Skip to content

Commit 9358b74

Browse files
NimRegevNimRegev
committed
Updates to nav yamls
1 parent 4b79d65 commit 9358b74

File tree

4 files changed

+400
-1
lines changed

4 files changed

+400
-1
lines changed

‎_data/nav.yml‎

Lines changed: 120 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,109 @@
189189
- title: GitOps examples
190190
url: "/cd-examples"
191191

192+
- title: Pipeline integrations
193+
url: "/integrations"
194+
pages:
195+
- title: Codefresh Hosted GitOps
196+
url: "/codefresh-hosted-gitops"
197+
- title: Git Providers
198+
url: "/git-providers"
199+
- title: Kubernetes
200+
url: "/kubernetes"
201+
- title: Amazon Services
202+
url: "/amazon-web-services"
203+
- title: Microsoft Azure
204+
url: "/microsoft-azure"
205+
- title: Google Cloud
206+
url: "/google-cloud"
207+
- title: Docker registries
208+
url: "/docker-registries"
209+
sub-pages:
210+
- title: Docker Hub
211+
url: "/docker-hub"
212+
- title: Azure Docker Registry
213+
url: "/azure-docker-registry"
214+
- title: Amazon EC2 Container Registry
215+
url: "/amazon-ec2-container-registry"
216+
- title: Google Container Registry
217+
url: "/google-container-registry"
218+
- title: Google Artifact Registry
219+
url: "/google-artifact-registry"
220+
- title: JFrog Bintray.io/Artifactory
221+
url: "/bintray-io"
222+
- title: Quay.io
223+
url: "/quay-io"
224+
- title: GitHub Container Registry
225+
url: "/github-container-registry"
226+
- title: DigitalOcean Container Registry
227+
url: "/digital-ocean-container-registry"
228+
- title: Other Registries
229+
url: "/other-registries"
230+
- title: Secret Storage
231+
url: "/secret-storage"
232+
- title: Hashicorp Vault
233+
url: "/hashicorp-vault"
234+
- title: Helm Integration
235+
url: "/helm"
236+
- title: ArgoCD Integration
237+
url: "/argocd"
238+
- title: Datadog Integration
239+
url: "/datadog"
240+
- title: Jira Integration
241+
url: "/jira"
242+
- title: Jenkins Integration
243+
url: "/jenkins-integration"
244+
- title: Codecov Integration
245+
url: "/codecov-integration"
246+
- title: Google Cloud builder
247+
url: "/gcloud-builder"
248+
- title: Google Marketplace Installation
249+
url: "/google-marketplace"
250+
- title: GitHub Actions
251+
url: "/github-actions"
252+
- title: Notifications
253+
url: "/notifications"
254+
sub-pages:
255+
- title: Slack
256+
url: "/slack-integration"
257+
- title: Jira
258+
url: "/jira-integration"
259+
- title: Codefresh API
260+
url: "/codefresh-api"
261+
262+
263+
- title: GitOps integrations
264+
url: "/gitops-integrations"
265+
pages:
266+
- title: Image enrichment with GitOps integrations
267+
url: "/image-enrichment-overview"
268+
- title: GitOps CI integrations
269+
url: "/ci-integrations"
270+
sub-pages:
271+
- title: Codefresh Classic
272+
url: "/codefresh-classic"
273+
- title: GitHub Actions
274+
url: "/github-actions"
275+
- title: Jenkins
276+
url: "/jenkins"
277+
- title: GitOps issue tracking integrations
278+
url: "/issue-tracking"
279+
sub-pages:
280+
- title: Jira
281+
url: "/jira"
282+
- title: GitOps container registry integrations
283+
url: "/container-registries"
284+
sub-pages:
285+
- title: Amazon ECR
286+
url: "/amazon-ecr"
287+
- title: Docker Hub Registry
288+
url: "/dockerhub"
289+
- title: GitHub Container Registry
290+
url: "/github-cr"
291+
- title: JFrog Artifactory
292+
url: "/jfrog"
293+
- title: Quay Registry
294+
url: "/quay"
192295

193296
- title: Deployments
194297
url: "/deployments"
@@ -332,7 +435,23 @@
332435
- title: Sharing file systems
333436
url: "/sharing-file-system"
334437

335-
438+
- title: CI/CD testing
439+
url: "/testing"
440+
pages:
441+
- title: Unit tests
442+
url: "/unit-tests"
443+
- title: Integration tests
444+
url: "/integration-tests"
445+
- title: Creating test reports
446+
url: "/test-reports"
447+
- title: Creating compositions
448+
url: "/create-composition"
449+
- title: Dynamic preview environments
450+
url: "/automatic-preview-environments"
451+
- title: Security scanning
452+
url: "/security-scanning"
453+
- title: SonarQube scanning
454+
url: "/sonarqube-integration"
336455

337456
- title: Clients
338457
url: "/clients"

