Documentation
¶
Overview ¶
Package credentialprovider resolves registry credentials by invoking kubelet image credential provider plugins (https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/).
Reusing the kubelet's contract keeps atelet free of any cloud SDK: the same binary authenticates to Artifact Registry on GKE and to ECR on EKS, using whichever plugin its node ships. The plugin and its config reach atelet as read-only host mounts; see manifests/ate-install/atelet.yaml.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Keychain ¶
type Keychain struct {
// contains filtered or unexported fields
}
Keychain is a go-containerregistry authn.Keychain backed by kubelet image credential provider plugins. It is safe for concurrent use.
func New ¶
New loads the CredentialProviderConfig at configPath and resolves each provider's executable inside binDir. Both mirror the kubelet flags of the same name; pointing atelet at the node's values makes it authenticate like that node's kubelet.
func (*Keychain) Candidates ¶
func (k *Keychain) Candidates(ctx context.Context, target authn.Resource) ([]authn.Authenticator, error)
Candidates returns the credentials of all providers matching target, in the order to try them: most specific auth key first, then config order. Failing providers are logged and skipped, like the kubelet.
func (*Keychain) ResolveContext ¶
func (k *Keychain) ResolveContext(ctx context.Context, target authn.Resource) (authn.Authenticator, error)
ResolveContext implements authn.ContextKeychain. It returns the first candidate, or authn.Anonymous if there are none.
Source Files