Hi Saul, We have followed instruction given to us by Infra team, and if you look at what airship has done, it is same as what we are doing. But having said that if you can help us getting an example of how that is done, and even better if you can do one repo as an example we will follow your lead. Thanks, Dariush -----Original Message----- From: Saul Wold [mailto:sgw@linux.intel.com] Sent: February-04-20 3:04 PM To: starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] Setting up StarlingX mirroring to GitHub Hi Darish, Bin: I got a look at the one of the reviews for this and I wonder if we can do this via a template in zuul-jobs so that we have have one secret shared for all the github mirror jobs? If needed we can check with the Infra team, and perhaps you already have. Sau! On 2/4/20 10:07 AM, Eslimi, Dariush wrote:

Hi All,

As part of effort to apply for CNCF Certified Kubernetes logo, we need to mirror our repositories to GitHub, I have created a story to track our progress, and so far we have completed one repo : ha

Here is the link to StarlingX GitHub : https://github.com/starlingx

Here is storyboard link : https://storyboard.openstack.org/#!/story/2007252

Bin will go through each repo to setup the mirroring job as part of zuul configuration, cores please review his commits as they get posted.

You can get the list of commits using this link: https://review.opendev.org/#/q/projects:starlingx+AND++topic:github-mi rror+(status:open+OR+status:merged)

Bin will update the developers wiki to add instructions on what has to be done to setup mirroring for your newly created repo.

Thanks,

Dariush

_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss

_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss

On 2/4/20 1:13 PM, Jeremy Stanley wrote:

On 2020-02-04 12:04:15 -0800 (-0800), Saul Wold wrote:

...

I got a look at the one of the reviews for this and I wonder if we can do this via a template in zuul-jobs so that we have have one secret shared for all the github mirror jobs?

If needed we can check with the Infra team, and perhaps you already have. [...]

The reason is explained in Zuul's documentation on secrets:

"If a job with secrets is defined in an untrusted-project, allowed-projects is automatically set to that project only, and can not be overridden (though a config-project may still add the job to any project’s pipeline regardless of this setting; do so with caution as other projects may expose the source project’s secrets)."

https://zuul-ci.org/docs/zuul/reference/secret_def.html

This is a safety measure, to prevent job definition changes merged to one project from being able to expose secrets belonging to another project. Also secrets are tied to the repository in which they're defined, encrypted with different keys per project, so copying the same secret into a different repository will only yield undecryptable garbage. Further, for related safety reasons, secrets can't be used by child job definitions or job variants, meaning that it would be impossible to override some variables in a secret-using job (for example, the git_mirror_repository variable on which the upload-git-mirror parent job relies) with a job variant in another repository.

So based on this, I guess there is no point in trying to create a template and common secret, I will +2 the existing work. I was not fully aware of the above limitation, I was thinking about template-ing a common task. Sau!

_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss