[RFC-0014] Upgrade auth

go.mod

@@ -11,12 +11,13 @@ require (
 	github.com/elazarl/goproxy v1.8.4
 	github.com/fluxcd/image-reflector-controller/api v1.2.0
 	github.com/fluxcd/pkg/apis/acl v0.12.0
+	github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad
 	github.com/fluxcd/pkg/apis/event v0.32.0
-	github.com/fluxcd/pkg/apis/meta v1.35.0
-	github.com/fluxcd/pkg/artifact v0.24.0
-	github.com/fluxcd/pkg/auth v0.62.0
-	github.com/fluxcd/pkg/cache v0.17.0
-	github.com/fluxcd/pkg/runtime v0.119.0
+	github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad
+	github.com/fluxcd/pkg/artifact v0.25.1-0.20261020182949-c5194b17fdad
+	github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad
+	github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad
+	github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad
 	github.com/fluxcd/pkg/version v0.19.0
 	github.com/go-logr/logr v1.4.4
 	github.com/google/go-containerregistry v0.22.1
@@ -139,6 +140,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.10.2 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.9.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect

go.sum

@@ -129,22 +129,24 @@ github.com/fluxcd/cli-utils v1.4.0 h1:zlTiCWcVDQvvwZXILYeu5rpbnGt1sS+w32y3+rkOpi
 github.com/fluxcd/cli-utils v1.4.0/go.mod h1:OupUOj2boEKTbiguMbGMz5Z/d59JUcb1c7pPESe8Pjw=
 github.com/fluxcd/pkg/apis/acl v0.12.0 h1:UWpZDqKxpKDW38wdXIMHV8Uv3POPu2vUrra0JH1frH0=
 github.com/fluxcd/pkg/apis/acl v0.12.0/go.mod h1:PJrGIu5Bw/6/siO95uhS+pi5oKSU+gVJqHqsPHb8Kok=
+github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad h1:SAzeZibDaqyyq7CaccwDEySCcsOMGGuHmEN28LcRPvM=
+github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad/go.mod h1:bEwkDgBjLXMVJ2BwmVbbj32PkirmNSicabgl2Jvw7Dk=
 github.com/fluxcd/pkg/apis/event v0.32.0 h1:3zyjdUspwQN+EQJPlUXwCvCMbeqtB+azlNmeenAcbuE=
 github.com/fluxcd/pkg/apis/event v0.32.0/go.mod h1:ALma8dTqo+NbI+z4BawSzt0pAPjetCSNNUSSS/9p0VU=
-github.com/fluxcd/pkg/apis/meta v1.35.0 h1:/k5d7uEFrxkz/hf6JTrdsKBr3UQWVHW2J4G6VSSae/k=
-github.com/fluxcd/pkg/apis/meta v1.35.0/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
-github.com/fluxcd/pkg/artifact v0.24.0 h1:j/3JrNDThWRwtkkU9u2N7wOFkSVwZjnMYQWHNG51PEA=
-github.com/fluxcd/pkg/artifact v0.24.0/go.mod h1:D1VCIh95degPgcfOOfVmRDHRqJqgRb2Z+PCCVODcHws=
-github.com/fluxcd/pkg/auth v0.62.0 h1:ZhrkfoLTaH5Q095sNGLZ47zLYw/AHw4nVnPAspGwT/c=
-github.com/fluxcd/pkg/auth v0.62.0/go.mod h1:46lKYjDvx5Q7fsq09ZC1BxXJcstTOfm2X/NFLLFn7wA=
-github.com/fluxcd/pkg/cache v0.17.0 h1:197ST7bSJD2Nw4G01y5cMjtWQpwQsyjpl2ox4MaGeU8=
-github.com/fluxcd/pkg/cache v0.17.0/go.mod h1:OW3fncHhPnPZFZav5FdEa//cyMHSndI0JS+IM69LXOU=
+github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad h1:p/W9d+gf9FuNNmiwUZJT7ReGzTzwuYLUago5szqkq5I=
+github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
+github.com/fluxcd/pkg/artifact v0.25.1-0.20261020182949-c5194b17fdad h1:r1anWXtWivFjkI6F0FDSHPnLw2dSMXYQpVpu+Esq+nc=
+github.com/fluxcd/pkg/artifact v0.25.1-0.20261020182949-c5194b17fdad/go.mod h1:9wKz9vfH7zuhteNxQkGw9l7sCN1xW8YZttEWNN8M/L0=
+github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad h1:lUjY+hEXSYG8RdJhuNYl5mjkrnLpwuG/+A+iSybCRlE=
+github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad/go.mod h1:gWbB4MzuHWalVyI0o4lE84aINidor9+S63ithckm+94=
+github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad h1:Lf7S9vl776ZW7SDxdQtZcEu1vjWroZS86ePd8gost4M=
+github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad/go.mod h1:OW3fncHhPnPZFZav5FdEa//cyMHSndI0JS+IM69LXOU=
 github.com/fluxcd/pkg/lockedfile v0.9.0 h1:bjm/kUjYpdMBBz/5Hw0nTSLwsZwrithTrH8gMyZjbzI=
 github.com/fluxcd/pkg/lockedfile v0.9.0/go.mod h1:xtSyl0R6g01ItVGOTRqzjPZTXqFwCvkQTuWA52oudQg=
 github.com/fluxcd/pkg/oci v0.72.0 h1:nUTGHTd/2qq2yT66anHfXiwE19uJl6VL36zm74iFwbU=
 github.com/fluxcd/pkg/oci v0.72.0/go.mod h1:5ngbB6SDvo6daD29HZtBbC6CcnHxuI+5JJR/YqtZhKM=
-github.com/fluxcd/pkg/runtime v0.119.0 h1:cY2KpQ4WwpQKG+pFToslSIXUjKK8ckHQ7cvPUc/QHiY=
-github.com/fluxcd/pkg/runtime v0.119.0/go.mod h1:7LJFbZPXwl++ATADx6bt63Jh9CverBoXQxbluxPwspw=
+github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad h1:AcQzxznBRZyRthcVgFjPV49uLfu7eDOoHO1B5WyRsO8=
+github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad/go.mod h1:Cw0CQ/tVKS9lgJoyKVouZr1qVnoJcYnSHw3QDzIOOjA=
 github.com/fluxcd/pkg/sourceignore v0.21.0 h1:p65j81RzXAeL4KJKgbkFRou+xiA0841CUdAsOCSAb5o=
 github.com/fluxcd/pkg/sourceignore v0.21.0/go.mod h1:N9NFuxbEMm+UPtP9t+Oyx5LEs0uHu7W+WVPmdlIbCeY=
 github.com/fluxcd/pkg/tar v1.3.0 h1:PbL5jNN5q/F6nXA8aCH+msM75BS6lSnPX2RNd48f8ls=
@@ -352,6 +354,8 @@ github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiT
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spiffe/go-spiffe/v2 v2.9.0 h1:g5qTg3qIP1HXV+GzuyEfSJFVxUCpEP5Ui1OINVJHPB4=
+github.com/spiffe/go-spiffe/v2 v2.9.0/go.mod h1:w2CLWKLMTX/PPYUEUPv3ltH0RXsw5S8suwNF46w9/Aw=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=

