On-cluster build: Code from private Git repository

[lance]

git-clone supports credentials, auth: https://hub.tekton.dev/tekton/task/git-clone

There should be a user friendly way how to add credentials that will be used by pipeline. Users shouldn't create additinonal resources themselves, all of it should be handled by func cli.

[github-actions[bot]]

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Reopen the issue with /reopen. Mark the issue as fresh by adding the comment /remove-lifecycle stale.

[zroubalik]

/remove-lifecycle stale

@Shashankft9 any update on this please?

[gab-satchi]

I can take this on if you'd like @Shashankft9

Couple of questions:

• Should we be adding support for ssh credentials, basic auth or both?

Users shouldn't create additinonal resources themselves, all of it should be handled by func cli

I assumed the user should still create a Secret with the ssh credentials (or basic auth creds). And maybe the name of the Secret can be a part of func.yaml and/or cli option?

[Shashankft9]

sure Gab, and thanks /unassign /assign @gab-satchi

[zroubalik]

@gab-satchi I'd prefer if we can actually create the secret for user. Or try to think about the best solution from users perspective.

Image that the user does have very limited knowledge of k8s.

[github-actions[bot]]

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Reopen the issue with /reopen. Mark the issue as fresh by adding the comment /remove-lifecycle stale.

[zroubalik]

/remove-lifecycle stale

[Shashankft9]

@zroubalik I tried something and I wanted to share if it would be good for upstream as well - let me know what you think:

(only tested with basic auth right now, but should in principle work with ssh as well)

User will have to create a secret like this:

kind: Secret
apiVersion: v1
metadata:
  name: my-basic-auth-secret
type: Opaque
stringData:
  .gitconfig: |
    [credential "https://gitlab.com"]
      helper = store
  .git-credentials: |
    https://username:[email protected]

Change the func.yaml to include secretName under git.

Following changes are to be done to a functions pipeline and pipelinerun only if the above git.secretName is specified, otherwise it stays the same. The secretName is reflected in the pipelinerun.

Change the pipeline that gets created for every function to look something like this:

  tasks:
  - name: fetch-sources
    params:
    - name: url
      value: $(params.gitRepository)
    - name: revision
      value: $(params.gitRevision)
    taskRef:
      kind: Task
      name: git-clone
    workspaces:
    - name: output
      workspace: source-workspace
    - name: basic-auth
      workspace: basic-auth-workspace
...
  workspaces:
  - description: Directory where function source is located.
    name: source-workspace
  - description: Directory containing image registry credentials stored in `config.json`
      file.
    name: dockerconfig-workspace
    optional: true
  - description: Directory where Buildpacks cache is stored.
    name: cache-workspace
  - name: basic-auth-workspace

Change the pipeline that gets created to something like this:

  workspaces:
  - name: source-workspace
    persistentVolumeClaim:
      claimName: test-pack-git-pipeline-pvc
    subPath: source
  - name: dockerconfig-workspace
    secret:
      secretName: test-pack-git-pipeline-secret
  - name: cache-workspace
    persistentVolumeClaim:
      claimName: test-pack-git-pipeline-pvc
    subPath: cache
  - name: basic-auth-workspace
    secret:
      secretName: my-basic-auth-secret

[lkingland]

Unassigning due to inactivity Please feel free to re-assign yourself if you're still working on it @gab-satchi !

[github-actions[bot]]

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Reopen the issue with /reopen. Mark the issue as fresh by adding the comment /remove-lifecycle stale.

[Shashankft9]

/remove-lifecycle stale

[github-actions[bot]]

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Reopen the issue with /reopen. Mark the issue as fresh by adding the comment /remove-lifecycle stale.

[Shashankft9]

remove-lifecycle stale

[github-actions[bot]]

This issue is stale because it has been open for 90 days with no activity. It will automatically close after 30 more days of inactivity. Reopen the issue with /reopen. Mark the issue as fresh by adding the comment /remove-lifecycle stale.