fix: match ACR regional endpoints and DNL-enabled login servers in credential provider by pujitha24 · Pull Request #10731 · kubernetes-sigs/cloud-provider-azure

pujitha24 · 2026-07-25T02:12:05Z

/kind bug

What this PR does / why we need it:

The acr-credential-provider's acrRE regex, used to detect whether an
image reference targets Azure Container Registry, only matched a single
alphanumeric label before the azurecr.* domain (e.g. foo.azurecr.io).
It rejected two valid ACR login server formats:

Registries with Domain Name Label (DNL) enabled, whose login server
includes a dash-separated hash, e.g. myregistry-abc123.azurecr.io.
ACR regional/replica endpoints, which add one extra DNS label, e.g.
myregistry.eastus.azurecr.io.

When parseACRLoginServerFromImage fails to recognize such a hostname,
GetCredentials returns an empty Auth map for that image (see
azure_credentials.go), so kubelet attempts an anonymous pull. For
private images hosted on a DNL-enabled or regional-endpoint registry,
that pull then fails with an authentication error. Public images and
registries using the existing plain registry.azurecr.io format are
unaffected.

Approach

Update acrRE to allow dashes within a DNS label and one optional
additional dot-separated label before the azurecr.* suffix, while
keeping the domain suffix itself a literal, anchored match. The
existing anti-spoofing behavior in parseACRLoginServerFromImage
(requiring whatever follows the matched registry to be empty or start
with /) is untouched, so hostnames like foo.azurecr.io.evil.com are
still correctly rejected.

Which issue(s) this PR fixes:

Fixes #9975

Special notes for your reviewer:

Added test cases for a DNL-style login server (foo-abc123.azurecr.io)
and a regional endpoint (foo.eastus.azurecr.io), and updated the
foo-azurecr-io.azurecr.cn case, which previously documented the bug
(expected "") and now correctly matches. Verified the existing
foo.azurecr.io.azurecr.cn anti-spoofing test case still returns ""
unchanged.

Does this PR introduce a user-facing change?

Fixed the acr-credential-provider incorrectly treating images hosted on Azure Container Registry regional endpoints or registries with Domain Name Label (DNL) enabled as non-ACR images, which caused private image pulls from those registries to fail with an authentication error.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Validation: go build ./pkg/credentialprovider/... and
go test ./pkg/credentialprovider/... both pass (all existing and new
subtests of TestParseACRLoginServerFromImage pass).

Signed-off-by: Pujitha Paladugu 10557236+pujitha24@users.noreply.github.com

…edential provider /kind bug #### What this PR does / why we need it: The acr-credential-provider's `acrRE` regex, used to detect whether an image reference targets Azure Container Registry, only matched a single alphanumeric label before the `azurecr.*` domain (e.g. `foo.azurecr.io`). It rejected two valid ACR login server formats: - Registries with Domain Name Label (DNL) enabled, whose login server includes a dash-separated hash, e.g. `myregistry-abc123.azurecr.io`. - ACR regional/replica endpoints, which add one extra DNS label, e.g. `myregistry.eastus.azurecr.io`. When `parseACRLoginServerFromImage` fails to recognize such a hostname, `GetCredentials` returns an empty `Auth` map for that image (see azure_credentials.go), so kubelet attempts an anonymous pull. For private images hosted on a DNL-enabled or regional-endpoint registry, that pull then fails with an authentication error. Public images and registries using the existing plain `registry.azurecr.io` format are unaffected. #### Approach Update `acrRE` to allow dashes within a DNS label and one optional additional dot-separated label before the `azurecr.*` suffix, while keeping the domain suffix itself a literal, anchored match. The existing anti-spoofing behavior in `parseACRLoginServerFromImage` (requiring whatever follows the matched registry to be empty or start with `/`) is untouched, so hostnames like `foo.azurecr.io.evil.com` are still correctly rejected. #### Which issue(s) this PR fixes: #### Special notes for your reviewer: Added test cases for a DNL-style login server (`foo-abc123.azurecr.io`) and a regional endpoint (`foo.eastus.azurecr.io`), and updated the `foo-azurecr-io.azurecr.cn` case, which previously documented the bug (expected `""`) and now correctly matches. Verified the existing `foo.azurecr.io.azurecr.cn` anti-spoofing test case still returns `""` unchanged. #### Does this PR introduce a user-facing change? ```release-note Fixed the acr-credential-provider incorrectly treating images hosted on Azure Container Registry regional endpoints or registries with Domain Name Label (DNL) enabled as non-ACR images, which caused private image pulls from those registries to fail with an authentication error. ``` #### Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.: ```docs ``` Validation: `go build ./pkg/credentialprovider/...` and `go test ./pkg/credentialprovider/...` both pass (all existing and new subtests of TestParseACRLoginServerFromImage pass). Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

kubernetes-prow · 2026-07-25T02:12:14Z

Welcome @pujitha24!

