Ignition: Support for Basic Authentication

Issue by @jcrowthe

Issue Report

CoreOS Version

$ cat /etc/os-release
NAME=CoreOS 1235.6.0

Expected Behavior

Accept basic authentication username/password in URL of remote Ignition config.

Actual Behavior

Ignition fails to pull the remote config.

Reproduction Steps

1. Provide the following as ignition data:

{
    "ignition": {
        "version": "2.0.0",
        "config": {
            "append": [{
                "source": "http://test:test@<server-ip>/test.json",
                "verification": {}
            }]
        }
    }
}

2. Host the following test.json at the server address above:

{
    "ignition": {
        "version": "2.0.0"
    },
    "storage": {
        "files": [{
            "filesystem": "root",
            "path": "/foo/bar",
            "contents": {
                "source": "data:,example%20file%0A"
            }
        }]
    }
}

Feature Request

This is a request for basic authentication support in Ignition. This support would allow ignition data to be housed on a remote server that requires a username/password in order to be accessed. The application of this feature would be to provide ignition data that contains sensitive data, such as SSL certificates, passwords, etc.

While an obvious alternative to this solution is to embed this sensitive config information directly into the parent ignition file, this is not always possible. Specifically, right now, cloud providers have a max of 16KB of data that can be placed inside the user-data (AWS) or custom-data (Azure) fields, where the ignition data is submitted. Once this limit is reached, it is necessary to reference further configs by using Ignition's remote config ability.

Let's consider this request. Thanks!

The issue names no implementation files or tests. Start by tracing how Ignition retrieves remote configuration URLs, then reproduce the provided URL with embedded credentials; done means the remote config is fetched successfully with basic authentication and the existing reproduction works without regressing unauthenticated retrieval.