Allow to specify service_account as json about concourse-helm-resource HOT 6 CLOSED

For instance, this is how docker-image already supports this:

- name: my-app-in-container
  type: docker-image
  source:
    repository: eu.gcr.io/my-project-id/my-app-in-container
    username: _json_key
    password: {{gcs_service_account_json_key}}

from concourse-helm-resource.

I think #36 is basically the same, but a bit more precise. So I'm closing thing.

from concourse-helm-resource.

It's not really the same as #36 which is kubeconfig support.
If you're using GKE, you'll need to provide this service account in addition to your kubeconfig, but it's not enough since the gcloud CLI isn't in this image.

We have our own fork with the gcloud CLI installed so we can authenticate using service accounts but I'm not sure whether something Google Cloud specific should end up in this resource. What do you think ?

from concourse-helm-resource.

Hm, I'd rather not have something vendor specific in it. We could have some kind of extension point where the standard common.sh calls out to a different (by default empty) script at the right place.

You need to be able to provide a kubeconfig as well? I don't use GKE, so excuse my questions..
I've seen you changed two things in you fork: allow kubeconfig and add the Google stuff, right?

from concourse-helm-resource.

not adding vendor specific stuff

from concourse-helm-resource.

From get-credentials help:

To configure a kubeconfig file to use application default credentials, set the container/use_application_default_credentials Cloud SDK property to true before running gcloud container clusters get-credentials

So I tried to build my own tasks like following:

1. Running google/cloud-sdk, I retrieve k8s credentials from my service account key file in a creds/kubeconfig file:

mkdir -p creds
cat >creds/gcp-sa.json <<EOF
((gcp-sa.key))
EOF
GOOGLE_APPLICATION_CREDENTIALS=creds/gcp-sa.json KUBECONFIG=creds/kubeconfig \
  gcloud config set container/use_application_default_credentials true
GOOGLE_APPLICATION_CREDENTIALS=creds/gcp-sa.json KUBECONFIG=creds/kubeconfig \
  gcloud container clusters get-credentials \
    target-cluster-in-gke \
    --region europe-west1

2. Use it in helm resource declared before, with the following parameters:

      - put: my-helm-template
        params:
          chart: ./charts/path
          kubeconfig_path: creds/kubeconfig

It works out-of-the-box with linkyard/concourse-helm-resource and doesn't require any change in Dockerfile nor other assets.

from concourse-helm-resource.