internal/controller/imagepolicy_controller.go

@@ -116,6 +116,8 @@ type ImagePolicyReconciler struct {
 	TokenCache                *cache.TokenCache
 	DependencyRequeueInterval time.Duration
 
+	ObjectLevelWorkloadIdentity bool
+
 	patchOptions []patch.Option
 }
 
@@ -357,7 +359,7 @@ func (r *ImagePolicyReconciler) reconcile(ctx context.Context, sp *patch.SerialP
 	}
 
 	// Check object-level workload identity feature gate.
-	if repo.Spec.Provider != "generic" && repo.Spec.ServiceAccountName != "" && !auth.IsObjectLevelWorkloadIdentityEnabled() {
+	if repo.Spec.Provider != "generic" && repo.Spec.ServiceAccountName != "" && !r.ObjectLevelWorkloadIdentity {
 		const msgFmt = "to use spec.serviceAccountName in the ImageRepository for provider authentication please enable the %s feature gate in the controller"
 		conditions.MarkStalled(obj, meta.FeatureGateDisabledReason, msgFmt,
 			auth.FeatureGateObjectLevelWorkloadIdentity)
@@ -465,20 +467,13 @@ func (r *ImagePolicyReconciler) fetchDigest(ctx context.Context,
 		return "", fmt.Errorf("failed parsing reference %q: %w", ref, err)
 	}
 
-	involvedObject := &cache.InvolvedObject{
-		Kind:      imagev1.ImagePolicyKind,
-		Name:      obj.GetName(),
-		Namespace: obj.GetNamespace(),
-		Operation: cache.OperationReconcile,
-	}
-
 	// The timeout must span both building the auth options and the registry
 	// request, as the authenticator fetches registry credentials lazily during
 	// the request.
 	ctx, cancel := context.WithTimeout(ctx, repo.GetTimeout())
 	defer cancel()
 