‎_docs/reference/git-tokens.md‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
---
2+
title: "Git tokens"
3+
description: ""
4+
group: reference
5+
redirect_from:
6+
- /docs/administration/git-tokens/
7+
toc: true
8+
---
9+
10+
11+
12+
Codefresh requires two types of Git tokens for authentication:
13+
* Git runtime token for runtime installation
14+
Used by:
15+
* Argo CD clone repositories and pull changes to sync the desired state in Git to the live state on the cluster.
16+
* Argo Events to create webhooks in Git repositories for Event Sources in Delivery Pipelines
17+
18+
The Git runtime token is runtime-specific but not user-specific.
19+
20+
21+
* Git user token, a user-specific personal access token for each runtime, unique to every user
22+
Unique to every user, the Git user token is used to authenticate the user for client-based actions, such as Git clone and push operations on specific repositories.
23+
Git user token requirements translate to permission scopes which differ for the different Git providers.
24+
25+
After installation, you need to authorize Git access for every provisioned runtime either through OAuth2 or through a personal access token from your Git provider.
26+
Every user can view the list of runtimes and tokens assigned to each runtime in [User Settings](https://g.codefresh.io/2.0/user-settings){:target="\_blank"}. Codefresh flags and notifies you of invalid, revoked, or expired tokens.
27+
28+
29+
30+
31+
### Git runtime token scopes
32+
The Git runtime token is mandatory for runtime installation.
33+
34+
{::nomarkdown}
35+
</br>
36+
{:/}
37+
38+
#### GitHub and GitHub Enterprise runtime token scopes
39+
40+
* `repo`
41+
* `admin:repo_hook`
42+
43+
{::nomarkdown}
44+
</br>
45+
{:/}
46+
47+
#### GitLab Cloud and GitLab Server runtime token scopes
48+
49+
* `api`
50+
* `read_repository`
51+
52+
{::nomarkdown}
53+
</br>
54+
{:/}
55+
56+
#### Bitbucket Cloud and Bitbucket Server runtime token scopes
57+
58+
* **Account**: `Read`
59+
* **Workspace membership**: `Read`
60+
* **Webhooks**: `Read and write`
61+
* **Repositories**: `Write`, `Admin`
62+
63+
{::nomarkdown}
64+
</br></br>
65+
{:/}
66+
67+
### Git personal tokens
68+
The Git personal token is a user-specific personal access token per provisioned runtime. Unique to each user, it may be required after to authenticate Git-based actions per runtime in Codefresh, based on how your admin has set up authentication for Git providers.
69+
70+
> If you have access to multiple runtimes, you can use the same personal access token for all the runtimes.
71+
You must configure the token for each runtime.
72+
73+
{::nomarkdown}
74+
</br>
75+
{:/}
76+
77+
#### GitHub and GitHub Enterprise personal user token scopes
78+
* `repo`
79+
80+
<!---{% include
81+
image.html
82+
lightbox="true"
83+
file="/images/getting-started/github-pat.png"
84+
url="/images/getting-started/github-pat.png"
85+
alt="Permissions for Git personal token"
86+
caption="Permissions for Git personal token"
87+
max-width="60%"
88+
%}-->
89+
{::nomarkdown}
90+
</br>
91+
{:/}
92+
93+
#### GitLab Cloud and GitLab Server personal user token scopes
94+
95+
* `write_repository` (includes `read-repository`)
96+
* `api-read`
97+
98+
{::nomarkdown}
99+
</br>
100+
{:/}
101+
102+
#### Bitbucket Cloud and Server personal user token scopes
103+
104+
* **Account**: `Read`
105+
* **Workspace membership**: `Read`
106+
* **Repositories**: `Write`, `Admin`
107+
108+
### Related articles
109+
[User settings]({{site.baseurl}}/docs/administration/user-settings/)

‎_docs/reference/secrets.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
title: "Secrets"
3+
description: "Learn how Codefresh stores secrets"
4+
group: reference
5+
toc: true
6+
---
7+
8+
9+
Codefresh provides out-of-the-box management for secrets, generally to store secrets for third-party integrations.
10+
11+
For secure secret storage, every Codefresh runtime uses the [Bitnami Sealed Secrets controller](https://github.com/bitnami-labs/sealed-secrets){:target="_blank"} behind the scenes.
12+
This controller is installed as part of the runtime and automatically managed by Codefresh.
13+
14+
### How Sealed Secrets work
15+
16+
Sealed Secrets are based on [public/private key encryption](https://en.wikipedia.org/wiki/Public-key_cryptography){:target="_blank"}. When the controller is installed, it gets a public and private key. The private key stays within the cluster. The public key can be given anywhere to encrypt secrets.
17+
18+
Any kind of secret can be encrypted with the public key (also via the `kubeseal` executable), and then passed to the cluster for decryption when needed.
19+
20+
For GitOps applications, encryption for secrets is critical, as it means that you can commit any kind of secret in Git as long as it is encrypted.
21+
22+
Here's the event flow for Sealed Secrets:
23+
24+
1. A secret is encrypted by an operator and/or developer with the `kubeseal` executable.
25+
1. A custom Kubernetes resource called SealedSecret is created.
26+
1. The secret is committed in Git.
27+
1. During application deployment, the Codefresh runtime applies this secret to the cluster.
28+
1. The Sealed Secret controller identifies the Sealed Secret object and decrypts it using the private key of the cluster.
29+
1. The Sealed Secret is converted to a [standard Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/) {:target="_blank"} inside the cluster.
30+
1. It is then passed to the application like any other secret, as a mounted file or environment variable.
31+
1. The application uses the secret in its decrypted form.
32+
33+
For more details, you can read our [blog post for sealed secrets](https://codefresh.io/blog/handle-secrets-like-pro-using-gitops/){:target="_blank"}.
34+
35+
### Configuring the Sealed Secrets controller
36+
37+
The Sealed Secret controller is fully managed by the Codefresh runtime, and secret encryption and decryption are fully automated.
38+
39+
> **Warning!** DO NOT tamper with the controller or its private/public keys in any way.
40+
41+
The applications you deploy with Codefresh should also have no knowledge of the controller. All secrets that you need in your own applications should be accessed using the standard Kubernetes methods.
42+
43+
### What to read next
44+
[Set up a hosted (Hosted GitOps environment]({{site.baseurl}}/docs/runtime/hosted-runtime)
45+
[Install hybrid runtimes]({{site.baseurl}}/docs/runtime/installation)
46+
[Image enrichment with integrations]({{site.baseurl}}/docs/integrations/image-enrichment-overview)
47+

0 commit comments

Comments
 (0)