Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[RFC-0003] Add the provider field for OIDC auth #2951

Merged
merged 1 commit into from Aug 2, 2022
Merged

[RFC-0003] Add the provider field for OIDC auth #2951

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
19 changes: 10 additions & 9 deletions rfcs/0003-kubernetes-oci/README.md
View file
Open in desktop
Expand Up @@ -4,7 +4,7 @@

**Creation date:** 2022-03-31

**Last update:** 2022-07-06
**Last update:** 2022-08-02

## Summary

Expand Down Expand Up @@ -192,16 +192,17 @@ kubectl create secret generic regcert \
When Flux runs on AKS, EKS or GKE, an IAM role (that grants read-only access to ACR, ECR or GCR)
can be used to bind the `source-controller` to the IAM role.

Similar to image-reflector-controller
[auto-login feature](https://fluxcd.io/docs/guides/image-update/#imagerepository-cloud-providers-authentication),
source-controller will expose dedicated flags for each cloud provider:

```sh
--aws-autologin-for-ecr
--azure-autologin-for-acr
--gcp-autologin-for-gcr
```yaml
spec:
provider: aws
```

The provider accepts the following values: `generic`, `aws`, `azure` and `gcp`. When the provider is
not specified, it defaults to `generic`. When the provider is set to `aws`, `azure` or `gcp`, the
controller will use a specific cloud SDK for authentication purposes. If both `spec.secretRef` and
a non-generic provider are present in the definition, the controller will use the static credentials
from the referenced secret.

### Reconcile artifacts

The `OCIRepository` can be used as a drop-in replacement for `GitRepository` and `Bucket` sources.
Expand Down