jetstack / jetstack/version-checker

Support for GCP Service Account with Workload Identity for GCR Artifact Registry

オープン
#220 コメント 3 件 リアクション 1 件 担当者 1 名 @davidcollom が担当を希望しています GitHub で見る
enhancement
主要言語
Go
スター
778
フォーク
82
平均マージ
2分
マージ済み PR(30日)
3

説明

Currently, version-checker only supports [basic authentication](https://github.com/jetstack/version-checker/blob/efca612c64483c7873528a1135ad7149e82cccba/pkg/client/gcr/gcr.go#L63), which limits the available methods for authenticating against GCR/GAR.

Deploying version-checker on GKE clusters would be significantly more secure if it could leverage [Google ADC](https://cloud.google.com/docs/authentication/provide-credentials-adc#containerized). This would allow us to stop using static service account keys in production environments, enabling deployments to use cluster metadata for accessing Google private registries.

If version-checker could support GCP [Service Accounts with Workload Identity](url) on [GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) and [GKE Enterprise](https://cloud.google.com/kubernetes-engine/fleet-management/docs/use-workload-identity) (Fleet Workload Identity), the Helm chart would just need the required annotations, similar to the existing ECR [iamRoleArn](https://github.com/jetstack/version-checker/blob/3606a614574beb8e1e4b7112b8694bb21f926a7c/deploy/charts/version-checker/templates/serviceaccount.yaml#L4-L6) annotation.

---

**Message from the maintainers**:

If you wish to see this enhancement implemented please add a 👍 reaction to this issue! We often sort issues this way to know what to prioritize.

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。