Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: mirror credentials support in DynamicCredentialProviderConfig #359

Merged
merged 1 commit into from
Feb 14, 2024
Merged

fix: mirror credentials support in DynamicCredentialProviderConfig #359

merged 1 commit into from
Feb 14, 2024

Conversation

supershal
Copy link
Contributor

@supershal supershal commented Feb 13, 2024 •
edited
Loading

Fixes : #329 (Support for mirror credentials for "globalImageRegistryMirror")

  • Adds mirror configuration in DynamicCredentialsConfig
    e.g.
apiVersion: credentialprovider.d2iq.com/v1alpha1
kind: DynamicCredentialProviderConfig
mirror:
  endpoint: mymirror.com
  credentialsStrategy: MirrorCredentialsOnly
credentialProviderPluginBinDir: /etc/kubernetes/image-credential-provider/
...
  • reads mirror credentials from secret and add its provider configuration in DynamiCredentialsProviderConfig if provided
    e.g.
apiVersion: credentialprovider.d2iq.com/v1alpha1
kind: DynamicCredentialProviderConfig
mirror:
  endpoint: mymirror.com
  credentialsStrategy: MirrorCredentialsOnly
credentialProviderPluginBinDir: /etc/kubernetes/image-credential-provider/
credentialProviders:
  apiVersion: kubelet.config.k8s.io/v1
  kind: CredentialProviderConfig
  providers:
  - name: static-credential-provider
    matchImages:
      - mymirror.com
    defaultCacheDuration: "0s"
    apiVersion: credentialprovider.kubelet.k8s.io/v1
  - name: static-credential-provider
    matchImages:
      - "docker.io"
    defaultCacheDuration: "0s"
    apiVersion: credentialprovider.kubelet.k8s.io/v1

@supershal supershal self-assigned this Feb 13, 2024
@github-actions github-actions bot added the fix label Feb 13, 2024
@github-actions github-actions bot added fix and removed fix labels Feb 13, 2024
dkoshkin
dkoshkin approved these changes Feb 14, 2024
View reviewed changes
Copy link
Contributor

@dkoshkin dkoshkin left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nicely done!

@dkoshkin dkoshkin merged commit f2ca745 into main Feb 14, 2024
15 checks passed
@dkoshkin dkoshkin deleted the shalin/mirror-creds branch February 14, 2024 01:46
@github-actions github-actions bot mentioned this pull request Feb 13, 2024
Merged
dkoshkin pushed a commit that referenced this pull request Feb 14, 2024
@github-actions
release(main): v0.4.1 (#357)
17fa13f 
🤖 I have created a release *beep* *boop*
---


## 0.4.1 (2024-02-14)

<!-- Release notes generated using configuration in .github/release.yaml
at main -->

## What's Changed
### Fixes 🔧
* fix: mirror credentials support in DynamicCredentialProviderConfig by
@supershal in
#359
### Other Changes
* ci: Ignore devbox update PRs in release notes by @jimmidyson in
#356
* build: Add v0.4 series to provider metadata by @jimmidyson in
#358


**Full Changelog**:
v0.4.0...v0.4.1

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@dkoshkin dkoshkin mentioned this pull request Feb 14, 2024
Merged
dkoshkin added a commit that referenced this pull request Feb 15, 2024
@dkoshkin
fix: generate config with only globalImageRegistryMirror set (#362)
9f81d40 
Follow up to
#359

I noticed that when the only setting `globalImageRegistryMirror` without
`imageRegistries` that the credential provider configs were not being
generated.

Tested locally and verified in the Docker container :
```
kubectl get kubeadmconfig.bootstrap.cluster.x-k8s.io/docker-quick-start-helm-addon-cilium-dgz8d-dk7c5 -o yaml | grep "path:"
        audit-log-path: /var/log/audit/kube-apiserver-audit.log
    path: /etc/kubernetes/audit-policy/apiserver-audit-policy.yaml
    path: /etc/konvoy/install-kubelet-credential-providers.sh
    path: /etc/kubernetes/image-credential-provider-config.yaml
    path: /etc/kubernetes/dynamic-credential-provider-config.yaml
    path: /etc/kubernetes/static-image-credentials.json
    path: /etc/containerd/certs.d/_default/hosts.toml
```

```
root@docker-quick-start-helm-addon-cilium-md-0-7zv45-plbrx-wv86j:/# ls -lat /etc/kubernetes/
total 44
drwxr-xr-x 1 root root 4096 Feb 14 23:02 ..
drwxr-xr-x 1 root root 4096 Feb 14 22:59 .
drwxr-xr-x 4 root root 4096 Feb 14 22:59 node-feature-discovery
-rw------- 1 root root 1911 Feb 14 22:59 kubelet.conf
drwxr-xr-x 2 root root 4096 Feb 14 22:59 pki
drwxr-xr-x 2 root root 4096 Feb 14 22:59 image-credential-provider
-rw------- 1 root root  248 Feb 14 22:59 static-image-credentials.json
-rw------- 1 root root  694 Feb 14 22:59 dynamic-credential-provider-config.yaml
-rw------- 1 root root  383 Feb 14 22:59 image-credential-provider-config.yaml
drwxr-xr-x 2 root root 4096 May 25  2023 manifests
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dkoshkin dkoshkin dkoshkin approved these changes

@jimmidyson jimmidyson Awaiting requested review from jimmidyson

Assignees

@supershal supershal

Labels
fix
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Support for mirror credentials for "globalImageRegistryMirror"
2 participants
@supershal @dkoshkin