It looks like this is your first PR to kubernetes-sigs/cloud-provider-azure 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cloud-provider-azure has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

kubernetes-prow · 2026-07-25T02:12:15Z

Hi @pujitha24. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kubernetes-prow · 2026-07-25T02:12:23Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: pujitha24
Once this PR has been reviewed and has the lgtm label, please assign andyzhangx for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull request overview

Fixes ACR hostname detection in the acr-credential-provider so kubelet can retrieve credentials for Azure Container Registry images hosted on regional/replica endpoints and registries with Domain Name Label (DNL) enabled.

Changes:

Broadened the ACR login-server regex to support dashes in registry labels and one optional extra DNS label for regional endpoints.
Updated/added unit tests to cover DNL-style and regional-endpoint hostnames and to reflect the corrected matching behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pkg/credentialprovider/azure_credentials.go	Updates `acrRE` to match DNL-enabled registry names and regional endpoint formats while preserving existing anti-spoofing behavior via the post-regex suffix check.
pkg/credentialprovider/azure_credentials_test.go	Expands `TestParseACRLoginServerFromImage` with new cases and updates an existing case to validate the broader regex matching.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

andyzhangx · 2026-07-25T02:23:17Z

/ok-to-test

pujitha24 · 2026-07-27T18:19:17Z

/retest

pujitha24 · 2026-07-28T15:35:42Z

/retest

pujitha24 · 2026-07-29T15:41:56Z

/retest

pujitha24 · 2026-07-29T18:45:23Z

The two failing jobs here (pull-cloud-provider-azure-e2e-ccm-capz and pull-cloud-provider-azure-e2e-ccm-vmss-capz) look unrelated to this change — they're failing across other open PRs as well, e.g. #10737, #10693, #10730 and #10720. I retried them a few times over the last three days and the same two jobs fail each run.

This PR only touches pkg/credentialprovider (+5/-2) — ACR endpoint matching — so it shouldn't affect cluster e2e provisioning. All other 20 checks are green, including pull-cloud-provider-azure-e2e-capz and pull-cloud-provider-azure-e2e-ccm-dualstack-vmss-capz.

Happy to rebase or investigate further if it would help.

kubernetes-prow · 2026-08-02T00:07:15Z

@pujitha24: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cloud-provider-azure-e2e-ccm-capz	`7c80930`	link	true	`/test pull-cloud-provider-azure-e2e-ccm-capz`
pull-cloud-provider-azure-e2e-ccm-vmssflex-capz	`7c80930`	link	true	`/test pull-cloud-provider-azure-e2e-ccm-vmssflex-capz`
pull-cloud-provider-azure-e2e-ccm-vmss-capz	`7c80930`	link	true	`/test pull-cloud-provider-azure-e2e-ccm-vmss-capz`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Copilot AI review requested due to automatic review settings July 25, 2026 02:12

github-actions Bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Jul 25, 2026

kubernetes-prow Bot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 25, 2026

kubernetes-prow Bot requested review from Liunardy and andyzhangx July 25, 2026 02:12

Copilot started reviewing on behalf of pujitha24 July 25, 2026 02:12 View session

Copilot AI reviewed Jul 25, 2026

View reviewed changes

andyzhangx requested a review from Copilot July 25, 2026 02:18

Copilot started reviewing on behalf of andyzhangx July 25, 2026 02:19 View session

Copilot AI reviewed Jul 25, 2026

View reviewed changes

kubernetes-prow Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 25, 2026

pujitha24 force-pushed the auto/issue-9975 branch from c0a94e6 to 7c80930 Compare August 1, 2026 20:38

kubernetes-prow Bot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Aug 1, 2026

Navigation Menu

Uh oh!

fix: match ACR regional endpoints and DNL-enabled login servers in credential provider - #10731

fix: match ACR regional endpoints and DNL-enabled login servers in credential provider#10731
pujitha24 wants to merge 1 commit into
kubernetes-sigs:masterfrom
pujitha24:auto/issue-9975

pujitha24 commented Jul 25, 2026

Uh oh!

kubernetes-prow Bot commented Jul 25, 2026

Uh oh!

kubernetes-prow Bot commented Jul 25, 2026

Uh oh!

kubernetes-prow Bot commented Jul 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

andyzhangx commented Jul 25, 2026

Uh oh!

pujitha24 commented Jul 27, 2026

Uh oh!

pujitha24 commented Jul 28, 2026

Uh oh!

pujitha24 commented Jul 29, 2026

Uh oh!

pujitha24 commented Jul 29, 2026

Uh oh!

kubernetes-prow Bot commented Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

pujitha24 commented Jul 25, 2026

What this PR does / why we need it:

Approach

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Uh oh!

kubernetes-prow Bot commented Jul 25, 2026

Uh oh!

kubernetes-prow Bot commented Jul 25, 2026

Uh oh!

kubernetes-prow Bot commented Jul 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

andyzhangx commented Jul 25, 2026

Uh oh!

pujitha24 commented Jul 27, 2026

Uh oh!

pujitha24 commented Jul 28, 2026

Uh oh!

pujitha24 commented Jul 29, 2026

Uh oh!

pujitha24 commented Jul 29, 2026

Uh oh!

kubernetes-prow Bot commented Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants