You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: cmd/build-init/main.go
+23-1Lines changed: 23 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -36,6 +36,7 @@ var (
36
36
gitRevision=flag.String("git-revision", os.Getenv("GIT_REVISION"), "The Git revision to make the repository HEAD.")
37
37
gitInitializeSubmodules=flag.Bool("git-initialize-submodules", getenvBool("GIT_INITIALIZE_SUBMODULES"), "Initialize submodules during git clone")
38
38
blobURL=flag.String("blob-url", os.Getenv("BLOB_URL"), "The url of the source code blob.")
39
+
blobAuth=flag.Bool("blob-auth", getenvBool("BLOB_AUTH"), "If authentication should be used for blobs")
39
40
stripComponents=flag.Int("strip-components", getenvInt("BLOB_STRIP_COMPONENTS", 0), "The number of directory components to strip from the blobs content when extracting.")
40
41
registryImage=flag.String("registry-image", os.Getenv("REGISTRY_IMAGE"), "The registry location of the source code image.")
41
42
hostName=flag.String("dns-probe-hostname", os.Getenv("DNS_PROBE_HOSTNAME"), "hostname to dns poll")
Copy file name to clipboardExpand all lines: docs/build.md
+4Lines changed: 4 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -95,6 +95,10 @@ The `source` field is a composition of a source code location and a `subpath`. I
95
95
- `git`: (Source Code is a git repository)
96
96
- `url`: The git repository url. Both https and ssh formats are supported; with ssh format requiring a [ssh secret](secrets.md#git-secrets).
97
97
- `revision`: The git revision to use. This value may be a commit sha, branch name, or tag.
98
+
- `auth`: Optional auth to use with blob source. Leave empty for no auth, "secret" for providing auth [via Secret](secrets.md#blob-secrets), or "helper" to use service account IAM (specific to each IaaS).
99
+
> Note: Only [Microsoft Azure](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview)
100
+
> and [Google Cloud Platform](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#kubernetes-sa-to-iam)
101
+
> helpers are currently implemented, contributions are welcome to `pkg/blob/<iaas>_keychain.go`.
98
102
- `subPath`: A subdirectory within the source folder where application code resides. Can be ignored if the source code resides at the `root` level.
Copy file name to clipboardExpand all lines: docs/image.md
+5Lines changed: 5 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -99,11 +99,16 @@ The `source` field is a composition of a source code location and a `subpath`. I
99
99
blob:
100
100
url: ""
101
101
stripComponents: 0
102
+
auth: "" | "secret" | "helper"
102
103
subPath: ""
103
104
```
104
105
- `blob`: (Source Code is a blob/jar in a blobstore)
105
106
- `url`: The URL of the source code blob. This blob needs to either be publicly accessible or have the access token in the URL
106
107
- `stripComponents`: Optional number of directory components to strip from the blobs content when extracting.
108
+
- `auth`: Optional auth to use with blob source. Leave empty for no auth, "secret" for providing auth [via Secret](secrets.md#blob-secrets), or "helper" to use service account IAM (specific to each IaaS).
109
+
> Note: Only [Microsoft Azure](https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview)
110
+
> and [Google Cloud Platform](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#kubernetes-sa-to-iam)
111
+
> helpers are currently implemented, contributions are welcome to `pkg/blob/<iaas>_keychain.go`.
107
112
- `subPath`: A subdirectory within the source folder where application code resides. Can be ignored if the source code resides at the `root` level.
Copy file name to clipboardExpand all lines: docs/secrets.md
+20Lines changed: 20 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -126,6 +126,26 @@ stringData:
126
126
password: <generated-token>
127
127
```
128
128
129
+
### Blob Secrets
130
+
131
+
Secrets are used with a `kpack.io/blob` annotation that references a hostname for a blob location. Only one of username/password, bearer, or authorization is allowed.
132
+
133
+
```yaml
134
+
apiVersion: v1
135
+
kind: Secret
136
+
metadata:
137
+
name: blob-secret
138
+
annotations:
139
+
kpack.io/blob: my-blob-store.com
140
+
stringData:
141
+
username: <username>
142
+
password: <password>
143
+
144
+
bearer: <oauth2 token>
145
+
146
+
authorization: <third-party-auth-header>
147
+
```
148
+
129
149
### Service Account
130
150
131
151
To use these secrets with kpack create a service account and reference the service account in image and build resources. When configuring the image resource, reference the `name` of your registry credential and the `name` of your git credential.
0 commit comments