jetstack / jetstack/version-checker

[FEATURE] Auto discovery of credentials using image pull secrets for private repos

オープン
#322 コメント 0 件 リアクション 4 件 担当者 0 名 GitHub で見る
enhancement
主要言語
Go
スター
778
フォーク
82
平均マージ
2分
マージ済み PR(30日)
3

説明

**Is your feature request related to a problem? Please describe.**
A cluster may contain pods with images from a large number of private repos (e.g. multi-tenant clusters), where configuring version-checker for each private repo can be quite tedious/possibly a never ending activity.

**Describe the solution you'd like**
Given that pods running in a cluster that are sourced from private repos already have credentials provided, it should be possible to automatically discover the credentials using the pods image pull secrets.

**Describe alternatives you've considered**
Nothing really viable I can think of.

**Additional context**
Given that this requires access to Kubernetes secrets, it should be toggleable on/off in the chart as not everyone may want to grant read access to secrets (or need to). If this feature is accepted, it may also be worth considering supporting OpenShifts [global image pull secret
](https://docs.openshift.com/container-platform/4.16/openshift_images/managing_images/using-image-pull-secrets.html#images-update-global-pull-secret_using-image-pull-secrets) so that any registries configured there can be authenticated to. Again the idea is to make it automatic, so that credentials would not need to be copied to version-checkers helm values file for every private registry/repo.

---

**Message from the maintainers**:

If you wish to see this enhancement implemented please add a 👍 reaction to this issue! We often sort issues this way to know what to prioritize.

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

No files or tests are named. Start by tracing how the project discovers Kubernetes pods and reads its Helm chart configuration, then review the permissions needed for image pull secrets. Done should include an opt-in setting that discovers usable credentials without requiring each registry or repository to be configured manually.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
go, kubernetes
領域
authentication, infrastructure
issue の種類
機能追加
難易度
5/5
見積もり時間
1週間以上
活発さ
停滞
明瞭さ
おおむね明確
初心者へのやさしさ
35/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。