How to link secret to default pipeline ServiceAccount in an OpenShift template?

user_5170812 0
Viewed 803

Currently I am trying to make sure that the default pipeline account is able to perform the git-clone ClusterTask in a Tekton pipeline. With the following yaml, the task can be performed successfully (the repo gets pulled):

apiVersion: v1
kind: ServiceAccount
metadata:
  name: pipeline
secrets
  - name: git-secret

However, when I use this same configuration in an OpenShift template, e.g.:

apiVersion: v1
kind: Template
metadata:
  name: test-template
objects:
  - apiVersion: v1
    kind: Secret
    type: kubernetes.io/ssh-auth
    metadata:
      name: git-secret
      annotations:
        tekton.dev/git-0: bitbucket.org
    data:
      ssh-privatekey: ${GIT_SSH_KEY}

  - apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: pipeline
    secrets
      - name: git-secret

The secret is not linked with the ServiceAccount and as a result, the pull fails. I tried to give the secret the following annotation:

kubernetes.io/service-account.name: pipeline

But that does not help either. When creating a new ServiceAccount in the template (e.g. pipeline-with-secret), things work perfectly. Also, when linking the secret manually, it also works well. However, I would prefer to have the template set the link correctly to avoid having to do the linking manually. This makes me wonder: is it possible to link a secret to a ServiceAccount that gets created by default?

OpenShift version: 4.5.19

Thanks.

tekton openshift
1 Answers

You are almost there,

The problem is that you miss parameters, see my last section below:

apiVersion: v1
kind: Template
metadata:
  name: test-template
objects:
  - apiVersion: v1
    kind: Secret
    type: kubernetes.io/ssh-auth
    metadata:
      name: git-secret
      annotations:
        tekton.dev/git-0: bitbucket.org
    data:
      ssh-privatekey: ${GIT_SSH_KEY}

  - apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: pipeline
    secrets
      - name: git-secret
parameters:
- name:  GIT_SSH_KEY
  displayName: SSH Private Key
  description: SSH Private key to use for openshift pipelines
  required: true
  value: ssh-private-key...

See the Templates Parameters section here.

To be honest I hate templates, prefer helm which is more as a standard.

user_12235320
Related