RHDEVDOCS-4233| Documented guidance on authentication strategies for pipelines #57140

gtrivedi88 · 2023-03-14T11:07:01Z

Aligned team: Dev Tools
OCP version for cherry-picking: enterprise-4.10, enterprise-4.11, enterprise-4.12, and enterprise-4.13
JIRA issue: RHDEVDOCS-4233
Preview pages: Click to preview the docs in your browser
SME review: @vdemeester
QE review: @ppitonak @VeereshAradhya
Peer review:

ocpdocs-previewbot · 2023-03-14T11:19:44Z

🤖 Updated build preview is available at:
https://57140--docspreview.netlify.app

Build log: https://circleci.com/gh/ocpdocs-previewbot/openshift-docs/13649

cicd/pipelines/authenticating-pipelines-and-tasks-using-secrets.adoc

…(git, image registry)

gtrivedi88 · 2023-04-10T08:42:21Z

@ppitonak @VeereshAradhya This PR is ready for QE review.
Thank you for your help!

ppitonak

I would reorder sections so that all related to git are following each other and section about docker is either first or last
The doc talks about binding secret to workspace but it doesn't show how.

ppitonak · 2023-06-20T11:12:46Z

modules/op-using-secrets-and-workspaces.adoc

+
+. Create a Task called `git-clone` that clones a git repository using SSH authentication. 
+
+. Define workspaces, describe the process to create a secret, and bind it to the workspace. For example:


I don't understand this part describe the process to create a secret

I split this point into two - one would only talk about how to create a secret, another one would talk about workspace declaration in task and binding.

Noted,
Resolved

ppitonak · 2023-06-20T11:13:05Z

modules/op-using-secrets-and-workspaces.adoc

+
+[NOTE]
+====
+To create the above secret, run `$ kubectl create secret generic my-github-ssh-credentials \


We usually use oc instead of kubectl

ppitonak · 2023-06-20T11:14:33Z

modules/op-using-secrets-and-workspaces.adoc

+
+== git-clone Task
+
+This approach involves creating a task called `git-clone`, which clones a git repository using SSH authentication. The following are the steps to use Secrets and Workspace in Tekton Pipelines:


We already ship git-clone clustertask, can't we just show how it looks like and describe how to use secrets with it?

Hello @vdemeester , can we use the already existing git-clone clustertask in this case?

@ppitonak , according to tekton documentation, clustertasks are deprecated. As Red Hat, are we still shipping them downstream? (CC @mramendi )

Yes, we still ship them

ppitonak · 2023-06-20T11:15:42Z

modules/op-using-secrets-and-workspaces.adoc

+      --param url=git@github.com:<username>/buildkit-tekton \
+      --workspace name=output,emptyDir="" \
+      --workspace name=ssh-directory,secret=my-github-ssh-credentials \
+      --use-param-defaults --showlog`


This command is rendered on a single line, in that case backslashes are not necessary

Noted,
Addressed

ppitonak · 2023-06-20T11:17:24Z

modules/op-using-secrets-and-workspaces.adoc

+
+Following are the steps involved in using a Docker configuration file inside a Tekton pipeline task.
+
+. Define a Tekton Task in your Kubernetes cluster with a reference to Skopeo image that copies a docker image to a specified repository.


Kubernetes cluster -> OpenShift cluster

ppitonak · 2023-06-20T11:35:54Z

modules/op-using-secrets-and-workspaces.adoc

+              mountPath: /optional-workspace
+----
+
+.Example: A modified git clone task  to incorporate the optional Workspace feature.


Why do we have 2 examples here? 🤔

ppitonak · 2023-06-20T11:37:29Z

modules/op-using-secrets-and-workspaces.adoc

+          cp "$(workspaces.basic_auth.path)/.gitconfig" "${HOME}/.gitconfig"
+          chmod 400 "${HOME}/.git-credentials"
+          chmod 400 "${HOME}/.gitconfig"
+        fi


This is basically a code from our own task but I miss the context here.

ppitonak · 2023-06-20T11:38:47Z

modules/op-using-serviceaccounts.adoc

+
+* kubernetes.io/basic-auth : basic authentications 
+
+* kubernetes.io/dockercfg : serialized ~/.dockercfg file kubernetes.io/dockerconfigjson : serialized ~/.docker/config.json file


kubernetes.io/dockerconfigjson should be a new bullet point

ppitonak · 2023-06-20T11:43:05Z

modules/op-using-serviceaccounts.adoc

+----
+# For a TaskRun
+
+apiVersion: tekton.dev/v1beta1


update to v1

ppitonak · 2023-06-20T11:43:17Z

modules/op-using-serviceaccounts.adoc

+metadata:
+  name: build-with-basic-auth
+spec:
+  serviceAccountName: build-bot


v1 API uses different syntax https://tekton.dev/docs/pipelines/migrating-v1beta1-to-v1/#changes-to-fields

openshift-bot · 2023-09-19T01:00:16Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

masauso-lungu · 2023-10-04T11:22:43Z

/remove-lifecycle stale

openshift-merge-robot · 2023-10-04T11:22:55Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

masauso-lungu · 2023-10-10T10:08:56Z

This PR is now being tracked with this PR-66069

openshift-bot · 2024-01-09T01:02:00Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2024-02-08T08:30:32Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

mramendi · 2024-02-08T20:29:34Z

/remove-lifecycle rotten

mramendi · 2024-02-08T20:30:49Z

@gtrivedi88 I mistakenly removed the rotten lifecycle. Could you please close this PR? Teh up-to-date PR on this issue is #70384

gtrivedi88 · 2024-02-09T10:08:48Z

@mramendi As you suggested. I've closed this PR.

