jetstack / jetstack/version-checker
Support for GCP Service Account with Workload Identity for GCR Artifact Registry
- Lingua principale
- Go
- Stelle
- 778
- Fork
- 82
- Merge medio
- 2m
- PR unite (30g)
- 3
Descrizione
Currently, version-checker only supports [basic authentication](https://github.com/jetstack/version-checker/blob/efca612c64483c7873528a1135ad7149e82cccba/pkg/client/gcr/gcr.go#L63), which limits the available methods for authenticating against GCR/GAR.
Deploying version-checker on GKE clusters would be significantly more secure if it could leverage [Google ADC](https://cloud.google.com/docs/authentication/provide-credentials-adc#containerized). This would allow us to stop using static service account keys in production environments, enabling deployments to use cluster metadata for accessing Google private registries.
If version-checker could support GCP [Service Accounts with Workload Identity](url) on [GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) and [GKE Enterprise](https://cloud.google.com/kubernetes-engine/fleet-management/docs/use-workload-identity) (Fleet Workload Identity), the Helm chart would just need the required annotations, similar to the existing ECR [iamRoleArn](https://github.com/jetstack/version-checker/blob/3606a614574beb8e1e4b7112b8694bb21f926a7c/deploy/charts/version-checker/templates/serviceaccount.yaml#L4-L6) annotation.
---
**Message from the maintainers**:
If you wish to see this enhancement implemented please add a 👍 reaction to this issue! We often sort issues this way to know what to prioritize.
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.