Use ServiceAccount mount secrets for authentication

[lcarva]

Feature request

Find ServiceAccount secrets that are either used for "mount" or for "pull".

Use case

The auth docs in Tekton Pipelines guide the user to set secrets for mount. This can be seen by the usage of the secrets attribute of ServiceAccounts, instead of the imagePullSecrets attribute.

Users following those docs will be confused when Chains cannot find the expected credentials causing it to not work properly.

[lcarva]

Chains uses the k8schain library to find secrets. However, that library only fetches the ImagePullSecrets associated with a ServiceAccount.

Possible solutions:

1. Teach the k8schain library to also take into consideration secrets under the secrets attribute.
2. Perform the discovery of such secrets directly in Chains, and pass the list of found secrets to the k8schain library here.
3. Update the Tekton Pipeline docs to guide users to link secrets for both mount and pull. I think this makes things more confusing to users and we should avoid it.

[lcarva]

Filed an issue with the library. Waiting to hear from the maintainers if they would be open to such a change.

[lcarva]

The library was updated to include an option to allow the use of mount secrets 🎉

Once a release is made, we need to update Chains to use that new version (or wait for dependabot). We also need to ensure we're enabling the use of the feature. Let's leave this issue open to track that work.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[lcarva]

v0.14.0 of the go-containerregistry library contains the required changes which Chains is already using.

Once a release is made, we need to update Chains to use that new version (or wait for dependabot). We also need to ensure we're enabling the use of the feature. Let's leave this issue open to track that work.

We can do this now.