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 14, 2023

vdemeester reviewed Mar 17, 2023

View reviewed changes

cicd/pipelines/authenticating-pipelines-and-tasks-using-secrets.adoc Outdated Show resolved Hide resolved

vdemeester approved these changes Mar 22, 2023

View reviewed changes

RHDEVDOCS-4233| Documented guidance on auth strategies for pipelines …

29e04b7

…(git, image registry)

gtrivedi88 force-pushed the RHDEVDOCS-4233 branch from 851bff9 to 29e04b7 Compare April 10, 2023 08:41

ppitonak suggested changes Jun 20, 2023

View reviewed changes

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 19, 2023

openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 4, 2023

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 4, 2023

masauso-lungu mentioned this pull request Oct 9, 2023

Guidance on authentication strategies for pipelines #65960

Closed

masauso-lungu mentioned this pull request Oct 10, 2023

ML-RHDEVDOCS-4233| Documented guidance on authentication strategies for pipel… #66069

Closed

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 9, 2024

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Feb 8, 2024

openshift-ci bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Feb 8, 2024

gtrivedi88 closed this Feb 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RHDEVDOCS-4233| Documented guidance on authentication strategies for pipelines #57140

RHDEVDOCS-4233| Documented guidance on authentication strategies for pipelines #57140

gtrivedi88 commented Mar 14, 2023 •

edited

ocpdocs-previewbot commented Mar 14, 2023 •

edited

gtrivedi88 commented Apr 10, 2023

ppitonak left a comment

ppitonak Jun 20, 2023

masauso-lungu Oct 9, 2023

ppitonak Jun 20, 2023

masauso-lungu Oct 9, 2023

ppitonak Jun 20, 2023

masauso-lungu Oct 9, 2023

masauso-lungu Oct 9, 2023 •

edited

ppitonak Oct 10, 2023

ppitonak Jun 20, 2023

masauso-lungu Oct 9, 2023

ppitonak Jun 20, 2023

masauso-lungu Oct 9, 2023

ppitonak Jun 20, 2023

ppitonak Jun 20, 2023

ppitonak Jun 20, 2023

ppitonak Jun 20, 2023

ppitonak Jun 20, 2023

openshift-bot commented Sep 19, 2023

masauso-lungu commented Oct 4, 2023

openshift-merge-robot commented Oct 4, 2023

masauso-lungu commented Oct 10, 2023 •

edited

openshift-bot commented Jan 9, 2024

openshift-bot commented Feb 8, 2024

mramendi commented Feb 8, 2024

mramendi commented Feb 8, 2024

gtrivedi88 commented Feb 9, 2024


		. Create a Task called `git-clone` that clones a git repository using SSH authentication.

		. Define workspaces, describe the process to create a secret, and bind it to the workspace. For example:


		== git-clone Task

		This approach involves creating a task called `git-clone`, which clones a git repository using SSH authentication. The following are the steps to use Secrets and Workspace in Tekton Pipelines:


		Following are the steps involved in using a Docker configuration file inside a Tekton pipeline task.

		. Define a Tekton Task in your Kubernetes cluster with a reference to Skopeo image that copies a docker image to a specified repository.


		* kubernetes.io/basic-auth : basic authentications

		* kubernetes.io/dockercfg : serialized ~/.dockercfg file kubernetes.io/dockerconfigjson : serialized ~/.docker/config.json file

RHDEVDOCS-4233| Documented guidance on authentication strategies for pipelines #57140

RHDEVDOCS-4233| Documented guidance on authentication strategies for pipelines #57140

Conversation

gtrivedi88 commented Mar 14, 2023 • edited

ocpdocs-previewbot commented Mar 14, 2023 • edited

gtrivedi88 commented Apr 10, 2023

ppitonak left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

masauso-lungu Oct 9, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-bot commented Sep 19, 2023

masauso-lungu commented Oct 4, 2023

openshift-merge-robot commented Oct 4, 2023

masauso-lungu commented Oct 10, 2023 • edited

openshift-bot commented Jan 9, 2024

openshift-bot commented Feb 8, 2024

mramendi commented Feb 8, 2024

mramendi commented Feb 8, 2024

gtrivedi88 commented Feb 9, 2024

gtrivedi88 commented Mar 14, 2023 •

edited

ocpdocs-previewbot commented Mar 14, 2023 •

edited

masauso-lungu Oct 9, 2023 •

edited

masauso-lungu commented Oct 10, 2023 •

edited