GoogleContainerTools/skaffold

Skaffold build using Kaniko on GKE

Open

#4,797 opened on Sep 17, 2020

View on GitHub
 (2 comments) (1 reaction) (0 assignees)Go (1,416 forks)batch import
build/kanikohelp wantedkind/frictionpriority/p1

Repository metrics

Stars
 (12,822 stars)
PR merge metrics
 (Avg merge 3d 6h) (16 merged PRs in 30d)

Description

I'm using Skaffold with a Kaniko build step on GKE and am wondering why the need for the kaniko-secret.

If I'm in GKE and the default SA used has permissions to push to my GCR repo why do I need to also supply SA keys via the kaniko-secret?

I see that things are working without the secret if Workload Identity is enabled but what about clusters not yet migrated to Workload Identity? https://github.com/GoogleContainerTools/skaffold/issues/3468

The only way I found to get it working is with the following instructions and skaffold.yaml.

Instructions:

  1. Create SA with Starage Admin
  2. Download keys
  3. Rename keys to kaniko-secret
  4. kubectl create secret generic kaniko-secret --from-file=kaniko-secret

skaffold.yaml

apiVersion: skaffold/v2beta7
kind: Config
metadata:
  name: my-image
build:
  artifacts:
    - image: gcr.io/my-repo/my-image
      kaniko:
        cache: {}
  cluster:
    pullSecretName: kaniko-secret

How can I make this work with the default SA and not have to add secondary keys?

Contributor guide

Research direction
Investigate how Skaffold handles authentication for Kaniko on GKE, specifically the use of workload identity and service account keys. Look into the `cluster` build config and the `pullSecretName` field to understand if there is a way to use the default node service account without a secret.
Tech stack
go
Domain
devopscloud
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
KubernetesGCP
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65