CrowdStrike / CrowdStrike/falcon-operator
Support for pushing images using GCP workload identity federation
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 79
- Forks
- 51
- Avg merge
- 6h 46m
- Merged PRs (30d)
- 10
Description
I've been looking through the authentication process for pushing images within a GCP project. It seems right now, when pushing images, the operator is looking explicitly for k8s secrets resources for everything other than AWS clusters (see here). This poses a security issue because the credentials in a k8s secret are long lived. The better solution here is to use an attached GCP service account via Workload Identity Federation.
I've made a sketch of a solution here:-
However, it's not ready as a PR because it is blocked by #711
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading pkg/registry/pushtoken/token.go and the blocking issue #711, then compare the linked workload-identity sketch. Done means GCP image pushes can use an attached service account through Workload Identity Federation instead of requiring long-lived Kubernetes Secret credentials.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, google-cloud, kubernetes
- Domain
- authentication, cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100