jetstack / jetstack/version-checker
Support for GCP Service Account with Workload Identity for GCR Artifact Registry
- Langage dominant
- Go
- Étoiles
- 778
- Forks
- 82
- Merge moyen
- 2 min
- PR mergées (30 j)
- 3
Description
Currently, version-checker only supports [basic authentication](https://github.com/jetstack/version-checker/blob/efca612c64483c7873528a1135ad7149e82cccba/pkg/client/gcr/gcr.go#L63), which limits the available methods for authenticating against GCR/GAR.
Deploying version-checker on GKE clusters would be significantly more secure if it could leverage [Google ADC](https://cloud.google.com/docs/authentication/provide-credentials-adc#containerized). This would allow us to stop using static service account keys in production environments, enabling deployments to use cluster metadata for accessing Google private registries.
If version-checker could support GCP [Service Accounts with Workload Identity](url) on [GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) and [GKE Enterprise](https://cloud.google.com/kubernetes-engine/fleet-management/docs/use-workload-identity) (Fleet Workload Identity), the Helm chart would just need the required annotations, similar to the existing ECR [iamRoleArn](https://github.com/jetstack/version-checker/blob/3606a614574beb8e1e4b7112b8694bb21f926a7c/deploy/charts/version-checker/templates/serviceaccount.yaml#L4-L6) annotation.
---
**Message from the maintainers**:
If you wish to see this enhancement implemented please add a 👍 reaction to this issue! We often sort issues this way to know what to prioritize.
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.