[Starlingx-discuss] Setting up StarlingX mirroring to GitHub

[Saul Wold]

On 2/4/20 1:13 PM, Jeremy Stanley wrote:
> On 2020-02-04 12:04:15 -0800 (-0800), Saul Wold wrote:
>> I got a look at the one of the reviews for this and I wonder if we
>> can do this via a template in zuul-jobs so that we have have one
>> secret shared for all the github mirror jobs?
>>
>> If needed we can check with the Infra team, and perhaps you
>> already have.
> [...]
> 
> The reason is explained in Zuul's documentation on secrets:
> 
>      "If a job with secrets is defined in an untrusted-project,
>      allowed-projects is automatically set to that project only, and
>      can not be overridden (though a config-project may still add the
>      job to any project’s pipeline regardless of this setting; do so
>      with caution as other projects may expose the source project’s
>      secrets)."
> 
>      https://zuul-ci.org/docs/zuul/reference/secret_def.html
> 
> This is a safety measure, to prevent job definition changes merged
> to one project from being able to expose secrets belonging to
> another project. Also secrets are tied to the repository in which
> they're defined, encrypted with different keys per project, so
> copying the same secret into a different repository will only yield
> undecryptable garbage. Further, for related safety reasons, secrets
> can't be used by child job definitions or job variants, meaning that
> it would be impossible to override some variables in a secret-using
> job (for example, the git_mirror_repository variable on which the
> upload-git-mirror parent job relies) with a job variant in another
> repository.
> 
So based on this, I guess there is no point in trying to create a 
template and common secret, I will +2 the existing work. I was not fully 
aware of the above limitation, I was thinking about template-ing a 
common task.

Sau!

> 
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
>