Documentation
¶
Index ¶
- Constants
- Variables
- func GenerateBasicAuthSecretName() string
- func GetCurrentNSWebhookSecret(ctx context.Context, k8int kubeinteraction.Interface, run *params.Run) (string, error)
- func GetSecretsAttachedToPipelineRun(ctx context.Context, k kubeinteraction.Interface, pr *tektonv1.PipelineRun) []ktypes.SecretValue
- func MakeBasicAuthSecret(runevent *info.Event, secretName string) (*corev1.Secret, error)
- func ReplaceSecretsInText(text string, values []ktypes.SecretValue) string
- func ResolveInheritedSecret(repo, globalRepo *v1alpha1.Repository) (string, bool, error)
- type SecretFromRepository
Constants ¶
const ( DefaultGitProviderSecretKey = "provider.token" DefaultGitProviderWebhookSecretKey = "webhook.secret" )
Variables ¶
var ErrSecretNotFound = errors.New("secret not found")
ErrSecretNotFound indicates that a Repository's secret is misconfigured. For example if a required secret is not specified or the required secret does not exist.
Functions ¶
func GenerateBasicAuthSecretName ¶
func GenerateBasicAuthSecretName() string
func GetCurrentNSWebhookSecret ¶ added in v0.46.0
func GetCurrentNSWebhookSecret(ctx context.Context, k8int kubeinteraction.Interface, run *params.Run) (string, error)
GetCurrentNSWebhookSecret get secret from namespace as stored on context.
func GetSecretsAttachedToPipelineRun ¶
func GetSecretsAttachedToPipelineRun(ctx context.Context, k kubeinteraction.Interface, pr *tektonv1.PipelineRun) []ktypes.SecretValue
GetSecretsAttachedToPipelineRun get all secrets attached to a PipelineRun and grab their values attached to it.
func MakeBasicAuthSecret ¶
MakeBasicAuthSecret Make a secret for git-clone basic-auth workspace.
func ReplaceSecretsInText ¶
func ReplaceSecretsInText(text string, values []ktypes.SecretValue) string
ReplaceSecretsInText this will take a text snippet and hide the leaked secret.
func ResolveInheritedSecret ¶ added in v0.51.0
func ResolveInheritedSecret(repo, globalRepo *v1alpha1.Repository) (string, bool, error)
ResolveInheritedSecret decides which namespace holds the git_provider secret of repo, and refuses the one combination that is not safe.
A Repository that omits git_provider.secret inherits the one of the global Repository, which lives in the controller namespace and is shared by every tenant. If that Repository is also allowed to choose git_provider.url, then whoever can create a Repository in any namespace can have an administrator's token sent to a host, or over a transport, of their choosing. Inheriting the credential and overriding the endpoint it is sent to are only safe apart.
Every path that resolves a provider secret must go through here: the adapter and the watcher each used to carry their own copy of this decision, and a guard that only one of them applies is not a guard.
Types ¶
type SecretFromRepository ¶ added in v0.46.0
type SecretFromRepository struct {
K8int kubeinteraction.Interface
Config *info.ProviderConfig
Event *info.Event
Repo *apipac.Repository
WebhookType string
Namespace string
InheritedGlobalSecret bool
Logger *zap.SugaredLogger
}
Source Files
Directories