jetstack / jetstack/version-checker

Support for GCP Service Account with Workload Identity for GCR Artifact Registry

Abierto
#220 3 comentarios 1 reacción 1 asignado Reclamado por @davidcollom Ver en GitHub
enhancement
Lenguaje dominante
Go
Estrellas
778
Forks
82
Merge medio
2 min
PR fusionados (30 d)
3

Descripción

Currently, version-checker only supports [basic authentication](https://github.com/jetstack/version-checker/blob/efca612c64483c7873528a1135ad7149e82cccba/pkg/client/gcr/gcr.go#L63), which limits the available methods for authenticating against GCR/GAR.

Deploying version-checker on GKE clusters would be significantly more secure if it could leverage [Google ADC](https://cloud.google.com/docs/authentication/provide-credentials-adc#containerized). This would allow us to stop using static service account keys in production environments, enabling deployments to use cluster metadata for accessing Google private registries.

If version-checker could support GCP [Service Accounts with Workload Identity](url) on [GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) and [GKE Enterprise](https://cloud.google.com/kubernetes-engine/fleet-management/docs/use-workload-identity) (Fleet Workload Identity), the Helm chart would just need the required annotations, similar to the existing ECR [iamRoleArn](https://github.com/jetstack/version-checker/blob/3606a614574beb8e1e4b7112b8694bb21f926a7c/deploy/charts/version-checker/templates/serviceaccount.yaml#L4-L6) annotation.

---

**Message from the maintainers**:

If you wish to see this enhancement implemented please add a 👍 reaction to this issue! We often sort issues this way to know what to prioritize.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.