[Starlingx-discuss] Setting up StarlingX mirroring to GitHub

Jeremy Stanley fungi at yuggoth.org
Tue Feb 4 21:13:43 UTC 2020


On 2020-02-04 12:04:15 -0800 (-0800), Saul Wold wrote:
> I got a look at the one of the reviews for this and I wonder if we
> can do this via a template in zuul-jobs so that we have have one
> secret shared for all the github mirror jobs?
> 
> If needed we can check with the Infra team, and perhaps you
> already have.
[...]

The reason is explained in Zuul's documentation on secrets:

    "If a job with secrets is defined in an untrusted-project,
    allowed-projects is automatically set to that project only, and
    can not be overridden (though a config-project may still add the
    job to any project’s pipeline regardless of this setting; do so
    with caution as other projects may expose the source project’s
    secrets)."

    https://zuul-ci.org/docs/zuul/reference/secret_def.html

This is a safety measure, to prevent job definition changes merged
to one project from being able to expose secrets belonging to
another project. Also secrets are tied to the repository in which
they're defined, encrypted with different keys per project, so
copying the same secret into a different repository will only yield
undecryptable garbage. Further, for related safety reasons, secrets
can't be used by child job definitions or job variants, meaning that
it would be impossible to override some variables in a secret-using
job (for example, the git_mirror_repository variable on which the
upload-git-mirror parent job relies) with a job variant in another
repository.
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20200204/b68df198/attachment.sig>


More information about the Starlingx-discuss mailing list