Workload Identity Federation broken since v2.1.26

[antdking]

When using Workload Identity Federation via OIDC without SA impersonation, docker-credential-gcr now reports that the "token was invalid".

$ echo "europe-west2-docker.pkg.dev" | docker-credential-gcr get
docker-credential-gcr/helper: could not retrieve GCR's access token: docker-credential-gcr/helper: token was invalid

The last working version was v2.1.25, so this is possibly an upstream issue with the new cloud auth library.
I have already tried compiling against a newer version of the auth library, to no avail.

For our usecase, we're utilising Gitlab CI, configured as per here.

[solidnerd]

Hey @antdking ,

I deployed it today in our GitLab CI Environment and its working for us. Probably I have a miss understanding of the Issue.

Here is our configuration that works

        apk add --no-cache curl
        set -x; curl -fsSL https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v$[[ inputs.gcr_credential_helper_version ]]/docker-credential-gcr_linux_amd64-$[[ inputs.gcr_credential_helper_version ]].tar.gz | tar xz 
        mv docker-credential-gcr /usr/local/bin/docker-credential-gcr
        chmod +x /usr/local/bin/docker-credential-gcr 
        export GOOGLE_APPLICATION_CREDENTIALS=$CI_PROJECT_DIR/_google_auth/.gcp_temp_cred.json
        docker-credential-gcr config --token-source="env, store"
        docker-credential-gcr configure-docker --registries="gcr.io,us-west1-docker.pkg.dev,europe-west4-docker.pkg.dev"

Than you can simply build the image and push it.

We used version 2.1.29 and I tested with 2.1.25 as well.

I hope this helps.

[antdking]

what's creating $CI_PROJECT_DIR/_google_auth/.gcp_temp_cred.json in your case @solidnerd ?

We're using WIF to make direct requests, as apposed to impersonating a service account.