Add docs for autologin(ACR/ECR/GCR) #702

somtochiama · 2022-01-11T13:03:55Z

This pull request adds documentation for GCR/ACR auto-login Integration and also moves the docs on using cron jobs to a separate page.

Part of: fluxcd/flux2#2308

Signed-off-by: Somtochi Onyekwere somtochionyekwere@gmail.com

Signed-off-by: Somtochi Onyekwere <somtochionyekwere@gmail.com>

kingdonb · 2022-01-14T14:06:32Z

I'm testing the Google Cloud Workload Identity work, I ran into this error applying one of the patches from these examples:

02-gke-cluster-1      	False	kustomize build failed: add operation does not apply: doc is missing path: "/metadata/annotations/spec/": missing value	                                                   	False

I suspect it would work fine if I had used patchesStrategicMerge instead: kubernetes-sigs/kustomize#2986 (comment)

tl;dr from the link above, json patch 6902 cannot really be used to add a path that does not exist, if you have a hash then you can add a field to it, but if there is no hash "annotations" which I think there generally isn't, it will not be created in a json patch. Maybe this works if you annotate the service account by hand with the gcloud CLI, I'm still new at this.

I tried this patch instead and it worked:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- gotk-components.yaml
- gotk-sync.yaml
patches:
- target:
    version: v1
    group: apps
    kind: Deployment
    name: image-reflector-controller
    namespace: flux-system
  patch: |-
    - op: add
      path: /spec/template/spec/containers/0/args/-
      value: --gcp-autologin-for-gcr
patchesStrategicMerge:
- |-
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: image-reflector-controller
    namespace: flux-system
    annotations:
      iam.gke.io/gcp-service-account: kingdon-test-gcr-sa@dx-kingdon.iam.gserviceaccount.com
images: # []
- name: ghcr.io/fluxcd/image-reflector-controller
  newName: docker.io/somma/image-reflector-controller
  newTag: test-autologin-18df01042

I'm sending you some corrections for the issues I ran into 👍 the good news is, I was able to confirm the GKE workload identity can access my gcr.io/dx-kingdon/podinfo private repository and sync tags without issue:

$ flux get image repository
NAME   	READY	MESSAGE                      	LAST SCAN                	SUSPENDED
podinfo	True 	successful scan, found 2 tags	2022-01-14T09:02:47-05:00	False

I know I'm annotating the SA correctly now, because when it was incorrect I got a 400 "bad request" error. There is a . instead of an @ in your example annotation. I found references to all of the correct information in the guide you linked here (the example you gave there is also looks to be more correct):

Get credentials from GCP/Azure when needed image-reflector-controller#194 (comment)

kingdonb · 2022-01-14T14:22:31Z

This is great work

It gets a 👍 from me, please note the suggestions I've made after testing GKE Workload Identity.

I'm going to grab the actual roles I assigned through the wizard and bring them back here so we can review them, also give the "artifact registry" a try since I've been able to get through "container registry" with Workload Identity and overcome all of the IAM hurdles, I think they are actually a different permission set, and that's what I'm hyper-focusing on here now.

If there are different role-permissions required for the SA to access Artifact Registry and Container Registry, then we should mention both roles in the doc.

kingdonb

👍 please adopt the suggestions or LMK if there are other changes

I am really pleased that I was able to make this work, it was not easy, but the information in this comment was super concise and very helpful to my overall understanding here:

Get credentials from GCP/Azure when needed image-reflector-controller#194 (comment)

content/en/docs/guides/image-update.md

content/en/docs/guides/cron-job-image-auth.md

content/en/docs/guides/image-update.md

kingdonb · 2022-01-14T14:42:50Z

I can adopt this branch myself, and reissue it with my suggestions incorporated as a new PR (if that helps!)

stefanprodan · 2022-01-14T14:50:06Z

@somtochiama please add @kingdonb to your fork so he can push to to your branch.

