ci: authenticate Image push to quay.io with OIDC - #3309
Merged
Merged
Conversation
nbusseneau
approved these changes
Sep 22, 2026
Member
|
Code LGTM, wonder why hostname was not working in testing. |
Member
Author
I think @aanm still needs to make some changes. He'll ping me once they're done I can test this again. Moving to draft until then. |
tklauser
marked this pull request as draft
September 22, 2026 15:46
aanm
requested changes
Sep 23, 2026
tklauser
force-pushed
the
pr/tklauser/image-push-oidc
branch
2 times, most recently
from
September 23, 2026 09:04
5bb720e to
e379093
Compare
Member
Author
|
@aanm copy&paste comments should be fixed now |
aanm
requested changes
Sep 23, 2026
tklauser
force-pushed
the
pr/tklauser/image-push-oidc
branch
from
September 23, 2026 09:10
e379093 to
3a20d33
Compare
tklauser
marked this pull request as ready for review
September 23, 2026 09:10
aanm
requested changes
Sep 23, 2026
tklauser
force-pushed
the
pr/tklauser/image-push-oidc
branch
from
September 23, 2026 09:14
3a20d33 to
aca4737
Compare
aanm
approved these changes
Sep 23, 2026
aanm
requested changes
Sep 23, 2026
tklauser
force-pushed
the
pr/tklauser/image-push-oidc
branch
from
September 23, 2026 09:31
aca4737 to
b4dbbc5
Compare
tklauser
force-pushed
the
pr/tklauser/image-push-oidc
branch
from
September 23, 2026 13:29
2840f2b to
982702a
Compare
aanm
requested changes
Sep 23, 2026
tklauser
force-pushed
the
pr/tklauser/image-push-oidc
branch
from
September 23, 2026 14:23
982702a to
0df1d74
Compare
aanm
approved these changes
Sep 23, 2026
maintainer-s-little-helper
Bot
added
the
ready-to-merge
Follow upstream cilium/cilium workflow changes and use OIDC to authenticate CI to quay.io, instead of the static robot password. The GitHub token cannot be used as the registry password directly, so it is traded for a short lived robot token before the login. Signed-off-by: Tobias Klauser <tobias@cilium.io>
Member
Author
|
Successful run: https://github.com/cilium/cilium-cli/actions/runs/35873886319 Dropping the test commit and amending the change requested here: #3309 (comment) |
tklauser
force-pushed
the
pr/tklauser/image-push-oidc
branch
from
September 23, 2026 19:09
0df1d74 to
cf03edc
Compare
hbjydev
pushed a commit
to hbjydev/phoebe
that referenced
this pull request
Sep 28, 2026
… (#752) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [aqua:cilium/cilium-cli](https://github.com/cilium/cilium-cli) | tools | patch | `0.20.0` → `0.20.1` | --- ### Release Notes <details> <summary>cilium/cilium-cli (aqua:cilium/cilium-cli)</summary> ### [`v0.20.1`](https://github.com/cilium/cilium-cli/releases/tag/v0.20.1) [Compare Source](cilium/cilium-cli@v0.20.0...v0.20.1) #### What's Changed - chore(deps): update docker.io/library/golang:1.27.0 docker digest to [`0ecdc2a`](cilium/cilium-cli@0ecdc2a) by [@​renovate](https://github.com/renovate)\[bot] in [#​3295](cilium/cilium-cli#3295) - Update stable release to v0.20.0 by [@​tklauser](https://github.com/tklauser) in [#​3296](cilium/cilium-cli#3296) - chore(deps): update softprops/action-gh-release digest to [`efb3536`](cilium/cilium-cli@efb3536) by [@​renovate](https://github.com/renovate)\[bot] in [#​3297](cilium/cilium-cli#3297) - chore(deps): update dependency kubernetes-sigs/kind to v0.33.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​3298](cilium/cilium-cli#3298) - chore(deps): update golangci/golangci-lint docker tag to v2.13.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​3299](cilium/cilium-cli#3299) - chore(deps): update helm/kind-action action to v1.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​3300](cilium/cilium-cli#3300) - chore(deps): update go to v1.27.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​3301](cilium/cilium-cli#3301) - chore(deps): update go by [@​renovate](https://github.com/renovate)\[bot] in [#​3303](cilium/cilium-cli#3303) - chore(deps): update gcr.io/distroless/static:latest docker digest to [`5813399`](cilium/cilium-cli@5813399) by [@​renovate](https://github.com/renovate)\[bot] in [#​3302](cilium/cilium-cli#3302) - chore(deps): update all github action dependencies by [@​renovate](https://github.com/renovate)\[bot] in [#​3305](cilium/cilium-cli#3305) - Prepare for v0.20.1 release by [@​tklauser](https://github.com/tklauser) in [#​3304](cilium/cilium-cli#3304) - chore(deps): update cilium/cilium action to v1.20.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​3306](cilium/cilium-cli#3306) - chore(deps): update dependency cilium/cilium to v1.20.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​3308](cilium/cilium-cli#3308) - chore(deps): update docker/setup-buildx-action action to v4.4.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​3307](cilium/cilium-cli#3307) - ci: authenticate Image push to quay.io with OIDC by [@​tklauser](https://github.com/tklauser) in [#​3309](cilium/cilium-cli#3309) - go.mod, vendor: update github.com/cilium/cilium to latest by [@​tklauser](https://github.com/tklauser) in [#​3310](cilium/cilium-cli#3310) **Full Changelog**: <cilium/cilium-cli@v0.20.0...v0.20.1> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTEuNCIsInVwZGF0ZWRJblZlciI6IjQ0LjExNS4xMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsidHlwZS9wYXRjaCJdfQ==--> Reviewed-on: https://git.hayden.moe/hayden/phoebe/pulls/752
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow upstream cilium/cilium workflow changes and use OIDC to authenticate CI to quay.io, instead of the static robot password. The GitHub token cannot be used as the registry password directly, so it is traded for a short lived robot token before the login.