Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cosigned should use k8schain to support imagePullSecrets #801

Closed
mattmoor opened this issue Sep 25, 2021 · 0 comments · Fixed by #804
Closed

cosigned should use k8schain to support imagePullSecrets #801

mattmoor opened this issue Sep 25, 2021 · 0 comments · Fixed by #804
Labels
bug Something isn't working

Comments

@mattmoor
Copy link
Member

Description

cosigned needs to be able to access the container images stored on registries, and one of the common forms of authentication is to use imagePullSecrets (possibly attached to the workload's service account), which isn't currently supported by cosigned.

There is a library for supporting this with GGCR, which is used by Tekton and Knative called k8schain, which cosigned should probably adopt (until something better comes along).
@mattmoor mattmoor added the bug Something isn't working label Sep 25, 2021
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 26, 2021
@mattmoor
Integrate k8schain to authenticate digest resolution.
e87d6e7 
`k8schain` implements a GGCR keychain that attempts to replicate the authentication done by the kubelet when pulling container images.  It supports ambient credentials (e.g. GCE/AWS's `http://metadata`) as well as `imagePullSecret` resolution, and is also currently used by Tekton and Knative for similar purposes.

Fixes: sigstore#801
Signed-off-by: Matt Moore <mattomata@gmail.com>
@mattmoor mattmoor mentioned this issue Sep 26, 2021
Merged
mattmoor added a commit that referenced this issue Sep 27, 2021
@mattmoor
Integrate k8schain to authenticate digest resolution. (#804)
a42b124 
`k8schain` implements a GGCR keychain that attempts to replicate the authentication done by the kubelet when pulling container images.  It supports ambient credentials (e.g. GCE/AWS's `http://metadata`) as well as `imagePullSecret` resolution, and is also currently used by Tekton and Knative for similar purposes.

Fixes: #801
Signed-off-by: Matt Moore <mattomata@gmail.com>
mrjoelkamp pushed a commit to mrjoelkamp/cosign that referenced this issue Sep 27, 2021
@mattmoor
Integrate k8schain to authenticate digest resolution. (sigstore#804)
9eea891 
`k8schain` implements a GGCR keychain that attempts to replicate the authentication done by the kubelet when pulling container images.  It supports ambient credentials (e.g. GCE/AWS's `http://metadata`) as well as `imagePullSecret` resolution, and is also currently used by Tekton and Knative for similar purposes.

Fixes: sigstore#801
Signed-off-by: Matt Moore <mattomata@gmail.com>
Signed-off-by: Joel Kamp <joel.kamp@invitae.com>
mrjoelkamp pushed a commit to mrjoelkamp/cosign that referenced this issue Sep 28, 2021
@mattmoor
Integrate k8schain to authenticate digest resolution. (sigstore#804)
025a759 
`k8schain` implements a GGCR keychain that attempts to replicate the authentication done by the kubelet when pulling container images.  It supports ambient credentials (e.g. GCE/AWS's `http://metadata`) as well as `imagePullSecret` resolution, and is also currently used by Tekton and Knative for similar purposes.

Fixes: sigstore#801
Signed-off-by: Matt Moore <mattomata@gmail.com>
Signed-off-by: Joel Kamp <joel.kamp@invitae.com>
mrjoelkamp pushed a commit to mrjoelkamp/cosign that referenced this issue Sep 28, 2021
@mattmoor
Integrate k8schain to authenticate digest resolution. (sigstore#804)
f986ddb 
`k8schain` implements a GGCR keychain that attempts to replicate the authentication done by the kubelet when pulling container images.  It supports ambient credentials (e.g. GCE/AWS's `http://metadata`) as well as `imagePullSecret` resolution, and is also currently used by Tekton and Knative for similar purposes.

Fixes: sigstore#801
Signed-off-by: Matt Moore <mattomata@gmail.com>
Signed-off-by: Joel Kamp <joel.kamp@invitae.com>
@tcnghia tcnghia mentioned this issue Mar 24, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Integrate k8schain to authenticate digest resolution. mattmoor/cosign
1 participant
@mattmoor