msi-acrpull

command module
v0.1.0-alpha Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 15, 2020 License: MIT Imports: 9 Imported by: 0

README

MSI ACR Pull

MSI ACR Pull enables deployments in a Kubernetes cluster to use any user assigned managed identity to pull images from Azure container registry. With this, each application can use its own identity to pull container images.

How it works

The architecture looks like below. As an user you will create a custom resource ACRPullBinding, which binds a managed identity (using client ID or resource ID) to an Azure container registry (using its FQDN).

Internally, the ACRPullBindingController watches the ACRPullBinding resource, and for each of them, create a secret in the namespace. The secret content is a Docker image pull config, and the password is the ACR access token that the controller exchanged from ACR using managed identity. The secret will be refreshed 30min before it expire automatically. The controller will also associate the secret to the specified service account in namespace (by default, use the default service account). With this, any pods created in the namespace will automatically pull images from the ACR using the specified managed identity credential.

Diagram

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Documentation

The Go Gopher

There is no documentation for this package.

Directories

Path Synopsis
api
v1beta1
Package v1beta1 contains API Schema definitions for the msiacrpull v1beta1 API group +kubebuilder:object:generate=true +groupName=msi-acrpull.microsoft.com
Package v1beta1 contains API Schema definitions for the msiacrpull v1beta1 API group +kubebuilder:object:generate=true +groupName=msi-acrpull.microsoft.com
pkg
authorizer/mock_authorizer
Package mock_authorizer is a generated GoMock package.
Package mock_authorizer is a generated GoMock package.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL