Don't send ~/.docker/config.json by default

[jpambrun]

The current implementation sends ~/.docker/config.json as a secret if it exist. This isn't great:

1. it's surprising, not mentioned anywhere and a security concern;
2. it's left behind if interrupted (e.g. ctrl-c is pressed);
3. the credential might not be the ones you want to use in the cluster (e.g. a service account with less privilege);
4. sending this config file it often not enough (e.g. in GKE grc.io auth depends on the gcloud command and other credential files);
5. it's often unnecessary (e.g. pushing to gcr.io from GKE doesn't require any secret if the default cluster service account is configured with gcs write permission)

As a result, I think it would be best to place this pushing of ~/.docker/config.json behind a dedicated flag and default to not sending any secrets.

[kvaps]

That's makes sense, the original Idea was to write simple wrapper cover the kaniko functionality:

Call this:

kubectl build --help

almost any option should be working as native one.

Meanwhile, I agree with the security risks you mention, I'm considering to add -s flag to forward docker credentials.

sending this config file it often not enough (e.g. in GKE grc.io auth depends on the gcloud command and other credential files);

Could you give me an example, how it can be implemented with native kaniko?

[jpambrun]

I don't know exactly how it works. The Google documentation says to invoke

gcloud auth configure-docker

after my ~/.docker/config.json is as follow:

{
  "auths" : {
    "https://gcr.io" : {

    },
    "gcr.io" : {

    }
  },
  "experimental" : "disabled",
  "HttpHeaders" : {
    "User-Agent" : "Docker-Client/18.09.2 (darwin)"
  },
  "credHelpers" : {
    "us.gcr.io" : "gcloud",
    "asia.gcr.io" : "gcloud",
    "marketplace.gcr.io" : "gcloud",
    "gcr.io" : "gcloud",
    "eu.gcr.io" : "gcloud",
    "staging-k8s.gcr.io" : "gcloud"
  },
  "credsStore" : "desktop",
  "stackOrchestrator" : "swarm",
  "credSstore" : "osxkeychain"
}

gcloud is part of google cloud sdk. It's not exactly lightweight. It has its own key files.

My cluster's default service account has write permission to gcr (which is probably not a good idea.. ) so it doesn't require any secret. This is the recommend way: https://github.com/GoogleContainerTools/kaniko#pushing-to-google-gcr

[kvaps]

Hi, since v1.4.0 kubectl-build no longer creates a secret, it sends docker config with the build context using tar directly to the stdin.

Also the support for variable DOCKER_CONFIG to specify custom docker config location was added.