GoogleContainerTools / GoogleContainerTools/skaffold
FR: Use Skaffold to set up registry authentication
- Dominant language
- Go
- Stars
- 15.9k
- Forks
- 1.7k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 10
Description
### Desired behavior
When running a pipeline on a CI build agent, I want to authenticate to the container image registry, so that Skaffold can push the image(s) that it builds.
If Skaffold provides this functionality, I can authenticate without relying on other CLI tools such as `docker`, `crane`, or `ko`, e.g.:
```shell
skaffold login registry.example.com --username agent-user --password $TOKEN
```
(or `skaffold auth login ...`)
### Current behavior
One of either the `docker`, `crane`, or `ko` CLIs must be available to the pipeline running on the CI build agent, for example: https://github.com/google/k8s-digester/blob/v0.1.7/.github/workflows/release.yml#L131
If I use Docker to build container images, I can use the `docker` CLI to authenticate. However, if I use the `ko`, Jib, or Bazel builders, the build agent may not have the `docker` CLI available, because it is not required for the build.
### Design considerations
The `ko` CLI implemented `ko login` (similar to `docker login`) by making use of the `crane auth login` command:
https://github.com/google/ko/blob/v0.9.3/pkg/commands/root.go#L44
https://github.com/google/go-containerregistry/blob/v0.7.0/cmd/crane/cmd/auth.go#L116
If Skaffold follows the same approach, then implementation should be straightforward.
`docker` and `ko` use just `login` as the subcommand, while `crane` uses `auth login` . The latter allows for the `auth get` subcommand: https://github.com/google/go-containerregistry/blob/v0.7.0/cmd/crane/cmd/auth.go#L34
Contributor guide
Assessment
This issue has not been assessed yet.