Flux CD
Hard
Security
How can an OCIRepository authenticate to Amazon ECR without a static registry password?
Select your answer:
Show answer and explanation
Answer: Set spec.provider: aws so source-controller uses the cloud identity
Explanation
With provider aws, azure or gcp, source-controller gets registry credentials from the cloud's workload identity instead of a Secret. The default, generic, uses a Secret or anonymous access. ImageRepository supports the same provider field for scanning private registries.
More hard Flux CD questions
- You need to add a label to a Deployment that a third-party chart renders, and the chart has no value for it. What does a HelmRelease offer?
- What permissions does the deploy key created by 'flux bootstrap github' have by default?
- What does the annotation kustomize.toolkit.fluxcd.io/ssa: IfNotPresent do on an object in a Flux source?
- A change to an immutable field makes Flux's apply of a Job fail. Which annotation on the Job tells Flux to delete and recreate it?
- A GitRepository has no ref field, and the repository's default branch is main. What does Flux check out?
- kustomize-controller can't tell when a custom resource from a third-party operator is healthy. How do you teach it?