configure gcp-auth addon pull secret to work with all GCR and AR mirrors

go.mod

@@ -6,6 +6,7 @@ require (
 	cloud.google.com/go/storage v1.15.0
 	contrib.go.opencensus.io/exporter/stackdriver v0.12.1
 	github.com/Delta456/box-cli-maker/v2 v2.2.1
+	github.com/GoogleCloudPlatform/docker-credential-gcr v0.0.0-20210713212222-faed5e8b8ca2
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v0.16.0
 	github.com/Microsoft/hcsshim v0.8.17 // indirect
 	github.com/Parallels/docker-machine-parallels/v2 v2.0.1

go.sum

@@ -70,6 +70,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Delta456/box-cli-maker/v2 v2.2.1 h1:uTcuvT6Ty+LBHuRUdFrJBpqP9RhtLxI5+5ZpKYAUuVw=
 github.com/Delta456/box-cli-maker/v2 v2.2.1/go.mod h1:R7jxZHK2wGBR2Luz/Vgi8jP5fz1ljUXgu2o2JQNmvFU=
+github.com/GoogleCloudPlatform/docker-credential-gcr v0.0.0-20210713212222-faed5e8b8ca2 h1:rMamBsR6iCT9Y5m2Il6vFGJvY7FAgck4AoA/LobheKU=
+github.com/GoogleCloudPlatform/docker-credential-gcr v0.0.0-20210713212222-faed5e8b8ca2/go.mod h1:BB1eHdMLYEFuFdBlRMb0N7YGVdM5s6Pt0njxgvfbGGs=
 github.com/GoogleCloudPlatform/k8s-cloud-provider v0.0.0-20200415212048-7901bc822317/go.mod h1:DF8FZRxMHMGv/vP2lQP6h+dYzzjpuRn24VeRiYn3qjQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v0.16.0 h1:ljU7eS7Fe0eGWEJxhoIjGANPEhx2f5PKTbDjvT61Kwk=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v0.16.0/go.mod h1:TLDTgf8D4fD8Y1DizdJKtfIjkHJZU1J+mieFB1qS5T8=

pkg/addons/addons_gcpauth.go

@@ -23,8 +23,10 @@ import (
 	"os"
 	"os/exec"
 	"strconv"
+	"strings"
 	"time"
 
+	gcr_config "github.com/GoogleCloudPlatform/docker-credential-gcr/config"
 	"github.com/pkg/errors"
 	"golang.org/x/oauth2/google"
 	corev1 "k8s.io/api/core/v1"
@@ -131,8 +133,16 @@ func createPullSecret(cc *config.ClusterConfig, creds *google.Credentials) error
 	token, err := creds.TokenSource.Token()
 	// Only try to add secret if Token was found
 	if err == nil {
+		dockercfg := ""
+		registries := append(gcr_config.DefaultGCRRegistries[:], gcr_config.DefaultARRegistries[:]...)
+		for _, reg := range registries {
+			dockercfg += fmt.Sprintf(`"https://%s":{"username":"oauth2accesstoken","password":"%s","email":"none"},`, reg, token.AccessToken)
+		}
+
+		dockercfg = strings.TrimSuffix(dockercfg, ",")
+
 		data := map[string][]byte{
-			".dockercfg": []byte(fmt.Sprintf(`{"https://gcr.io":{"username":"oauth2accesstoken","password":"%s","email":"none"}, "https://us-docker.pkg.dev":{"username":"oauth2accesstoken","password":"%s","email":"none"}}`, token.AccessToken, token.AccessToken)),
+			".dockercfg": []byte(fmt.Sprintf(`{%s}`, dockercfg)),
 		}
 
 		for _, n := range namespaces.Items {

test/integration/addons_test.go

@@ -700,7 +700,20 @@ func validateGCPAuthAddon(ctx context.Context, t *testing.T, profile string) {
 
 		// Make sure the pod is up and running, which means we successfully pulled the private image down
 		// 8 minutes, because 4 is not enough for images to pull in all cases.
-		_, err := PodWait(ctx, t, profile, "default", "integration-test=private-image", Minutes(8))
+		_, err = PodWait(ctx, t, profile, "default", "integration-test=private-image", Minutes(8))
+		if err != nil {
+			t.Fatalf("wait for private image: %v", err)
+		}
+
+		// Try it with a European mirror as well
+		_, err = Run(t, exec.CommandContext(ctx, "kubectl", "--context", profile, "apply", "-f", filepath.Join(*testdataDir, "private-image-eu.yaml")))
+		if err != nil {
+			t.Fatalf("print env project: %v", err)
+		}
+
+		// Make sure the pod is up and running, which means we successfully pulled the private image down
+		// 8 minutes, because 4 is not enough for images to pull in all cases.
+		_, err = PodWait(ctx, t, profile, "default", "integration-test=private-image-eu", Minutes(8))
 		if err != nil {
 			t.Fatalf("wait for private image: %v", err)
 		}

test/integration/testdata/private-image-eu.yaml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: private-image-eu
+  labels:
+    integration-test: private-image-eu
+spec:
+  selector:
+    matchLabels:
+      integration-test: private-image-eu
+  template:
+    metadata:
+      labels:
+        integration-test: private-image-eu
+    spec:
+      containers:
+      - image: europe-west1-docker.pkg.dev/k8s-minikube/test-artifacts-eu/echoserver:1.4
+        imagePullPolicy: IfNotPresent
+        name: private-image-eu