test-infra icon indicating copy to clipboard operation
test-infra copied to clipboard

Use repository owner in PrincipalSet for access to ado pat

Open dekiel opened this issue 8 months ago • 0 comments

Description

Access to the ADO PAT stored in GCP secret manager is granted using WIF PrincipalSet attribute. The attribute used in PrincipalSet must contain repository owner for the accessing workflow and reusable workflow ref. This can be done by creating wif identity pool custom attribute mapping. The custom attribute must contain a repository owner and reusable workflow ref. Custom attribute definition can be done similar to the definition of subject attribute.

Reasons

This is needed to make sure the token is provided to the image-builder reusable workflow running as part of workflow running for repository owned by kyma-project.

Acceptance Criteria

  • [ ] WIF provider for github.com/kyma-project has a custom attribute build from repository owner and reusable workflow ref values.
  • [ ] Access to the secret with ado pat is granted only to the image-builder reusable workflow running as part of workflow executed for repository owned by kyma-project.

dekiel avatar Jun 10 '24 10:06 dekiel