Google Cloud custom universe domain compatibility

[mfilotto]

Hello everyone,

I would like to use fluxcd on a GKE cluster hosted on a Cloud de Confiance.
On these king of clouds, the api used to access Google ressources has a custom domain.

I tried to configure workload identity federation to pull OCI images from a Artifact Registry with no luck.

Do you know if Fluxcd is compatible or if there is a workaround to make it works.

Thanks for you help
Best regards
Mathieu

[mfilotto]

After reading a bit of source code, I found that auth pkg for GCP has "googleapis.com" as universe domain.
Maybe we could add a way to set another universe domain ?

https://github.com/fluxcd/pkg/blob/07d627dd2f175e3ab569d67571838d4cfd705813/auth/gcp/provider.go#L125

[matheuscscp]

This code is for when using .spec.serviceAccountName for workload identity, there must also be way to support this for DefaultTokenSource, which uses the controller service account for workload identity. Also, this code is only for getting the access token, for pointing to Google Artifact Registry in your cloud we probably need a change in source-controller as well, pls check it