Skip to content

feat: initial image cred plugin integration#184

Open
porridge wants to merge 4 commits intomasterfrom
porridge-cred-plugin
Open

feat: initial image cred plugin integration#184
porridge wants to merge 4 commits intomasterfrom
porridge-cred-plugin

Conversation

@porridge
Copy link
Copy Markdown
Collaborator

@porridge porridge commented Apr 14, 2026

This change enables basic kubelet credential provider plugin integration.

  • deploy has a new flag --use-kubelet-image-credential-integration=MODE which in turns causes the prefetcher deployment to mount config and plugin binaries from the host.
  • If configured, plugin credentials are fetched dynamically and tried for the images configured in the CredentialProviderConfig before pull secrets.
  • tested in fix(ci): work around preloaded image use problem in recent k8s stackrox#19287

Caveats:

  • Currently only supports mode GKE, which uses /etc/srv/kubernetes/cri_auth_config.yaml for config and /home/kubernetes/bin for binaries.
  • Caching is not considered at all, the plugin is simply executed every time it's needed.

AI-assisted

@mclasmeier
Copy link
Copy Markdown

A high-level PR description would be nice.

@porridge
Copy link
Copy Markdown
Collaborator Author

A high-level PR description would be nice.

Done.

return config, nil
}

// Lookup is like Lookup(context.Background(), ...).
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// Lookup is like Lookup(context.Background(), ...).
// Lookup is like LookupWithCtx(context.Background(), ...).

}

// LookupForKeyring returns credentials formatted for the DockerKeyring interface.
func (kr *PluginKeyring) LookupForKeyring(image string) DockerConfig {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like this is never used.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants