cluster/test-deploy/aws/openshift: Set the pull secret as a string

[wking]

Catching up with openshift/installer#208.

I've replaced the inputs.yaml copy with a sed invocation to avoid leaking the internal pull secret into the output artifacts. I'm not sure how sensitive it is though, maybe we don't mind leaking the secret?

/hold

We don't want to merge this until the installer PR lands.

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: wking
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: smarterclayton

If they are not already assigned, you can assign the PR to them by writing /assign @smarterclayton in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[stevekuznetsov]

/uncc

[wking]

openshift/installer#208 landed, so we're good to go here.

/hold cancel

@stevekuznetsov, @smarterclayton, can one of take a look?

[wking]

Maybe I should drop the sed, because we're already leaking the pull secret over here. It will be nice when we can pull all our images anonymously. How close to that are we?

[smarterclayton]

The secret isn't that secure, but it would be better to accept it as a file.

Images in 4.0 will continue to be protected, and the ci infra will likely start using that mechanism as well to ensure it is always functioning.

[wking]

The secret isn't that secure, but it would be better to accept it as a file.

Thoughts on openshift/installer#205 then? Don't set the pull secret there at all?

[openshift-bot]

@wking: PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[wking]

This is obsolete since #1677. While that is still inserting the pull secret as a path, openshift_install is still immediately reading it into a string variable. We're probably still leaking that secret in the CI logs (e.g. somewhere in here), but if that doesn't bother anyone in the release team, that's fine with me ;).