Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Recipe support for private Bicep registries #6917

Closed
3 of 10 tasks
Tracked by #1
AaronCrawfis opened this issue Dec 5, 2023 · 6 comments
Closed
3 of 10 tasks
Tracked by #1

Recipe support for private Bicep registries #6917

AaronCrawfis opened this issue Dec 5, 2023 · 6 comments
Assignees
@vishwahiremat
Labels
feature This issue describes a feature request in Radius triaged This issue has been reviewed and triaged

Comments

@AaronCrawfis
Copy link
Contributor

AaronCrawfis commented Dec 5, 2023 •
edited by willtsai
Loading

Current state

Today we allow OCI registries with anonymous pull to be used as Bicep registries for Recipes. For example, ghcr.io/radius-project/recipes/local-dev/rediscaches:latest is a public Recipe Bicep module: https://github.com/radius-project/recipes/pkgs/container/recipes%2Flocal-dev%2Frediscaches

Desired state

We want to enable users to be able to use private OCI registries that are not open to the public. For example, an ACR or GHCR registry could be locked down to only certain users or accounts.

Acceptance criteria

  • A user can create an OCI registry, such as an Azure Container Registry, that is private and can only be pulled from by allowed users/accounts
  • Recipes can be pushed to this OCI registry via rad bicep publish, after the user logs into the OCI registry via the registries login mechanism (az acr login for example).
  • The private Recipe can be added to an environment's list of Recipes
  • A user can configure credentials for the OCI registry
  • Radius uses the credentials to fetch Recipes
  • If credentials are invalid for the registry, an anonymous pull is attempted. This prevents a user from registering credentials for ghcr.io/myaccount and then public recipes for ghcr.io/radius-project can no longer be pulled.
  • Users can list configured credentials and view the username, but not the password
  • Users update credentials to roll them when they are expired or need to be replaced
  • Users can remove credentials for a specific OCI registry
  • Nested Bicep modules can leverage the same set of credentials

AB#10666
@AaronCrawfis AaronCrawfis changed the title Support for private Bicep registries Recipe support for private Bicep registries Dec 5, 2023
@AaronCrawfis
Copy link
Contributor Author

Similar to #6911

@shalabhms shalabhms added feature This issue describes a feature request in Radius triaged This issue has been reviewed and triaged labels Dec 11, 2023
@radius-triage-bot
Copy link

👋 @AaronCrawfis Thanks for filing this feature request.

A project maintainer will review this feature request and get back to you soon.

We also welcome community contributions! If you would like to pick this item up sooner and submit a pull request, please visit our contribution guidelines and assign this to yourself by commenting "/assign" on this issue.

For more information on our triage process please visit our triage overview

@radius-triage-bot
Copy link

👍 We've reviewed this issue and have agreed to add it to our backlog. Please subscribe to this issue for notifications, we'll provide updates when we pick it up.

We also welcome community contributions! If you would like to pick this item up sooner and submit a pull request, please visit our contribution guidelines and assign this to yourself by commenting "/assign" on this issue.

For more information on our triage process please visit our triage overview

@shalabhms
Copy link
Contributor

Triaged: similar parity #6911

@willtsai willtsai moved this to 🔖 Prioritized in Radius Roadmap Dec 15, 2023
@willtsai willtsai mentioned this issue Dec 15, 2023
Closed
@Gijsreyn Gijsreyn mentioned this issue Dec 17, 2023
Closed
@shalabhms
Copy link
Contributor

/assign @vishwahiremat

@vishwahiremat
Copy link
Contributor

/assign

@lakshmimsft lakshmimsft mentioned this issue Aug 9, 2024
Merged
@lakshmimsft lakshmimsft mentioned this issue Aug 16, 2024
Merged
lakshmimsft added a commit that referenced this issue Aug 29, 2024
@lakshmimsft
Update LoadSecrets() (#7796)
84cb120 
# Description

1. Update LoadSecrets() to return data for all keys for corresponding
secret store when no keys filter is provided.
2. Update return type to include SecretData{}
3. Updated existing LoadSecrets() to return data collated for multiple
secret store ids
4. Update to helper function populateSecretData() and it's unit tests
which populates secret data map returned.
5. Update functional test to include envSecrets input

## Type of change
- This pull request adds or changes features of Radius and has an
approved issue (#6917).

Fixes: (Part of #6917)
lakshmimsft added a commit that referenced this issue Aug 29, 2024
@lakshmimsft
Add new secret types to Applications.Core/secretstores (#7816)
50fef93 
# Description

Add new types to Applications.Core/secretstores (basicAuthentication,
azureWorkloadIdentity, awsIRSA)
Update convertor, tests.
Update existing ValidateAndMutateRequest() in
/pkg/corerp/frontend/controller/secretstores/kubernetes.go
to check if required secret keys exist for current secret type. Add to
existing unit tests.

## Type of change

- This pull request fixes a bug in Radius and has an approved issue
(#6917 ).


Fixes: Part of #6917
@lakshmimsft lakshmimsft mentioned this issue Aug 30, 2024
Merged
lakshmimsft added a commit that referenced this issue Aug 30, 2024
@lakshmimsft
Updates to adding secret types PR (#7867)
7232cc6 
# Description
Updates per comments in
#7816

## Type of change
- This pull request adds or changes features of Radius and has an
approved issue (#6917 ).

Fixes: Part of #6917
@vishwahiremat vishwahiremat mentioned this issue Sep 10, 2024
Merged
@willtsai willtsai closed this as completed Oct 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vishwahiremat vishwahiremat

Labels
feature This issue describes a feature request in Radius triaged This issue has been reviewed and triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@willtsai @shalabhms @AaronCrawfis @vishwahiremat