-	opts, err := r.AuthOptionsGetter.GetOptions(ctx, repo, involvedObject)
+	opts, err := r.AuthOptionsGetter.GetOptions(ctx, repo, imagev1.ImagePolicyKind, obj)
 	if err != nil {
 		return "", fmt.Errorf("failed to configure authentication options: %w", err)
 	}

internal/controller/imagepolicy_controller_test.go

@@ -37,7 +37,6 @@ import (
 
 	aclapis "github.com/fluxcd/pkg/apis/acl"
 	"github.com/fluxcd/pkg/apis/meta"
-	"github.com/fluxcd/pkg/auth"
 	"github.com/fluxcd/pkg/runtime/acl"
 	"github.com/fluxcd/pkg/runtime/conditions"
 	"github.com/fluxcd/pkg/runtime/events"
@@ -465,8 +464,14 @@ func TestImagePolicyReconciler_objectLevelWorkloadIdentityFeatureGate(t *testing
 	t.Run("enabled", func(t *testing.T) {
 		g := NewWithT(t)
 
-		auth.EnableObjectLevelWorkloadIdentity()
-		t.Cleanup(auth.DisableObjectLevelWorkloadIdentity)
+		testAuthOptionsGetter.ObjectLevelWorkloadIdentity = true
+		testImageRepositoryReconciler.ObjectLevelWorkloadIdentity = true
+		testImagePolicyReconciler.ObjectLevelWorkloadIdentity = true
+		t.Cleanup(func() {
+			testAuthOptionsGetter.ObjectLevelWorkloadIdentity = false
+			testImageRepositoryReconciler.ObjectLevelWorkloadIdentity = false
+			testImagePolicyReconciler.ObjectLevelWorkloadIdentity = false
+		})
 
 		namespaceName := "imagepolicy-" + randStringRunes(5)
 		namespace := &corev1.Namespace{
@@ -497,7 +502,7 @@ func TestImagePolicyReconciler_objectLevelWorkloadIdentityFeatureGate(t *testing
 			err := k8sClient.Get(ctx, client.ObjectKeyFromObject(imageRepo), imageRepo)
 			logRepoStatus(t, imageRepo)
 			return err == nil && !conditions.IsReady(imageRepo) &&
-				conditions.GetReason(imageRepo, meta.ReadyCondition) == imagev1.ReadOperationFailedReason
+				conditions.GetReason(imageRepo, meta.ReadyCondition) == imagev1.AuthenticationFailedReason
 		}, timeout, interval).Should(BeTrue())
 
 		g.Eventually(func() bool {

internal/controller/imagerepository_controller.go

@@ -109,6 +109,8 @@ type ImageRepositoryReconciler struct {
 	Database          storage.Database
 	AuthOptionsGetter *registry.AuthOptionsGetter
 
+	ObjectLevelWorkloadIdentity bool
+
 	patchOptions []patch.Option
 }
 
@@ -227,7 +229,7 @@ func (r *ImageRepositoryReconciler) reconcile(ctx context.Context, sp *patch.Ser
 	}()
 
 	// Check object-level workload identity feature gate.
-	if obj.Spec.Provider != "generic" && obj.Spec.ServiceAccountName != "" && !auth.IsObjectLevelWorkloadIdentityEnabled() {
+	if obj.Spec.Provider != "generic" && obj.Spec.ServiceAccountName != "" && !r.ObjectLevelWorkloadIdentity {
 		const msgFmt = "to use spec.serviceAccountName for provider authentication please enable the %s feature gate in the controller"
 		conditions.MarkStalled(obj, meta.FeatureGateDisabledReason, msgFmt,
 			auth.FeatureGateObjectLevelWorkloadIdentity)
@@ -268,19 +270,12 @@ func (r *ImageRepositoryReconciler) reconcile(ctx context.Context, sp *patch.Ser
 	}
 	conditions.Delete(obj, meta.StalledCondition)
 
-	involvedObject := &cache.InvolvedObject{
-		Kind:      imagev1.ImageRepositoryKind,
-		Name:      obj.GetName(),
-		Namespace: obj.GetNamespace(),
-		Operation: cache.OperationReconcile,
-	}
-
 	// The timeout must span both building the auth options and the scan, as the
 	// authenticator fetches registry credentials lazily during the scan.
 	ctx, cancel := context.WithTimeout(ctx, obj.GetTimeout())
 	defer cancel()
 
