fix(Konflux 5917): add an example how user can use a secret in pipeline #208

kasemAlem · 2025-01-15T19:35:15Z

We added a tekton task as an example how user can use the created secrets
within a build or integration pipeline

github-actions · 2025-01-15T19:36:38Z

🚀 Preview is available at https://pr-208--konflux-docs.netlify.app

arewm · 2025-01-16T03:36:37Z

docs/modules/ROOT/pages/how-tos/configuring/creating-secrets.adoc

+    - name: registry-credentials
+      secret:
+        secretName: registry.redhat.io


This is how you use a secret, but what does this secret look like that you are using? Is it clear how values need to match up between the secret and its use?

+1. I think only one secret name in volumes might not enough as one example.

I'm confused, maybe I'm missing something
In the current documentation of creating secrets it's detailed step by step how user can create a secret of each type, also there is a good example stated in a note frame :

One such task is the [sast-snyk-check](https://github.com/konflux-ci/build-definitions/tree/main/task/sast-snyk-check) task that uses the third-party service [snyk](https://snyk.io/) to perform static application security testing (SAST) as a part of the default {ProductName} pipeline. Use this procedure to upload your snyk.io token. Name the secret snyk-secret so that the snyk task in the {ProductName} pipeline will recognize it and use it.

It's an example how a third party tool in task requires a specific secret and how it's been used within the task , isn't ?

Would providing a link to the Creating registry pull secrets section of the guide either above or below this example do the job of clarifying how the secret should look like?

What does the secret CR need to look like? Maybe this is just a lack of knowledge/experience coming from me. Maybe this is documented well for k8s.

What I understand here is that you are describing use of a secret by its name, but are there specific properties of how that secret is created in k8s that need to be reflected in the task?

Also, for your awareness, in #214 we have started to link the different places that secrets are documented in this page.

Thanks @arewm , hope the new fix can be clear for a user :

github-actions · 2025-01-28T18:20:49Z

🚀 Preview is available at https://pr-208--konflux-docs.netlify.app

arewm · 2025-01-28T20:16:46Z

docs/modules/ROOT/pages/how-tos/configuring/creating-secrets.adoc

@@ -30,13 +30,6 @@ NOTE: One such task is the link:https://github.com/konflux-ci/build-definitions/
 . Optional: Under **Labels**, add a label to tag or provide more context for your secret.
 . Click **Add secret**.

-=== Notable task input secrets


Did you mean to delete this?

was deleted by mistake , returned
thanks

arewm · 2025-01-28T20:21:36Z

docs/modules/ROOT/pages/how-tos/configuring/creating-secrets.adoc

@@ -54,6 +47,61 @@ Some container builds may use parent images from registries that require authent
 . Enter the password for the registry in **Password**.
 . Click **Add secret**.

+== Example of creating a quay.io secret 


Is this a bad example? Can users not get access to a registry secret without this additional task changes? When adding the secret with the UI, we link it with the ServiceAccount and it is then available in the task.

We do not, for example, do this in the buildah tasks: https://github.com/konflux-ci/build-definitions/blob/main/task/buildah-oci-ta/0.3/buildah-oci-ta.yaml#L159-L184

you are right,
the fact is that secrets created via UI are automatically linked to the SA
so no action is required , I've removed the task example and updated the note
@arewm . WDYT?

github-actions · 2025-01-29T07:49:04Z

🚀 Preview is available at https://pr-208--konflux-docs.netlify.app

github-actions · 2025-01-29T14:04:50Z

🚀 Preview is available at https://pr-208--konflux-docs.netlify.app

docs/modules/ROOT/pages/how-tos/configuring/creating-secrets.adoc

arewm · 2025-02-04T15:50:19Z

docs/modules/ROOT/pages/how-tos/configuring/creating-secrets.adoc

+* **Manual Secret Creation**  
+  If you create the secret manually (e.g., via `kubectl` or YAML), you must **manually link it** to the `appstudio-pipeline` ServiceAccount in your namespace.


Do secrets always need to be linked to the ServiceAccount in order for it to be used by a task?

another options :

Create secret is in namespace and just have to make sure SA got the right access permissions by Role/RoleBinding

Secret as Env environment

let me add both ways

Signed-off-by: Kasem Alem <[email protected]>

This reverts commit adbb34e.

github-actions · 2025-02-05T09:49:59Z

🚀 Preview is available at https://pr-208--konflux-docs.netlify.app

dirgim

LGTM

arewm · 2025-02-05T12:27:38Z

docs/modules/ROOT/pages/how-tos/configuring/creating-secrets.adoc

-
-please review the xref:/troubleshooting/index.adoc#check-if-the-secret-is-linked-to-the-service-account[troubleshooting section]) for more info.
+* **Automatic Secret Linking via UI**  
+  The Konflux UI automatically links image pull secrets to the `appstudio-pipeline` ServiceAccount.  


Last change before we can merge, please use {ProductName} instead of Konflux for consistency.

nice catch,
fixed

Signed-off-by: Kasem Alem <[email protected]>

github-actions · 2025-02-05T13:07:48Z

🚀 Preview is available at https://pr-208--konflux-docs.netlify.app

arewm

thanks!

kasemAlem changed the title ~~Konflux 5917~~ fix(Konflux 5917): add an example how user can use a secret in pipeline Jan 15, 2025

Josh-Everett approved these changes Jan 15, 2025

View reviewed changes

arewm reviewed Jan 16, 2025

View reviewed changes

kasemAlem requested review from hongweiliu17, Josh-Everett and arewm January 21, 2025 11:29

kasemAlem force-pushed the KONFLUX-5917 branch from e727907 to b94be67 Compare January 28, 2025 18:19

arewm reviewed Jan 28, 2025

View reviewed changes

kasemAlem force-pushed the KONFLUX-5917 branch from b94be67 to de9bd79 Compare January 29, 2025 07:47

kasemAlem force-pushed the KONFLUX-5917 branch 3 times, most recently from bebbc53 to df60879 Compare January 29, 2025 14:03

dirgim reviewed Jan 30, 2025

View reviewed changes

docs/modules/ROOT/pages/how-tos/configuring/creating-secrets.adoc Outdated Show resolved Hide resolved

arewm reviewed Feb 4, 2025

View reviewed changes

arewm mentioned this pull request Feb 4, 2025

doc(konflux-5673): document process for accessing private repo #217

Open

Kasem Alem added 2 commits February 5, 2025 11:48

feat(KONFLUX-5917): add secrets uses examples

fe0bc5e

Signed-off-by: Kasem Alem <[email protected]>

Revert "feat(KONFLUX-5917): add secrets uses examples"

ffddfa2

This reverts commit adbb34e.

kasemAlem force-pushed the KONFLUX-5917 branch from df60879 to a73827f Compare February 5, 2025 09:48

dirgim approved these changes Feb 5, 2025

View reviewed changes

arewm reviewed Feb 5, 2025

View reviewed changes

fix(KONFLUX-5917): adding tekton example of using secret

5ccab9d

Signed-off-by: Kasem Alem <[email protected]>

kasemAlem force-pushed the KONFLUX-5917 branch from a73827f to 5ccab9d Compare February 5, 2025 13:06

arewm approved these changes Feb 5, 2025

View reviewed changes

arewm merged commit a308f2d into konflux-ci:main Feb 5, 2025
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(Konflux 5917): add an example how user can use a secret in pipeline #208

fix(Konflux 5917): add an example how user can use a secret in pipeline #208

kasemAlem commented Jan 15, 2025 •

edited

Loading

github-actions bot commented Jan 15, 2025

arewm Jan 16, 2025

hongweiliu17 Jan 16, 2025

kasemAlem Jan 21, 2025

dirgim Jan 21, 2025

kasemAlem Jan 27, 2025

arewm Jan 28, 2025

kasemAlem Jan 28, 2025 •

edited

Loading

github-actions bot commented Jan 28, 2025

arewm Jan 28, 2025

kasemAlem Jan 29, 2025 •

edited

Loading

arewm Jan 28, 2025

kasemAlem Jan 29, 2025

github-actions bot commented Jan 29, 2025

github-actions bot commented Jan 29, 2025

arewm Feb 4, 2025

kasemAlem Feb 4, 2025

kasemAlem Feb 5, 2025

github-actions bot commented Feb 5, 2025

dirgim left a comment

arewm Feb 5, 2025

kasemAlem Feb 5, 2025 •

edited

Loading

github-actions bot commented Feb 5, 2025

arewm left a comment

		* Manual Secret Creation
		If you create the secret manually (e.g., via `kubectl` or YAML), you must manually link it to the `appstudio-pipeline` ServiceAccount in your namespace.

fix(Konflux 5917): add an example how user can use a secret in pipeline #208

fix(Konflux 5917): add an example how user can use a secret in pipeline #208

Conversation

kasemAlem commented Jan 15, 2025 • edited Loading

github-actions bot commented Jan 15, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kasemAlem Jan 28, 2025 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented Jan 28, 2025

Choose a reason for hiding this comment

kasemAlem Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Jan 29, 2025

github-actions bot commented Jan 29, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Feb 5, 2025

dirgim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kasemAlem Feb 5, 2025 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented Feb 5, 2025

arewm left a comment

Choose a reason for hiding this comment

kasemAlem commented Jan 15, 2025 •

edited

Loading

kasemAlem Jan 28, 2025 •

edited

Loading

kasemAlem Jan 29, 2025 •

edited

Loading

kasemAlem Feb 5, 2025 •

edited

Loading