search

GoogleContainerTools / kpt-config-sync

Config Sync - used to sync Git, OCI and Helm charts to your clusters.
Apache License 2.0
244 stars 43 forks source link

Feature: support OCI signature verification by setting the `configsync.gke.io/image-to-sync` annotation in RSync #1452

Closed tiffanny29631 closed 4 weeks ago

google-oss-prow[bot] commented 1 month ago

Skipping CI for Draft Pull Request. If you want CI signal for your change, please convert it to an actual PR. You can still manually trigger a test run with /test all

nan-yu commented 1 month ago

My browser crashed a few times after trying to leave inline comments.

One comment about the getGoogleAccessToken function in test/docker/presync-webhook-server/oci-signature-verification-server.go: it uses the go IAM credentials API library, which is specifically for impersonating service accounts. That requires explicitly specifying the service account you want to impersonate, e2e-test-ar-reader@peip-monitor.iam.gserviceaccount.com and using its credentials to generate an access token. This is not flexible enough, especially with the support of BYOID in OCI, which doesn't need to impersonate a GSA.

A more common and recommended approach is to use google.FindDefaultCredentials, which implements Google's Application Default Credentials (ADC) strategy. It automatically searches for credentials in a predefined order:

This makes the code more portable and allows it to run in different environements.

ts, err := googauth.DefaultTokenSource(context.Background(), cloudPlatformScope)
    if err != nil {
        return nil, err
    }

    token, err := ts.Token()
    if err != nil {
        return nil, err
    }

    return &tokenSourceAuth{oauth2.ReuseTokenSource(token, ts)}, nil

The go-containerregistry library wraps it with a NewEnvAuthenticator function. You can use it in your webhook implementation by replacing remote.WithAuthFromKeychain(keychain) with remote.WithAuthFromKeychain(google.NewEnvAuthenticator()).

tiffanny29631 commented 1 month ago

re @nan-yu google authentication is simplified with one of the recent commits.

google-oss-prow[bot] commented 4 weeks ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nan-yu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/GoogleContainerTools/kpt-config-sync/blob/main/OWNERS)~~ [nan-yu] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment