FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Updated docs to include GCP provider instructions · racdev/source-controller@a6be9c8 · GitHub

/ source-controller Public
forked from fluxcd/source-controller

Commit a6be9c8

Browse files
pa250194
committed
Updated docs to include GCP provider instructions
Signed-off-by: pa250194 <pa250194@ncr.com>
1 parent fa8c4ca commit a6be9c8

2 files changed

Lines changed: 82 additions & 5 deletions

File tree

‎docs/spec/v1alpha1/buckets.md‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ Bucket:
1111
// BucketSpec defines the desired state of an S3 compatible bucket
1212
type BucketSpec struct {
1313
// The S3 compatible storage provider name, default ('generic').
14-
// +kubebuilder:validation:Enum=generic;aws;gcp
14+
// +kubebuilder:validation:Enum=generic;aws
1515
// +optional
1616
Provider string `json:"provider,omitempty"`
1717

@@ -57,7 +57,6 @@ Supported providers:
5757
const (
5858
GenericBucketProvider string = "generic"
5959
AmazonBucketProvider string = "aws"
60-
GoogleBucketProvider string = "gcp"
6160
)
6261
```
6362

@@ -232,4 +231,4 @@ Wait for ready condition:
232231

233232
```bash
234233
kubectl -n gitios-system wait bucket/podinfo --for=condition=ready --timeout=1m
235-
```
234+
```

‎docs/spec/v1beta1/buckets.md‎

Lines changed: 80 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ Bucket:
1111
// BucketSpec defines the desired state of an S3 compatible bucket
1212
type BucketSpec struct {
1313
// The S3 compatible storage provider name, default ('generic').
14-
// +kubebuilder:validation:Enum=generic;aws
14+
// +kubebuilder:validation:Enum=generic;aws;gcp
1515
// +optional
1616
Provider string `json:"provider,omitempty"`
1717

@@ -62,6 +62,7 @@ Supported providers:
6262
const (
6363
GenericBucketProvider string = "generic"
6464
AmazonBucketProvider string = "aws"
65+
GoogleBucketProvider string = "gcp"
6566
)
6667
```
6768

@@ -182,7 +183,8 @@ data:
182183
secretkey: <BASE64>
183184
```
184185

185-
> **Note:** that for Google Cloud Storage you have to enable
186+
> **Note:** that when using the generic provider
187+
> for Google Cloud Storage you have to enable
186188
> S3 compatible access in your GCP project.
187189

188190
### AWS IAM authentication
@@ -230,6 +232,82 @@ spec:
230232
}
231233
```
232234

235+
### GCP Provider
236+
237+
When the provider is `gcp` and the `secretRef` is not specified,
238+
the GCP client authenticates using workload identity.
239+
The GCP client automatically handles authentication in two ways.
240+
The first way being that the GCP client library will automatically
241+
check for the presence of the GOOGLE_APPLICATION_CREDENTIAL
242+
environment variable. If this is not found, the GCP client library
243+
will search for the Google Application Credential file in the config directory:
244+
245+
```yaml
246+
apiVersion: source.toolkit.fluccd.io/v1beta1
247+
kind: Bucket
248+
metadata:
249+
name: podinfo
250+
namespace: gitops-system
251+
spec:
252+
interval: 5m
253+
provider: gcp
254+
bucketName: podinfo
255+
endpoint: storage.googleapis.com
256+
region: us-east-1
257+
timeout: 30s
258+
```
259+
260+
When the provider is `gcp` and the `secretRef` is specified,
261+
the GCP client authenticates using a Kubernetes secret named serviceaccount
262+
which is a base 64 encoded string of the GCP service account JSON file:
263+
264+
```yaml
265+
apiVersion: source.toolkit.fluccd.io/v1beta1
266+
kind: Bucket
267+
metadata:
268+
name: podinfo
269+
namespace: gitops-system
270+
spec:
271+
interval: 5m
272+
provider: gcp
273+
bucketName: podinfo
274+
endpoint: storage.googleapis.com
275+
region: us-east-1
276+
timeout: 30s
277+
secretRef:
278+
name: gcp-service-account
279+
---
280+
apiVersion: v1
281+
kind: Secret
282+
metadata:
283+
name: gcp-service-account
284+
namespace: gitops-system
285+
type: Opaque
286+
data:
287+
serviceaccount: "ewogICAgInR5cGUiOiAic2VydmljZV9hY2NvdW50IiwKICAgICJwcm9qZWN0X2lkIjogInBvZGluZm8iLAogICAgInByaXZhdGVfa2V5X2lkIjogIjI4cXdnaDNnZGY1aGozZ2I1ZmozZ3N1NXlmZ2gzNGY0NTMyNDU2OGh5MiIsCiAgICAicHJpdmF0ZV9rZXkiOiAiLS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5Id2V0aGd5MTIzaHVnZ2hoaGJkY3U2MzU2ZGd5amhzdmd2R0ZESFlnY2RqYnZjZGhic3g2M2Ncbjc2dGd5Y2ZlaHVoVkdURllmdzZ0N3lkZ3lWZ3lkaGV5aHVnZ3ljdWhland5NnQzNWZ0aHl1aGVndmNldGZcblRGVUhHVHlnZ2h1Ymh4ZTY1eWd0NnRneWVkZ3kzMjZodWN5dnN1aGJoY3Zjc2poY3NqaGNzdmdkdEhGQ0dpXG5IY3llNnR5eWczZ2Z5dWhjaGNzYmh5Z2NpamRiaHl5VEY2NnR1aGNldnVoZGNiaHVoaHZmdGN1aGJoM3VoN3Q2eVxuZ2d2ZnRVSGJoNnQ1cmZ0aGh1R1ZSdGZqaGJmY3JkNXI2N3l1aHV2Z0ZUWWpndnRmeWdoYmZjZHJoeWpoYmZjdGZkZnlodmZnXG50Z3ZnZ3RmeWdodmZ0NnR1Z3ZURjVyNjZ0dWpoZ3ZmcnR5aGhnZmN0Nnk3eXRmcjVjdHZnaGJoaHZ0Z2hoanZjdHRmeWNmXG5mZnhmZ2hqYnZnY2d5dDY3dWpiZ3ZjdGZ5aFZDN3VodmdjeWp2aGhqdnl1amNcbmNnZ2hndmdjZmhnZzc2NTQ1NHRjZnRoaGdmdHloaHZ2eXZ2ZmZnZnJ5eXU3N3JlcmVkc3dmdGhoZ2ZjZnR5Y2ZkcnR0ZmhmL1xuLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLVxuIiwKICAgICJjbGllbnRfZW1haWwiOiAidGVzdEBwb2RpbmZvLmlhbS5nc2VydmljZWFjY291bnQuY29tIiwKICAgICJjbGllbnRfaWQiOiAiMzI2NTc2MzQ2Nzg3NjI1MzY3NDYiLAogICAgImF1dGhfdXJpIjogImh0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbS9vL29hdXRoMi9hdXRoIiwKICAgICJ0b2tlbl91cmkiOiAiaHR0cHM6Ly9vYXV0aDIuZ29vZ2xlYXBpcy5jb20vdG9rZW4iLAogICAgImF1dGhfcHJvdmlkZXJfeDUwOV9jZXJ0X3VybCI6ICJodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbS9vYXV0aDIvdjEvY2VydHMiLAogICAgImNsaWVudF94NTA5X2NlcnRfdXJsIjogImh0dHBzOi8vd3d3Lmdvb2dsZWFwaXMuY29tL3JvYm90L3YxL21ldGFkYXRhL3g1MDkvdGVzdCU0MHBvZGluZm8uaWFtLmdzZXJ2aWNlYWNjb3VudC5jb20iCn0="
288+
```
289+
290+
> **Note:** the serviceaccount secret is a base 64 encoded form of
291+
> the GCP service account json file like so
292+
293+
```json
294+
{
295+
"type": "service_account",
296+
"project_id": "podinfo",
297+
"private_key_id": "28qwgh3gdf5hj3gb5fj3gsu5yfgh34f45324568hy2",
298+
"private_key": "-----BEGIN PRIVATE KEY-----\nHwethgy123hugghhhbdcu6356dgyjhsvgvGFDHYgcdjbvcdhbsx63c\n76tgycfehuhVGTFYfw6t7ydgyVgydheyhuggycuhejwy6t35fthyuhegvcetf\nTFUHGTygghubhxe65ygt6tgyedgy326hucyvsuhbhcvcsjhcsjhcsvgdtHFCGi\nHcye6tyyg3gfyuhchcsbhygcijdbhyyTF66tuhcevuhdcbhuhhvftcuhbh3uh7t6y\nggvftUHbh6t5rfthhuGVRtfjhbfcrd5r67yuhuvgFTYjgvtfyghbfcdrhyjhbfctfdfyhvfg\ntgvggtfyghvft6tugvTF5r66tujhgvfrtyhhgfct6y7ytfr5ctvghbhhvtghhjvcttfycf\nffxfghjbvgcgyt67ujbgvctfyhVC7uhvgcyjvhhjvyujc\ncgghgvgcfhgg765454tcfthhgftyhhvvyvvffgfryyu77reredswfthhgfcftycfdrttfhf/\n-----END PRIVATE KEY-----\n",
299+
"client_email": "test@podinfo.iam.gserviceaccount.com",
300+
"client_id": "32657634678762536746",
301+
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
302+
"token_uri": "https://oauth2.googleapis.com/token",
303+
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
304+
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/test%40podinfo.iam.gserviceaccount.com"
305+
}
306+
```
307+
> **Note:** that when using the gcp provider for
308+
> Google Cloud Storage you do not have to enable
309+
> S3 compatible access in your GCP project.
310+
233311
## Status examples
234312

235313
Successful download:

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL