matchImages is a list of string patterns used to determine whether
the CRI-O credential provider should be invoked for a given image. This list is
passed to the kubelet CredentialProviderConfig, and if any pattern matches
the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling
that image or its mirrors.
Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider.
Conflicts between the existing platform specific provider image match configuration and this list will be handled by
the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those
from the CRIOCredentialProviderConfig when both match the same image.
To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with
existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml).
You can check the resource’s Status conditions
to see if any entries were ignored due to exact matches with known built-in provider patterns.
This field is optional, the items of the list must contain between 1 and 50 entries.
The list is treated as a set, so duplicate entries are not allowed.
For more details, see:
https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/
https://github.com/cri-o/crio-credential-provider#architecture
Each entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters.
Wildcards ('') are supported for full subdomain labels, such as '.k8s.io' or 'k8s..io',
and for top-level domains, such as 'k8s.' (which matches 'k8s.io' or 'k8s.net').
A global wildcard '' (matching any domain) is not allowed.
Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path.
For example, 'example..com' is valid, but 'exa*mple..com' is not.
Each wildcard matches only a single domain label,
so '.io' does not match '.k8s.io'.
A match exists between an image and a matchImage when all of the below are true:
Both contain the same number of domain parts and each part matches.
The URL path of an matchImages must be a prefix of the target image URL path.
If the matchImages contains a port, then the port must match in the image as well.
Example values of matchImages:
- 123456789.dkr.ecr.us-east-1.amazonaws.com
- *.azurecr.io
- gcr.io
- *..registry.io
- registry.io:8080/path |
