Mirrors/flux2
1
0
Fork 0
mirror of synced 2026-02-14 05:26:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add client certificate authentication

Browse Source 
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This commit is contained in:
Stefan Prodan
2022-04-12 17:53:08 +03:00
parent 183b9a7ee0
commit 8a7c94180b
1 changed files with 32 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
rfcs/kubernetes-oci/README.md
View File

@@ -110,7 +110,25 @@ spec:
The `secretRef` points to a Kubernetes secret in the same namespace as the `OCIRepository`, The `secretRef` points to a Kubernetes secret in the same namespace as the `OCIRepository`,
the secret type must be `kubernetes.io/dockerconfigjson`. the secret type must be `kubernetes.io/dockerconfigjson`.
When Flux runs on EKS or GKE, an IAM role (that grants read-only access to ACR, ECR or GCR) For private repositories which require a certificate to authenticate,
the client certificate, private key and the CA certificate (if self-signed), can be provided with:
```yaml
spec:
certSecretRef:
name: regcert
```
The `certSecretRef` points to a Kubernetes secret in the same namespace as the `OCIRepository`:
```shell
kubectl create secret generic regcert \
--from-file=certFile=client.crt \
--from-file=keyFile=client.key \
--from-file=caFile=ca.crt
```
When Flux runs on AKS, EKS or GKE, an IAM role (that grants read-only access to ACR, ECR or GCR)
can be used to bind the `source-controller` to the IAM role. can be used to bind the `source-controller` to the IAM role.
Similar to image-reflector-controller Similar to image-reflector-controller
@@ -126,6 +144,19 @@ source-controller will expose dedicated flags for each cloud provider:
We should extract the flags and the AWS, Azure and GCP auth implementations from image-reflector-controller into We should extract the flags and the AWS, Azure and GCP auth implementations from image-reflector-controller into
`fluxcd/pkg/oci/auth` to reuses the code in source-controller. `fluxcd/pkg/oci/auth` to reuses the code in source-controller.
### Pull artifacts from self-hosted repositories
For self-hosted Docker registries where the API is exposed with a self-signed TLS certificate,
the CA certificate and private key can be provided with:
```yaml
spec:
secretRef:
name: regcred
```
### Reconcile artifacts ### Reconcile artifacts
The `OCIRepository` can be used as a drop-in replacement for `GitRepository` and `Bucket` sources. The `OCIRepository` can be used as a drop-in replacement for `GitRepository` and `Bucket` sources.