-	opts, err := r.AuthOptionsGetter.GetOptions(ctx, obj, involvedObject)
+	opts, err := r.AuthOptionsGetter.GetOptions(ctx, obj, imagev1.ImageRepositoryKind, obj)
 	if err != nil {
 		e := fmt.Errorf("failed to configure authentication options: %w", err)
 		conditions.MarkFalse(obj, meta.ReadyCondition, imagev1.AuthenticationFailedReason, "%s", e)

internal/controller/suite_test.go

@@ -60,6 +60,10 @@ var (
 	testEnv      *testenv.Environment
 	testBadgerDB *badger.DB
 	ctx          = ctrl.SetupSignalHandler()
+
+	testAuthOptionsGetter         *registry.AuthOptionsGetter
+	testImageRepositoryReconciler *ImageRepositoryReconciler
+	testImagePolicyReconciler     *ImagePolicyReconciler
 )
 
 func TestMain(m *testing.M) {
@@ -87,26 +91,28 @@ func TestMain(m *testing.M) {
 		panic(fmt.Sprintf("Failed to create new Badger database: %v", err))
 	}
 
-	optGetter := &registry.AuthOptionsGetter{Client: testEnv}
+	testAuthOptionsGetter = &registry.AuthOptionsGetter{Client: testEnv}
 
-	if err = (&ImageRepositoryReconciler{
+	testImageRepositoryReconciler = &ImageRepositoryReconciler{
 		Client:            testEnv,
 		Database:          database.NewBadgerDatabase(testBadgerDB),
 		Recorder:          events.NewFakeRecorder(256, false),
-		AuthOptionsGetter: optGetter,
-	}).SetupWithManager(testEnv, ImageRepositoryReconcilerOptions{
+		AuthOptionsGetter: testAuthOptionsGetter,
+	}
+	if err = testImageRepositoryReconciler.SetupWithManager(testEnv, ImageRepositoryReconcilerOptions{
 		RateLimiter: controller.GetDefaultRateLimiter(),
 	}); err != nil {
 		panic(fmt.Sprintf("Failed to start ImageRepositoryReconciler: %v", err))
 	}
 
-	if err = (&ImagePolicyReconciler{
+	testImagePolicyReconciler = &ImagePolicyReconciler{
 		Client:                    testEnv,
 		Database:                  database.NewBadgerDatabase(testBadgerDB),
 		Recorder:                  events.NewFakeRecorder(256, false),
-		AuthOptionsGetter:         optGetter,
+		AuthOptionsGetter:         testAuthOptionsGetter,
 		DependencyRequeueInterval: 30 * time.Second,
-	}).SetupWithManager(testEnv, ImagePolicyReconcilerOptions{
+	}
+	if err = testImagePolicyReconciler.SetupWithManager(testEnv, ImagePolicyReconcilerOptions{
 		RateLimiter: controller.GetDefaultRateLimiter(),
 	}); err != nil {
 		panic(fmt.Sprintf("Failed to start ImagePolicyReconciler: %v", err))

internal/features/features.go

@@ -44,16 +44,20 @@ var features = map[string]bool{
 	// FluxStorage
 	// opt-in from v1.2
 	FluxStorage: false,
+
+	// ObjectLevelWorkloadIdentity
+	// opt-in from Flux v2.6.
+	auth.FeatureGateObjectLevelWorkloadIdentity: false,
 }
 
-func init() {
-	auth.SetFeatureGates(features)
+var retiredFeatures = map[string]string{
+	// TODO: retire ObjectLevelWorkloadIdentity in Flux 2.11.
 }
 
 // FeatureGates contains a list of all supported feature gates and their default
 // values.
-func FeatureGates() map[string]bool {
-	return features
+func FeatureGates() (map[string]bool, map[string]string) {
+	return features, retiredFeatures
 }
 
 // Enabled verifies whether the feature is enabled or not.

internal/registry/options.go

@@ -18,6 +18,7 @@ package registry
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"net/url"
 
@@ -28,6 +29,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	cryptov1 "github.com/fluxcd/pkg/apis/crypto/v1"
 	"github.com/fluxcd/pkg/auth"
 	authutils "github.com/fluxcd/pkg/auth/utils"
 	"github.com/fluxcd/pkg/cache"
@@ -48,11 +50,14 @@ import (
 // - spec.serviceAccountName
 type AuthOptionsGetter struct {
 	client.Client
-	TokenCache *cache.TokenCache
+	TokenCache                  *cache.TokenCache
+	DefaultServiceAccount       string
+	ObjectLevelWorkloadIdentity bool
 }
 
 func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageRepository,
-	involvedObject *cache.InvolvedObject) ([]remote.Option, error) {
+	involvedObjectKind string, involvedObject client.Object) ([]remote.Option, error) {
+
 	var transportOptions []func(*http.Transport)
 
