GoogleContainerTools / GoogleContainerTools/skaffold

FR: Use Skaffold to set up registry authentication

Open
#6,963 0 comments 9 reactions 0 assignees View on GitHub
area/auth kind/feature-request priority/p2
Dominant language
Go
Stars
15.9k
Forks
1.7k
Avg merge
3d 9h
Merged PRs (30d)
10

Description

### Desired behavior

When running a pipeline on a CI build agent, I want to authenticate to the container image registry, so that Skaffold can push the image(s) that it builds.

If Skaffold provides this functionality, I can authenticate without relying on other CLI tools such as `docker`, `crane`, or `ko`, e.g.:

```shell
skaffold login registry.example.com --username agent-user --password $TOKEN
```

(or `skaffold auth login ...`)

### Current behavior

One of either the `docker`, `crane`, or `ko` CLIs must be available to the pipeline running on the CI build agent, for example: https://github.com/google/k8s-digester/blob/v0.1.7/.github/workflows/release.yml#L131

If I use Docker to build container images, I can use the `docker` CLI to authenticate. However, if I use the `ko`, Jib, or Bazel builders, the build agent may not have the `docker` CLI available, because it is not required for the build.

### Design considerations

The `ko` CLI implemented `ko login` (similar to `docker login`) by making use of the `crane auth login` command:

https://github.com/google/ko/blob/v0.9.3/pkg/commands/root.go#L44

https://github.com/google/go-containerregistry/blob/v0.7.0/cmd/crane/cmd/auth.go#L116

If Skaffold follows the same approach, then implementation should be straightforward.

`docker` and `ko` use just `login` as the subcommand, while `crane` uses `auth login` . The latter allows for the `auth get` subcommand: https://github.com/google/go-containerregistry/blob/v0.7.0/cmd/crane/cmd/auth.go#L34

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.