Add --oci-skip-registry-validation flag for custom registry proxies

[yegortokmakov]

Summary

This PR adds support for using custom OCI registry proxies/gateways with cloud provider workload identity authentication by introducing a new controller flag that bypasses registry domain validation.

Problem

Organizations using custom OCI registry proxies (for security, caching, or compliance reasons) cannot use cloud provider authentication because the auth package validates that registry domains match official patterns (e.g., *.gcr.io, *.dkr.ecr.*.amazonaws.com, *.azurecr.io).

Solution

Add a new controller flag --oci-skip-registry-validation that, when enabled, skips domain validation in ParseArtifactRepository for all cloud providers (GCP, AWS, Azure).

Changes

auth/controller_flags.go

• Added constant ControllerFlagOCISkipRegistryValidation
• Added ociSkipRegistryValidation variable
• Added SetOCISkipRegistryValidation() and GetOCISkipRegistryValidation() functions

auth/gcp/provider.go

• Modified ParseArtifactRepository to skip validation when flag is enabled
• Returns provider name when validation is skipped

auth/aws/provider.go

• Modified ParseArtifactRepository to skip validation when flag is enabled
• Returns provider name when validation is skipped
• Modified getECRRegionFromRegistryInput to fall back to AWS_REGION env var when provider name is returned

auth/azure/provider.go

• Modified ParseArtifactRepository to skip validation when flag is enabled
• Returns extracted registry host when validation is skipped

Tests

Added tests for:

• TestSetOCISkipRegistryValidation
• TestGetOCISkipRegistryValidation
• TestProvider_ParseArtifactRegistry_SkipValidation (GCP)
• TestProvider_ParseArtifactRepository_SkipValidation (AWS)
• TestProvider_ParseArtifactRegistry_SkipValidation (Azure)

Usage

Controllers using this package can bind the flag:

flag.BoolVar(&ociSkipRegistryValidation, auth.ControllerFlagOCISkipRegistryValidation, false,
    "Skip OCI registry domain validation for cloud provider authentication.")

// After flag.Parse()
if ociSkipRegistryValidation {
    auth.SetOCISkipRegistryValidation(true)
}

Security Considerations

• This flag should only be enabled when using trusted registry proxies
• Cloud provider credentials will be sent to the configured registry endpoint

Related

• Feature request: Support OCI registry proxies with cloud provider authentication source-controller#1974