TrueCloudLab/distribution
13
0
Fork 3
Code Issues 2 Pull requests Projects Releases 2 Packages Wiki Activity Actions

Support redirects in gcs storage with default credentials (#4295)

Browse source
This commit is contained in:
Milos Gajdos 2024-03-11 22:29:57 +00:00 committed by GitHub
commit d9815da9cb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
docs/content/storage-drivers/gcs.md
View file

@ -17,4 +17,8 @@ An implementation of the `storagedriver.StorageDriver` interface which uses Goog
{{< hint type=note >}}
Instead of a key file you can use [Google Application Default Credentials](https://developers.google.com/identity/protocols/application-default-credentials).
To use redirects with default credentials assigned to a virtual machine you have to enable "IAM Service Account Credentials API" and grant `iam.serviceAccounts.signBlob` permission on the used service account.
To use redirects with default credentials from Google Cloud CLI, in addition to the permissions mentioned above, you have to [impersonate the service account intended to be used by the registry](https://cloud.google.com/sdk/gcloud/reference#--impersonate-service-account).
{{< /hint >}}

4
registry/storage/driver/gcs/gcs.go
View file

@ -785,10 +785,6 @@ func (d *driver) Delete(ctx context.Context, path string) error {
// RedirectURL returns a URL which may be used to retrieve the content stored at
// the given path, possibly using the given options.
func (d *driver) RedirectURL(r *http.Request, path string) (string, error) {
if d.privateKey == nil {
return "", nil
}
if r.Method != http.MethodGet && r.Method != http.MethodHead {
return "", nil
}