Closed Dermah closed 2 years ago
docker-credential-gcr seems to use golang.org/x/oauth2 version v0.0.0-20210817223510-7df4dd6e12ab, which is a high enough version to support identity federation to get the credentials.
Where do you see this? As far as I can tell, we're on a pretty old version of oauth2. I think we just need to update that.
Ah yep my mistake. I don't do much go, so I misintepreted go's output when installing the binary:
$ go get -u github.com/GoogleCloudPlatform/docker-credential-gcr
go: downloading golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f
...
You're right, the oauth2 library bundled here is older and doesn't support external_account
https://github.com/GoogleCloudPlatform/docker-credential-gcr/blob/7307e104ebc758a766a5f954aef3c9050ac3f336/vendor/golang.org/x/oauth2/google/google.go#L92-L96
@Dermah I believe while moving over to go modules, we pulled in a new enough version of oauth2 for this to work now. Can you try the 2.1.0
release?
I no longer have access to the environment where I was testing this, but it looks like the go modules would have enabled my use case. Thank you for this!
Weird use case, but I'm trying to use
docker-credential-gcr
to authenticate docker client requests tous-docker.pkg.dev
from an AWS instance that can generate Google credentials using Identity Federation.From that documentation, I've used the command given (with the relevant variables replaced for my account):
This generates a JSON file that I thought could be used as the
GOOGLE_APPLICATION_CREDENTIALS
key:When I set the
GOOGLE_APPLICATION_CREDENTIALS
environment variable to the location of this key file and try to pull an image I get this errorI'm assuming this is because
docker-credential-gcr
doesn't support"type": "external_account"
JSON file keys:Note I have been able to pull the above image on this AWS instance when I gave the helper a
"type": "service_account"
JSON file key for a service account downloaded from the console.docker-credential-gcr
seems to usegolang.org/x/oauth2
versionv0.0.0-20210817223510-7df4dd6e12ab
, which is a high enough version to support identity federation to get the credentials. Am I doing something else wrong?