scope}})
  if err != nil {
  return "", "", xerrors.Errorf("unable to get an access token: %w", err)
  }

diff --git a/pkg/fanal/image/registry/azure/azure_test.go b/pkg/fanal/image/registry/azure/azure_test.go
@@ -20,6 20,10 @@ func TestRegistry_CheckOptions(t *testing.T) {
  name: "happy path",
  domain: "test.azurecr.io",
  },
  {
  name: "china happy path",
  domain: "test.azurecr.cn",
  },
  {
  name: "invalidURL",
  domain: "not-azurecr.io",