feat: inline auth

[mattwelke]

Issue

Resolves #285.

Description

Adds support for inline auth. The order of precedence is:

1. Implicit (workload identity)
2. Explicit - k8s secret
3. Explicit - inline

Example using the new auth style:

apiVersion: validation.spectrocloud.labs/v1alpha1
kind: AzureValidator
metadata:
  name: azurevalidator-communitygalleryimages-one-image-inline-auth
spec:
  auth:
    implicit: false
    credentials:
      tenantId: "<uuid>"
      clientId: "<uuid>"
      clientSecret: "abc123"
      environment: "AzureUSGovernment"
  communityGalleryImageRules:
  - name: rule-1
    gallery:
      location: westus
      name: AKSUbuntu-38d80f77-467a-481f-a8d4-09b6d4220bd2
    images:
    - 1804gen2gpucontainerd
    subscriptionID: 9b16dd0b-1bea-4c9a-a291-65e6f44c4745

[TylerGillson]

What about the Azure environment? Can't remember how that's being handled tbh.

[mattwelke]

What about the Azure environment? Can't remember how that's being handled tbh.

@TylerGillson Good point. I looked at how it was done before and I don't think it was done well. It only allowed the Azure environment to be specified in the Helm config. That meant that users could only specify it if they were using k8s to evaluate the rules. If they were using direct rule evaluation, they'd be stuck only being able to connect to the public Azure cloud.

I reworked it. Now, the environment to connect to is part of the credentials part of the auth config just like the three main env vars are. It works the same way as them, where if the user specifies them using a k8s secret or inline in the CRD, the env var that the Azure SDK needs gets set.

While reworking it, I changed the order of precedence. Now, k8s secret takes priority over inline config. This made validation code for the values simpler, and it matches the way the other plugins work too, where the secret is used first.

[TylerGillson]

Nice! You manually verified running the controller in k8s as well as running validatorctl in direct mode?

[mattwelke]

Nice! You manually verified running the controller in k8s as well as running validatorctl in direct mode?

Tested manually in k8s. Did not test in direct mode yet. I'll test that using a replace in validatorctl before merging this.

[mattwelke]

Confirmed working with direct execution. Used the example in the PR desc with real Azure creds.

validatorctl rules check --custom-resources ./crs

Reading plugin specs from file: crs/azure-validator.yaml

                                                                                                                                                                                                                                                                 
                                                                                                                  Executing validator plugin(s)                                                                                                                  
                                                                                                                                                                                                                                                                 


=================
Validation Result
=================

Plugin:           Azure
Name:             validator-plugin-azure-azure-validator
Namespace:        N/A
State:            Succeeded

------------
Rule Results
------------

Validation Rule:        validation-rule-1
Validation Type:        azure-community-gallery-image
Status:                 True
Last Validated:         2024-11-05T12:18:28-05:00
Message:                All required images present in community gallery.

-------
Details
-------
- Found image; Name: '1804gen2gpucontainerd'

[codecov]

Codecov Report

Attention: Patch coverage is 77.04918% with 14 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/controller/azurevalidator_controller.go	75.86%	9 Missing and 5 partials ⚠️

@@            Coverage Diff             @@
##             main     #288      +/-   ##
==========================================
+ Coverage   60.95%   61.23%   +0.28%     
==========================================
  Files          11       12       +1     
  Lines         945      988      +43     
==========================================
+ Hits          576      605      +29     
- Misses        348      358      +10     
- Partials       21       25       +4     

Files with missing lines	Coverage Δ
api/v1alpha1/azurevalidator_types.go	75.00% <ø> (ø)
pkg/utils/strings/strings.go	100.00% <100.00%> (ø)
internal/controller/azurevalidator_controller.go	67.59% <75.86%> (-1.53%)	⬇️

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d00fe26...da99247. Read the comment docs.