somtochiama · 2022-01-14T15:01:01Z

@kingdonb I have sent out an invite to my fork of this repo

When fluxcd/website#702 merges, this patch will have been incorporated into the Image Update Guide. Add a link to the more directly relevant Image Update Guide here instead, since it has the example, and it doesn't belong in the API docs nor need to be repeated here, per the discussion from the earlier PR number fluxcd#193. Signed-off-by: Kingdon Barrett <kingdon@weave.works>

Workload Identity (the same link repeated from cron-job-image-auth.md) Signed-off-by: Kingdon Barrett <kingdon@weave.works>

kingdonb

👍 LGTM

kingdonb · 2022-01-14T15:25:05Z

My approval is pending the merge of the following PR:

Get credentials from GCP/Azure when needed image-reflector-controller#194

The draft status of this PR reflects that the depended on PR has not been merged yet.

content/en/docs/guides/cron-job-image-auth.md

Co-authored-by: Stefan Prodan <stefan.prodan@gmail.com> Signed-off-by: Kingdon Barrett <kingdon@weave.works>

Squashed commits: follow the convention of using footer-style links I noticed that some links might not be good, and all of the new links added in this PR were not following the convention of link targets in the footer. Correct those issues. Signed-off-by: Kingdon Barrett <kingdon@weave.works> Update docs/spec/v1beta1/imagerepositories.md Signed-off-by: Kingdon Barrett <kingdon@weave.works> update docs Signed-off-by: Kingdon Barrett <kingdon@weave.works> Link to the Image Update guide When fluxcd/website#702 merges, this patch will have been incorporated into the Image Update Guide. Add a link to the more directly relevant Image Update Guide here instead, since it has the example, and it doesn't belong in the API docs nor need to be repeated here, per the discussion from the earlier PR number fluxcd#193. Signed-off-by: Kingdon Barrett <kingdon@weave.works> remove orphaned link URLs Signed-off-by: Kingdon Barrett <kingdon@weave.works>

Link to the Image Update guide When fluxcd/website#702 merges, this patch will have been incorporated into the Image Update Guide. Add a link to the more directly relevant Image Update Guide here instead, since it has the example, and it doesn't belong in the API docs nor need to be repeated here, per the discussion from the earlier PR number fluxcd#193. Signed-off-by: Kingdon Barrett <kingdon@weave.works> remove orphaned link URLs Signed-off-by: Kingdon Barrett <kingdon@weave.works> Signed-off-by: Kingdon Barrett <yebyen@gmail.com>

stefanprodan · 2022-02-01T10:43:35Z

content/en/docs/guides/cron-job-image-auth.md

@@ -0,0 +1,377 @@
+---
+title: "How to use cron jobs to sync image repository credentials"
+linkTitle: "cron jobs for image repository cretentions"


Suggested change

linkTitle: "cron jobs for image repository cretentions"

linkTitle: "Configure image automation authentication"

stefanprodan · 2022-02-01T10:43:47Z

content/en/docs/guides/cron-job-image-auth.md

@@ -0,0 +1,377 @@
+---
+title: "How to use cron jobs to sync image repository credentials"


Suggested change

title: "How to use cron jobs to sync image repository credentials"

title: "Configure image automation authentication"

stefanprodan

LGTM

I'll make the title changes in another PR.

Add docs for autologin(GCR/ACR)

f83ca0d

Signed-off-by: Somtochi Onyekwere <somtochionyekwere@gmail.com>

stefanprodan added the area/docs Documentation related issues and pull requests label Jan 11, 2022

stefanprodan changed the title ~~Add docs for autologin(GCR/ACR)~~ Add docs for autologin(ACR/ECR/GCR) Jan 11, 2022

