✨ Add support for GCR service account keys

and custom delimiters for registry auth strings

README.md

@@ -25,8 +25,9 @@ for this to work it requires inserting a root CA certificate into system trusted
   - `hostname`s listed here should be listed in the REGISTRIES environment as well, so they can be intercepted.
   - For Docker Hub authentication, `hostname` should be `auth.docker.io`, username should NOT be an email, use the regular username.
   - For regular registry auth (HTTP Basic), `hostname` here should be the same... unless your registry uses a different auth server. This should work for quay.io also, but I have no way to test.
-  - For Google Container Registry (GCR), username should be `_json_key` and the password should be the contents of the service account JSON. Check out [GCR docs](https://cloud.google.com/container-registry/docs/advanced-authentication#json_key_file)
+  - Env `AUTH_REGISTRIES_DELIMITER` to change the separator between authentication info. By default, a space: "` `". If you use keys that contain spaces (as with Google Cloud Registry), you should update this variable, e.g. setting it to `AUTH_REGISTRIES_DELIMITER=";;;"`. In that case, `AUTH_REGISTRIES` could contain something like `registry1.com:user1:pass1;;;registry2.com:user2:pass2`.
-  
+  - Env `AUTH_REGISTRY_DELIMITER` to change the separator between authentication info *parts*. By default, a colon: "`:`". If you use keys that contain single colons, you should update this variable, e.g. setting it to `AUTH_REGISTRIES_DELIMITER=":::"`. In that case, `AUTH_REGISTRIES` could contain something like `registry1.com:::user1:::pass1 registry2.com:::user2:::pass2`.
+  - For Google Container Registry (GCR), username should be `_json_key` and the password should be the contents of the service account JSON. Check out [GCR docs](https://cloud.google.com/container-registry/docs/advanced-authentication#json_key_file). The service account key is in JSON format, it contains spaces ("` `") and colons ("`:`"). To be able to use GCR you should set `AUTH_REGISTRIES_DELIMITER` to something different than space (e.g. `AUTH_REGISTRIES_DELIMITER=";;;"`) and `AUTH_REGISTRY_DELIMITER` to something different than a single colon (e.g. `AUTH_REGISTRY_DELIMITER=":::"`).
 
 ```bash
 docker run --rm --name docker_registry_proxy -it \
@@ -38,6 +39,20 @@ docker run --rm --name docker_registry_proxy -it \
        rpardini/docker-registry-proxy:0.2.4
 ```
 
+Example with GCR using credentials from a service account from a key file `servicekey.json`:
+
+```bash
+docker run --rm --name docker_registry_proxy -it \
+       -p 0.0.0.0:3128:3128 \
+       -v $(pwd)/docker_mirror_cache:/docker_mirror_cache \
+       -v $(pwd)/docker_mirror_certs:/ca \
+       -e REGISTRIES="k8s.gcr.io gcr.io quay.io your.own.registry another.public.registry" \
+       -e AUTH_REGISTRIES_DELIMITER=";;;;" \
+       -e AUTH_REGISTRY_DELIMITER="::::" \
+       -e AUTH_REGISTRIES="gcr.io::::_json_key::::$(cat servicekey.json);;;auth.docker.io:::dockerhub_username:::dockerhub_password" \
+       rpardini/docker-registry-proxy:0.2.4
+```
+
 Let's say you did this on host `192.168.66.72`, you can then `curl http://192.168.66.72:3128/ca.crt` and get the proxy CA certificate.
 
 #### Configuring the Docker clients / Kubernetes nodes

entrypoint.sh

@@ -34,12 +34,29 @@ export ALLDOMAINS=${ALLDOMAINS:1} # remove the first comma and export
 # Now handle the auth part.
 echo -n "" > /etc/nginx/docker.auth.map
 
-for ONEREGISTRYIN in ${AUTH_REGISTRIES}; do
+# Ref: https://stackoverflow.com/a/47633817/219530
-    ONEREGISTRY=$(echo -n ${ONEREGISTRYIN} | xargs) # Remove whitespace
+AUTH_REGISTRIES_DELIMITER=${AUTH_REGISTRIES_DELIMITER:-" "}
-    AUTH_HOST=$(echo -n ${ONEREGISTRY} | cut -d ":" -f 1 | xargs)
+s=$AUTH_REGISTRIES$AUTH_REGISTRIES_DELIMITER
-    AUTH_USER=$(echo -n ${ONEREGISTRY} | cut -d ":" -f 2 | xargs)
+auth_array=();
-    AUTH_PASS=$(echo -n ${ONEREGISTRY} | cut -d ":" -f 3 | xargs)
+while [[ $s ]]; do
-    AUTH_BASE64=$(echo -n ${AUTH_USER}:${AUTH_PASS} | base64 | xargs)
+    auth_array+=( "${s%%"$AUTH_REGISTRIES_DELIMITER"*}" );
+    s=${s#*"$AUTH_REGISTRIES_DELIMITER"};
+done
+
+AUTH_REGISTRY_DELIMITER=${AUTH_REGISTRY_DELIMITER:-":"}
+
+for ONEREGISTRY in "${auth_array[@]}"; do
+    s=$ONEREGISTRY$AUTH_REGISTRY_DELIMITER
+    registry_array=();
+    while [[ $s ]]; do
+        registry_array+=( "${s%%"$AUTH_REGISTRY_DELIMITER"*}" );
+        s=${s#*"$AUTH_REGISTRY_DELIMITER"};
+    done
+    AUTH_HOST="${registry_array[0]}"
+    AUTH_USER="${registry_array[1]}"
+    AUTH_PASS="${registry_array[2]}"
+    # make base64 not wrap lines: https://superuser.com/a/1225334
+    AUTH_BASE64=$(echo -n "${AUTH_USER}:${AUTH_PASS}" | base64 | tr -d \\n )
     echo "Adding Auth for registry '${AUTH_HOST}' with user '${AUTH_USER}'."
     echo "\"${AUTH_HOST}\" \"${AUTH_BASE64}\";" >> /etc/nginx/docker.auth.map
 done