 	// Load proxy configuration.
@@ -79,23 +84,72 @@ func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageR
 	var authSecret corev1.Secret
 	var authenticator authn.Authenticator
 
-	if provider := repo.GetProvider(); provider != "" && provider != "generic" {
-		// Build login provider options and use it to attempt registry login.
-		opts := []auth.Option{
+	provider := repo.GetProvider()
+	useProviderAuth := provider != "" && provider != "generic"
+
+	// Resolve the ServiceAccount used for provider authentication. The default
+	// ServiceAccount only applies to providers that support object-level
+	// workload identity; for the generic provider, only the ServiceAccount
+	// explicitly referenced by the ImageRepository is used for image pull
+	// secrets.
+	saName := repo.Spec.ServiceAccountName
+	if useProviderAuth && saName == "" {
+		saName = r.DefaultServiceAccount
+	}
+	var sa *corev1.ServiceAccount
+	if saName != "" {
+		if useProviderAuth && !r.ObjectLevelWorkloadIdentity {
+			return nil, auth.ErrObjectLevelWorkloadIdentityNotEnabled
+		}
+		sa = &corev1.ServiceAccount{}
+		saRef := types.NamespacedName{
+			Name:      saName,
+			Namespace: repo.GetNamespace(),
+		}
+		if err := r.Get(ctx, saRef, sa); err != nil {
+			return nil, fmt.Errorf("failed to get service account '%s': %w", saRef, err)
+		}
+	}
+
+	if useProviderAuth {
+		// Build the provider-agnostic authentication spec, validating the
+		// kubeconfig-equivalent inputs and the ServiceAccount annotations.
+		buildOpts := []cryptov1.Option{
+			cryptov1.WithServiceProvider(provider),
+			cryptov1.WithOCI(),
+		}
+		if sa != nil {
+			buildOpts = append(buildOpts, cryptov1.WithAnnotations(sa.Annotations))
+			if len(sa.ImagePullSecrets) > 0 {
+				buildOpts = append(buildOpts, cryptov1.WithImagePullSecrets())
+			}
+		}
+		if repo.Spec.CertSecretRef != nil {
+			buildOpts = append(buildOpts, cryptov1.WithCertSecretRef())
+		}
+		spec, err := cryptov1.BuildSpec(buildOpts...)
+		if err != nil {
+			return nil, fmt.Errorf("failed to validate configuration: %w", err)
+		}
+
+		authOpts := []auth.Option{
 			auth.WithClient(r.Client),
-			auth.WithServiceAccountNamespace(repo.GetNamespace()),
+			auth.WithObject(imagev1.GroupVersion.Group, imagev1.ImageRepositoryKind, repo),
 		}
-		if proxyURL != nil {
-			opts = append(opts, auth.WithProxyURL(*proxyURL))
+		authOpts = append(authOpts, auth.OptionsFromSpec(spec.Auth)...)
+		if sa != nil {
+			authOpts = append(authOpts, auth.WithServiceAccountName(sa.Name))
 		}
-		if repo.Spec.ServiceAccountName != "" {
-			opts = append(opts, auth.WithServiceAccountName(repo.Spec.ServiceAccountName))
+		if proxyURL != nil {
+			authOpts = append(authOpts, auth.WithProxyURL(*proxyURL))
 		}
 		if r.TokenCache != nil {
-			opts = append(opts, auth.WithCache(*r.TokenCache, *involvedObject))
+			authOpts = append(authOpts,
+				auth.WithCache(*r.TokenCache),
+				auth.WithCacheOperation(cache.OperationReconcile),
+				auth.WithInvolvedObject(imagev1.GroupVersion.Group, involvedObjectKind, involvedObject))
 		}
-		var err error
-		authenticator, err = authutils.GetArtifactRegistryCredentials(ctx, provider, repo.Spec.Image, opts...)
+		authenticator, err = authutils.GetArtifactRegistryCredentials(ctx, provider, repo.Spec.Image, authOpts...)
 		if err != nil {
 			return nil, err
 		}
@@ -160,12 +214,8 @@ func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageR
 			pullSecrets = append(pullSecrets, s)
 		}
 
-		if repo.Spec.ServiceAccountName != "" {
-			saRef := types.NamespacedName{
-				Name:      repo.Spec.ServiceAccountName,
-				Namespace: repo.GetNamespace(),
-			}
-			s, err := secrets.PullSecretsFromServiceAccountRef(ctx, r.Client, saRef)
+		if sa != nil {
+			s, err := secrets.PullSecretsFromServiceAccount(ctx, r.Client, sa)
 			if err != nil {
 				return nil, err
 			}