Add correct links

9bd9053

Signed-off-by: Somtochi Onyekwere <somtochionyekwere@gmail.com>

kingdonb requested changes Jan 14, 2022

View reviewed changes

content/en/docs/guides/image-update.md Outdated Show resolved Hide resolved

content/en/docs/guides/image-update.md Outdated Show resolved Hide resolved

content/en/docs/guides/cron-job-image-auth.md Show resolved Hide resolved

content/en/docs/guides/image-update.md Show resolved Hide resolved

kingdonb mentioned this pull request Jan 14, 2022

Elaborate on how to enable autologin for ECR fluxcd/image-reflector-controller#193

Closed

kingdonb mentioned this pull request Jan 14, 2022

Clarify ECR Auto-login note, fix CanonicalImageName typos fluxcd/image-reflector-controller#219

Merged

Provide reference documentation about GKE feature

1f9240b

Workload Identity (the same link repeated from cron-job-image-auth.md) Signed-off-by: Kingdon Barrett <kingdon@weave.works>

kingdonb force-pushed the gcr-acr-autologin branch from 56a4e13 to 1f9240b Compare January 14, 2022 15:21

kingdonb approved these changes Jan 14, 2022

View reviewed changes

stefanprodan reviewed Jan 14, 2022

View reviewed changes

content/en/docs/guides/cron-job-image-auth.md Outdated Show resolved Hide resolved

Update content/en/docs/guides/cron-job-image-auth.md

7eb2fe2

Co-authored-by: Stefan Prodan <stefan.prodan@gmail.com> Signed-off-by: Kingdon Barrett <kingdon@weave.works>

kingdonb force-pushed the gcr-acr-autologin branch from 8850aca to 7eb2fe2 Compare January 14, 2022 15:31

makkes mentioned this pull request Jan 31, 2022

Prepare Flux v0.26.0 release fluxcd/flux2#2308

Closed

24 tasks

stefanprodan requested changes Feb 1, 2022

View reviewed changes

stefanprodan marked this pull request as ready for review February 1, 2022 10:58

stefanprodan approved these changes Feb 1, 2022

View reviewed changes

stefanprodan merged commit 3ac53ea into fluxcd:main Feb 1, 2022

kingdonb mentioned this pull request Feb 11, 2022

Add changelog references to image reflector docs #755

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add docs for autologin(ACR/ECR/GCR) #702

Add docs for autologin(ACR/ECR/GCR) #702

somtochiama commented Jan 11, 2022 •

edited by stefanprodan

Loading

kingdonb commented Jan 14, 2022

kingdonb commented Jan 14, 2022

kingdonb left a comment

kingdonb commented Jan 14, 2022

stefanprodan commented Jan 14, 2022

somtochiama commented Jan 14, 2022

kingdonb left a comment

kingdonb commented Jan 14, 2022

stefanprodan Feb 1, 2022

stefanprodan Feb 1, 2022

stefanprodan left a comment

	linkTitle: "cron jobs for image repository cretentions"
	linkTitle: "Configure image automation authentication"

		@@ -0,0 +1,377 @@
		---
		title: "How to use cron jobs to sync image repository credentials"

	title: "How to use cron jobs to sync image repository credentials"
	title: "Configure image automation authentication"

Add docs for autologin(ACR/ECR/GCR) #702

Add docs for autologin(ACR/ECR/GCR) #702

Conversation

somtochiama commented Jan 11, 2022 • edited by stefanprodan Loading

kingdonb commented Jan 14, 2022

kingdonb commented Jan 14, 2022

kingdonb left a comment

Choose a reason for hiding this comment

kingdonb commented Jan 14, 2022

stefanprodan commented Jan 14, 2022

somtochiama commented Jan 14, 2022

kingdonb left a comment

Choose a reason for hiding this comment

kingdonb commented Jan 14, 2022

stefanprodan Feb 1, 2022

Choose a reason for hiding this comment

stefanprodan Feb 1, 2022

Choose a reason for hiding this comment

stefanprodan left a comment

Choose a reason for hiding this comment

somtochiama commented Jan 11, 2022 •

edited by stefanprodan

Loading