func parseACRLoginServerFromImage(image string, env *azure.Environment) string {
	match := acrRE.FindAllString(image, -1)
	if len(match) == 1 {
		return match[0]
	}
	if env != nil {
		cloudAcrSuffix := env.ContainerRegistryDNSSuffix
		cloudAcrSuffixLength := len(cloudAcrSuffix)
		if cloudAcrSuffixLength > 0 {
			customAcrSuffixIndex := strings.Index(image, cloudAcrSuffix)
			if customAcrSuffixIndex != -1 {
				endIndex := customAcrSuffixIndex + cloudAcrSuffixLength
				return image[0:endIndex]
			}
		}
	}
	return ""
}
parseACRLoginServerFromImage takes image as parameter and returns login server of it.
Parameter `image` is expected in following format: foo.azurecr.io/bar/imageName:version
If the provided image is not an acr image, this function will return an empty string.
package credentialprovider
import (
	"context"
	"fmt"
	"regexp"
	"strings"
	"github.com/Azure/go-autorest/autorest/adal"
	"github.com/Azure/go-autorest/autorest/azure"
	k8sCredentialProvider "github.com/vdemeester/k8s-pkg-credentialprovider"
	"k8s.io/klog/v2"
)
var (
	containerRegistryUrls = []string{"*.azurecr.io", "*.azurecr.cn", "*.azurecr.de", "*.azurecr.us"}
	acrRE                 = regexp.MustCompile(`.*\.azurecr\.io|.*\.azurecr\.cn|.*\.azurecr\.de|.*\.azurecr\.us`)
)
func NewAcrDockerProvider(provider CredentialProvider) k8sCredentialProvider.DockerConfigProvider {
	return acrDockerProvider{
		internalProvider: provider,
	}
}
type acrDockerProvider struct {
	internalProvider CredentialProvider
}
func (acr acrDockerProvider) Enabled() bool {
	return true
}
func (acr acrDockerProvider) Provide(image string) k8sCredentialProvider.DockerConfig {
	cfg := k8sCredentialProvider.DockerConfig{}
	creds, err := acr.internalProvider.GetAcrCredentials(image)
	if err != nil {
		klog.ErrorS(err, "failed to get acr credentials")
		return cfg
	}
	return k8sCredentialProvider.DockerConfig{
		"*.azurecr.*": creds,
	}
}
func (c CloudConfigCredentialProvider) GetAcrCredentials(image string) (k8sCredentialProvider.DockerConfigEntry, error) {
	cred := k8sCredentialProvider.DockerConfigEntry{
		Username: "",
		Password: "",
	}
	if c.config.UseManagedIdentityExtension {
		klog.V(4).Info("using managed identity for acr credentials")
		loginServer := parseACRLoginServerFromImage(image, c.environment)
		if loginServer == "" {
			klog.V(4).InfoS("image is not from ACR, skip MSI authentication", "image", image)
		} else {
			token, err := getServicePrincipalTokenFromCloudConfig(c.config, c.environment, c.environment.ServiceManagementEndpoint)
			if err != nil {
				return cred, err
			}
			if managedCred, err := getACRDockerEntryFromARMToken(c.config.TenantID, *c.environment, token, loginServer); err == nil {
				klog.V(4).InfoS("found acr gredentials", "url", loginServer)
				return managedCred, nil
			}
		}
	} else {
		return k8sCredentialProvider.DockerConfigEntry{
			Username: c.config.AADClientID,
			Password: c.config.AADClientSecret,
		}, nil
	}
	return cred, nil
}
func (c EnvironmentCredentialProvider) GetAcrCredentials(image string) (k8sCredentialProvider.DockerConfigEntry, error) {
	cred := k8sCredentialProvider.DockerConfigEntry{
		Username: "",
		Password: "",
	}
	creds, err := getCredentials(c.envSettings, c.envSettings.Environment.ServiceManagementEndpoint)
	if err != nil {
		return cred, err
	}
	loginServer := parseACRLoginServerFromImage(image, &c.envSettings.Environment)
	if loginServer == "" {
		klog.V(4).InfoS("image is not from acr, skip msi auth", "image", image)
	} else {
		managedCred, err := getACRDockerEntryFromARMToken(creds.tenantID, c.envSettings.Environment, creds.token, loginServer)
		if err != nil {
			return cred, err
		}
		return managedCred, nil
	}
	return cred, nil
}
func (c CloudConfigCredentialProvider) IsAcrRegistry(image string) bool {
	return parseACRLoginServerFromImage(image, c.environment) != ""
}
func (c EnvironmentCredentialProvider) IsAcrRegistry(image string) bool {
	return parseACRLoginServerFromImage(image, &c.envSettings.Environment) != ""
}
func getACRDockerEntryFromARMToken(tenantID string, env azure.Environment, token *adal.ServicePrincipalToken, loginServer string) (k8sCredentialProvider.DockerConfigEntry, error) {
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()
	cred := k8sCredentialProvider.DockerConfigEntry{
		Username: "",
		Password: "",
	}
	err := token.RefreshExchangeWithContext(ctx, env.ServiceManagementEndpoint)
	if err != nil {
		return cred, fmt.Errorf("failed to refresh token using resource %s, error: %+v", env.ServiceManagementEndpoint, err)
	}
	armAccessToken := token.OAuthToken()
	klog.V(4).InfoS("discovering auth redirects", "url", loginServer)
	directive, err := receiveChallengeFromLoginServer(loginServer)
	if err != nil {
		return cred, fmt.Errorf("failed to receive challenge: %s", err)
	}
	klog.V(4).Info("exchanging an acr refresh_token")
	registryRefreshToken, err := performTokenExchange(loginServer, directive, tenantID, armAccessToken)
	if err != nil {
		return cred, fmt.Errorf("failed to perform token exchange: %s", err)
	}
	klog.V(4).InfoS("adding ACR docker config entry", "url", loginServer)
	return k8sCredentialProvider.DockerConfigEntry{
		Username: dockerTokenLoginUsernameGUID,
		Password: registryRefreshToken,
	}, nil
}