Does this support Identity Federation from external accounts? about docker-credential-gcr

[jonjohnsonjr]

@Dermah I believe while moving over to go modules, we pulled in a new enough version of oauth2 for this to work now. Can you try the 2.1.0 release?

[jonjohnsonjr]

docker-credential-gcr seems to use golang.org/x/oauth2 version v0.0.0-20210817223510-7df4dd6e12ab, which is a high enough version to support identity federation to get the credentials.

Where do you see this? As far as I can tell, we're on a pretty old version of oauth2. I think we just need to update that.

[Dermah]

Ah yep my mistake. I don't do much go, so I misintepreted go's output when installing the binary:

$ go get -u github.com/GoogleCloudPlatform/docker-credential-gcr
go: downloading golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f
...

You're right, the oauth2 library bundled here is older and doesn't support external_account

docker-credential-gcr/vendor/golang.org/x/oauth2/google/google.go

Lines 92 to 96 in 7307e10

	// JSON key file types.
	const (
	serviceAccountKey = "service_account"
	userCredentialsKey = "authorized_user"
	)

but the latest oauth2 library does

[Dermah]

I no longer have access to the environment where I was testing this, but it looks like the go modules would have enabled my use case. Thank you for this!