Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support BYO credential helpers #800

Open
ollypom opened this issue Feb 8, 2024 · 0 comments
Open

Support BYO credential helpers #800

ollypom opened this issue Feb 8, 2024 · 0 comments
Labels
enhancement New feature or request feature_request New Feature Request for Finch

Comments

@ollypom
Copy link
Contributor

ollypom commented Feb 8, 2024

What is the problem you're trying to solve?.
Today Finch only "natively" supports the ecr-login credential helper #462. However there are scenarios where folks may want to use other credential helpers or wrap ecr-login.

Today you can put your own helpers in ~/.finch/cred-helpers and update your DOCKER_CONFIG config.json and everything will be successfully passed into the lima VM, however the BYO credential helper would not be in your path.

$ cat .finch/config.json
{
        "credsStore": "ecr-login-new"
}

$ ls -l .finch/cred-helpers
total 6512
-rwxrwxrwx 1 root root 6668288 Feb  1 13:42 docker-credential-ecr-login
-rwxrwxrwx 1 root root      42 Feb  8 11:24 docker-credential-ecr-login-new

$ finch run 111222333444.dkr.ecr.eu-west-1.amazonaws.com/nginx:latest
WARN[0000] cannot get auth config for authConfigHostname="111222333444.dkr.ecr.eu-west-1.amazonaws.com" (refHostname="111222333444.dkr.ecr.eu-west-1.amazonaws.com")  error="error getting credentials - err: exec: \"docker-credential-ecr-login-new\": executable file not found in $PATH, out: ``"

Today we create a symlink explicitly for the ecr-login provider so that's its in your path.

cmdArr := []string{
`export DOCKER_CONFIG="$FINCH_DIR"`,
"[ -L /usr/local/bin/docker-credential-ecr-login ] " +
`|| sudo ln -s "$FINCH_DIR"/cred-helpers/docker-credential-ecr-login /usr/local/bin/`,
`[ -L /root/.aws ] || sudo ln -fs "$AWS_DIR" /root/.aws`,
}

I wonder if we could instead add "$FINCH_DIR"/cred-helpers/ to the users path. Therefore all credentials providers could be picked up 🤔

Describe the feature you'd like
Support BYO credential providers / wrapper scripts.

Additional context
Add any other context or screenshots about the feature request here.

@ollypom ollypom added enhancement New feature or request feature_request New Feature Request for Finch labels Feb 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request feature_request New Feature Request for Finch
Projects
None yet
Development

No branches or pull requests

1 participant