@@ -10,15 +10,21 @@ The OpenShift Pipelines configuration is a requirement in order to support CI/CD
10
10
kubectl get route -n openshift-pipelines pipelines-as-code-controller
11
11
```
12
12
13
- 3 . Download ` cosign ` , which will be used to generate the updated ` signing-secrets ` .
13
+ 3 . Download ` cosign ` depending on your platform , which will be used to generate the updated ` signing-secrets ` .
14
14
15
15
```
16
16
curl -sL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 -o /usr/bin/cosign && chmod +x /usr/bin/cosign
17
17
```
18
18
19
- 4 . In your Operator's Namespace, delete (if exists) the ` signing-secrets ` Secret.
19
+ or
20
20
21
- 5 . Generate the new ` signing-secrets ` inside the Operator's Namespace and patch the new secret as immutable:
21
+ ```
22
+ curl -sL https://github.com/sigstore/cosign/releases/latest/download/cosign-darwin-amd64 -o /usr/bin/cosign && chmod +x /usr/bin/cosign
23
+ ```
24
+
25
+ 4 . In the ` openshift-pipelines ` Namespace, delete (if exists) the ` signing-secrets ` Secret.
26
+
27
+ 5 . Generate the new ` signing-secrets ` in the ` openshift-pipelines ` Namespace and patch the new secret as immutable:
22
28
23
29
```
24
30
export KUBERNETES_SERVICE_PORT=<your-kubernetes-service port>
@@ -30,10 +36,10 @@ kubectl patch secret -n openshift-pipelines signing-secrets -o yaml --patch='{"i
30
36
6 . Ensure that the ` tektonconfigs ` CRDs are available. You can verify that if the below command returns 1 as response:
31
37
32
38
```
33
- kubectl api-resources | grep -c "^ tektonconfigs "
39
+ kubectl api-resources | grep " tektonconfigs"
34
40
```
35
41
36
- 7 . Update the ` TektonConfig ` , by enabling the necessary resolvers and use a targeted namespace :
42
+ 7 . Update the ` TektonConfig ` , by enabling the necessary resolvers:
37
43
38
44
```
39
45
kubectl patch tektonconfig config --type 'merge' --patch "$( cat <<EOF
@@ -74,7 +80,7 @@ export GITHUB_APP_APP_ID=<your-github-app's-app-id-value>
74
80
export GITHUB_APP_PRIVATE_KEY="
75
81
<your-multi-lined-github-app-private-key>
76
82
"
77
- kubectl -n "$PIPELINES_NAMESPACE" create secret generic pipelines-as-code-secret \
83
+ kubectl -n openshift-pipelines create secret generic pipelines-as-code-secret \
78
84
--from-literal github-application-id="$GITHUB_APP_APP_ID" \
79
85
--from-literal github-private-key="$GITHUB_APP_PRIVATE_KEY" \
80
86
--from-literal webhook.secret="$GITHUB_APP_WEBHOOK_SECRET"
@@ -83,7 +89,7 @@ kubectl -n "$PIPELINES_NAMESPACE" create secret generic pipelines-as-code-secret
83
89
10 . Fetch the codesign public key from the ` signing-secrets ` Secret inside the Operator's Namespace.
84
90
85
91
```
86
- export COSIGN_SIGNING_PUBLIC_KEY=$(kubectl get secrets -n $PIPELINES_NAMESPACE signing-secrets -o jsonpath='{.data.cosign\.pub}')
92
+ export COSIGN_SIGNING_PUBLIC_KEY=$(kubectl get secrets -n openshift-pipelines signing-secrets -o jsonpath='{.data.cosign\.pub}')
87
93
cat <<EOF | kubectl apply -f - >/dev/null
88
94
apiVersion: v1
89
95
data:
@@ -106,14 +112,14 @@ EOF
106
112
kubectl -n $APP_NAMESPACE create secret generic pipelines-secret --from-literal=webhook.secret=$GITHUB_APP_WEBHOOK_SECRET
107
113
```
108
114
109
- 12 . Similarly with the previous step, create the ` image-registry-token ` in your application's Namespace, containing the docker ` config.json ` file of your Quay.io account (see more info [ here] ( https://docs.redhat.com/en/documentation/red_hat_quay/3.6/html-single/use_red_hat_quay/index#allow-robot-access-user-repo ) ):
115
+ 12 . Similarly with the previous step, create the ` ai-lab- image-registry-token` in your application's Namespace, containing the docker ` config.json ` file of your Quay.io account (see more info [ here] ( https://docs.redhat.com/en/documentation/red_hat_quay/3.6/html-single/use_red_hat_quay/index#allow-robot-access-user-repo ) ):
110
116
111
117
```
112
118
export IMAGE_REGISTRY_TOKEN_SECRET="ai-lab-image-registry-token"
113
119
kubectl -n $APP_NAMESPACE create secret docker-registry "$IMAGE_REGISTRY_TOKEN_SECRET" --from-file=.dockerconfigjson=<your-docker-config.json-file-path>
114
120
```
115
121
116
- 13 . Patch the ` default ` and ` pipeline ` ServiceAccounts by adding to them the image registry token secret created above:
122
+ 1 . Patch the ` default ` and ` pipeline ` ServiceAccounts in your application Namespace by adding the image registry token secret created above:
117
123
118
124
```
119
125
for SA in default pipeline; do
0 commit comments