actions/fluxcd-flux2
3
0
Fork 0
mirror of https://github.com/fluxcd/flux2.git synced 2026-02-23 16:11:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add auto-login feature

Browse source 
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This commit is contained in:
Stefan Prodan 2022-04-01 11:12:26 +03:00
parent 0fc582d6fd
commit 183b9a7ee0
No known key found for this signature in database
GPG key ID: 3299AEB0E4085BAF
1 changed files with 30 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
rfcs/kubernetes-oci/README.md
View file

@ -83,7 +83,23 @@ spec:
semver: "6.0.x" semver: "6.0.x"
``` ```
For private repositories, the credentials can be supplied with: To verify the authenticity of an artifact, the Sigstore cosign public key can be supplied with:
```yaml
spec:
verify:
provider: cosign
secretRef:
name: cosign-key
```
### Pull artifacts from private repositories
For authentication purposes, Flux users can choose between supplying static credentials with Kubernetes secrets
and cloud-based OIDC using an IAM role binding to the source-controller Kubernetes service account.
For private repositories hosted on DockerHub, GitHub, Quay, self-hosted Docker Registry and others,
the credentials can be supplied with:
```yaml ```yaml
spec: spec:
@ -94,16 +110,22 @@ spec:
The `secretRef` points to a Kubernetes secret in the same namespace as the `OCIRepository`, The `secretRef` points to a Kubernetes secret in the same namespace as the `OCIRepository`,
the secret type must be `kubernetes.io/dockerconfigjson`. the secret type must be `kubernetes.io/dockerconfigjson`.
To verify the authenticity of an artifact, the Sigstore cosign public key can be supplied with: When Flux runs on EKS or GKE, an IAM role (that grants read-only access to ACR, ECR or GCR)
can be used to bind the `source-controller` to the IAM role.
```yaml Similar to image-reflector-controller
spec: [auto-login feature](https://fluxcd.io/docs/guides/image-update/#imagerepository-cloud-providers-authentication),
verify: source-controller will expose dedicated flags for each cloud provider:
provider: cosign
secretRef: ```sh
name: cosign-key --aws-autologin-for-ecr
--azure-autologin-for-acr
--gcp-autologin-for-gcr
``` ```
We should extract the flags and the AWS, Azure and GCP auth implementations from image-reflector-controller into
`fluxcd/pkg/oci/auth` to reuses the code in source-controller.
### Reconcile artifacts ### Reconcile artifacts
The `OCIRepository` can be used as a drop-in replacement for `GitRepository` and `Bucket` sources. The `OCIRepository` can be used as a drop-in replacement for `GitRepository` and `Bucket` sources.