jetstack / jetstack/version-checker
Support for GCP Service Account with Workload Identity for GCR Artifact Registry
- Lenguaje dominante
- Go
- Estrellas
- 778
- Forks
- 82
- Merge medio
- 2 min
- PR fusionados (30 d)
- 3
Descripción
Currently, version-checker only supports [basic authentication](https://github.com/jetstack/version-checker/blob/efca612c64483c7873528a1135ad7149e82cccba/pkg/client/gcr/gcr.go#L63), which limits the available methods for authenticating against GCR/GAR.
Deploying version-checker on GKE clusters would be significantly more secure if it could leverage [Google ADC](https://cloud.google.com/docs/authentication/provide-credentials-adc#containerized). This would allow us to stop using static service account keys in production environments, enabling deployments to use cluster metadata for accessing Google private registries.
If version-checker could support GCP [Service Accounts with Workload Identity](url) on [GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) and [GKE Enterprise](https://cloud.google.com/kubernetes-engine/fleet-management/docs/use-workload-identity) (Fleet Workload Identity), the Helm chart would just need the required annotations, similar to the existing ECR [iamRoleArn](https://github.com/jetstack/version-checker/blob/3606a614574beb8e1e4b7112b8694bb21f926a7c/deploy/charts/version-checker/templates/serviceaccount.yaml#L4-L6) annotation.
---
**Message from the maintainers**:
If you wish to see this enhancement implemented please add a 👍 reaction to this issue! We often sort issues this way to know what to prioritize.
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.