Skip to content

Conversation

@amisevsk
Copy link
Collaborator

@amisevsk amisevsk commented Sep 1, 2022

What does this PR do?

Ignore any mount-path annotations on secrets labelled 'controller.devfile.io/git-credential'. Instead, always mount the merged git credentials secret to /.git-credentials/.

Additionally, mount the credentials file as files rather than using subpath mounts, in order to ensure changes to the on-cluster secret can be propagated to the running workspace without requiring a restart.

What issues does this PR fix or reference?

Closes #915

Is it tested? How?

  1. Create a secret with git-credentials label:
    kind: Secret
    apiVersion: v1
    metadata:
      name: git-credentials-test-secret
      labels:
        controller.devfile.io/git-credential: 'true'
        controller.devfile.io/watch-secret: 'true'
    data:
      credentials: aGVsbG8gd29ybGQK # "hello world"
    type: Opaque
  2. Start a workspace and verify file /.git-credentials/credentials is mounted and contains text "hello world"
  3. Edit the secret in the cluster, changing the value of the credentials key
  4. Update the workspace in any way to trigger a reconcile (e.g. add an annotation)
  5. Check that file /.git-credentials/credentials reflects the new value (this may take some time to propagate down)

PR Checklist

  • E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
    • v8-devworkspace-operator-e2e: DevWorkspace e2e test
    • v8-che-happy-path: Happy path for verification integration with Che

Ignore any mount-path annotations on secrets labelled
'controller.devfile.io/git-credential'. Instead, always mount the merged
git credentials secret to `/.git-credentials`.

Additionally, mount the credentials file as files rather than using
subpath mounts, in order to ensure changes to the on-cluster secret can
be propagated to the running workspace without requiring a restart.

Signed-off-by: Angel Misevski <[email protected]>
@amisevsk amisevsk requested a review from ibuziuk as a code owner September 1, 2022 23:26
@openshift-ci openshift-ci bot added the approved label Sep 1, 2022
@amisevsk amisevsk requested review from AObuchow and dkwon17 September 2, 2022 00:31
Copy link
Collaborator

@AObuchow AObuchow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested (following the PR instructions) and works as expected:

bash-5.1$ cd  /.git-credentials/
bash-5.1$ cat credentials 
hello world

Modified the secret credentials data to: fafghe9gd29ybGQK, added an annotation to the workspace, then:

bash-5.1$ cat credentials 
}����`world

@openshift-ci
Copy link

openshift-ci bot commented Sep 2, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amisevsk, AObuchow, dkwon17

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@amisevsk amisevsk merged commit d342380 into devfile:main Sep 6, 2022
@amisevsk amisevsk deleted the non-subpath-git-credentials branch September 6, 2022 20:04
@l0rd
Copy link
Collaborator

l0rd commented Sep 8, 2022

Should we update the documentation and remove the reference to controller.devfile.io/mount-path?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update how personal access token git credentials are mounted into workspaces

4 participants