feat: k8s-sa-wif provider by ihor-hrytskiv · Pull Request #1108 · kubernetes/cloud-provider-gcp

ihor-hrytskiv · 2026-05-06T13:30:14Z

This PR implements Service Account Token Integration for Image Pulls (GA), enabling kubelet to use Workload Identity Federation via GCP STS when retrieving credentials for pulling images. This change also resolves the issue described in #864

k8s-ci-robot · 2026-05-06T13:30:23Z

This issue is currently awaiting triage.

If the repository mantainers determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-05-06T13:30:24Z

Welcome @ihor-hrytskiv!

It looks like this is your first PR to kubernetes/cloud-provider-gcp 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/cloud-provider-gcp has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-05-06T13:30:25Z

Hi @ihor-hrytskiv. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-05-06T13:30:28Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ihor-hrytskiv
Once this PR has been reviewed and has the lgtm label, please assign joelspeed for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

linux-foundation-easycla · 2026-05-06T13:30:35Z

The committers listed above are authorized under a signed CLA.

✅ login: ihor-hrytskiv / name: Ihor Hrytskiv (340ca33, 422c7cf, a349023)

Signed-off-by: Ihor Hrytskiv <ihor.hrytskiv@macpaw.com>

mastersingh24 · 2026-05-09T21:16:03Z

+			ProjectNumber: os.Getenv("GCP_WIF_PROJECT_NUMBER"),
+			PoolId:        os.Getenv("GCP_WIF_POOL_ID"),
+			ProviderId:    os.Getenv("GCP_WIF_PROVIDER_ID"),
+		},


You should also be able to pass these in via args to the get-credentials command as well. We do use this in GKE and we'd likely pass these in via args in the CredentialProviderConfig passed to the kubelet

mastersingh24 · 2026-05-09T21:21:12Z

 	gcrAuthFlow             = "gcr"
 	dockerConfigAuthFlow    = "dockercfg"
 	dockerConfigURLAuthFlow = "dockercfg-url"
+	k8sSAWIFAuthFlow        = "k8s-sa-wif"


it's probably fine to have a dedicated authflow, but we should be able to also use the gcr flow and then just check the CredentialProviderRequest to see if it contains the serviceaccount info.

Hi @mastersingh24, thank you for your comment
Do you mean I should use the same gcrAuthFlow provider with two different logics? If CredentialProviderRequest contains a ServiceAccountToken, use the WIF-based logic; if it doesn’t, fall back to the standard gcrAuthFlow logic using the metadata server?

@ihor-hrytskiv - that's what I was thinking. I believe that there will be cases in the same cluster where people use both flows so supporting both methods together makes sense.

@mastersingh24 Could you maybe share an example where both flows would be used?

From what I understand, if the provider is running on a GCP Compute instance, we’d typically use the internal metadata server. And the service account token flow would be more relevant when running outside of GCP, since the metadata server isn’t available there.

@mastersingh24 I’ve implemented new logic within the existing gcrAuthFlow. If that looks good, I’ll add tests.

Signed-off-by: Ihor Hrytskiv <ihor.hrytskiv@macpaw.com>

wattmto · 2026-05-12T04:25:44Z

-		klog.Errorf("while reading access token endpoint: %v", err)
-		return cfg
+	entry := credentialconfig.DockerConfigEntry{
+		Username: "_token",


Can we confirm that Artifact Registry accepts _token as the username when the password is a Google access token? I see the existing provider uses _token, while the public Artifact Registry docs show oauth2accesstoken.
https://docs.cloud.google.com/artifact-registry/docs/docker/authentication#token

yes, it works correct

wattmto · 2026-05-12T04:37:34Z

Since Container Registry does not support identity federation, should the WIF path return credentials only for Artifact Registry (*.pkg.dev)?
https://docs.cloud.google.com/iam/docs/federated-identity-supported-services

k8s-ci-robot · 2026-05-14T05:04:31Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label May 6, 2026

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 6, 2026

k8s-ci-robot requested review from bridgetkromhout and cheftako May 6, 2026 13:30

k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label May 6, 2026

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels May 6, 2026

feat: k8s-sa-wif provider

422c7cf

Signed-off-by: Ihor Hrytskiv <ihor.hrytskiv@macpaw.com>

ihor-hrytskiv force-pushed the master branch from 408bb01 to 422c7cf Compare May 6, 2026 13:53

feat: k8s-sa-wif provider

340ca33

mastersingh24 reviewed May 9, 2026

View reviewed changes

feat: k8s-sa-wif provider

a349023

Signed-off-by: Ihor Hrytskiv <ihor.hrytskiv@macpaw.com>

ihor-hrytskiv force-pushed the master branch from 834b822 to a349023 Compare May 11, 2026 18:39

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 12, 2026

wattmto reviewed May 12, 2026

View reviewed changes

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 12, 2026

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 14, 2026

Conversation

ihor-hrytskiv commented May 6, 2026

Uh oh!

k8s-ci-robot commented May 6, 2026

Uh oh!

k8s-ci-robot commented May 6, 2026

Uh oh!

k8s-ci-robot commented May 6, 2026

Uh oh!

k8s-ci-robot commented May 6, 2026

Uh oh!

linux-foundation-easycla Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mastersingh24 May 9, 2026

Choose a reason for hiding this comment

Uh oh!

mastersingh24 May 9, 2026

Choose a reason for hiding this comment

Uh oh!

ihor-hrytskiv May 11, 2026

Choose a reason for hiding this comment

Uh oh!

mastersingh24 May 11, 2026

Choose a reason for hiding this comment

Uh oh!

ihor-hrytskiv May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ihor-hrytskiv May 11, 2026

Choose a reason for hiding this comment

Uh oh!

wattmto May 12, 2026

Choose a reason for hiding this comment

Uh oh!

ihor-hrytskiv May 13, 2026

Choose a reason for hiding this comment

Uh oh!

wattmto commented May 12, 2026

Uh oh!

k8s-ci-robot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

linux-foundation-easycla Bot commented May 6, 2026 •

edited

Loading

ihor-hrytskiv May 11, 2026 •

edited

Loading