From a9d838b2c8cdb8c913964e1f6d7e3539be064016 Mon Sep 17 00:00:00 2001 From: David Simansky Date: Fri, 3 Jul 2026 19:00:15 +0200 Subject: [PATCH] Document new SA name for konflux apply --- cmd/konflux-apply/README.md | 12 ++++++------ .../manifests/gh-action-rolebinding.yaml | 2 +- .../manifests/gh-action-serviceaccount.yaml | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/cmd/konflux-apply/README.md b/cmd/konflux-apply/README.md index 805c3ac5b..a26c04abb 100644 --- a/cmd/konflux-apply/README.md +++ b/cmd/konflux-apply/README.md @@ -4,7 +4,7 @@ The Konflux manifests are applied automatically via the [konflux-apply](../../.g For this workflow, we use a token for Konflux setup as described in [the docs](https://konflux.pages.redhat.com/docs/users/getting-started/getting-access.html#accessing-konflux-via-cli). Therefor we need to setup a service account, role & rolebinding: -1. Service account `gh-action`: +1. Service account `konflux-bot-0`: ```shell kubectl apply -f ./cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml ``` @@ -16,22 +16,22 @@ For this workflow, we use a token for Konflux setup as described in [the docs](h ```shell kubectl apply -f ./cmd/konflux-apply/manifests/gh-action-rolebinding.yaml ``` -4. Use the token from the `gh-action` Service account as the `KONFLUX_SA_TOKEN` repository secret used by the Github workflow +4. Use the token from the `konflux-bot-0` Service account as the `KONFLUX_SA_TOKEN` repository secret used by the Github workflow ```shell - kubectl create token gh-action --duration $((6*30*24))h + kubectl create token konflux-bot-0 --duration $((6*30*24))h ``` ## Revoke and Recreate Token As we use by default Tokens with a validity of 6 months, we need to recreate them periodically. This is done via the following: -1. Make sure, you're logged in to Konflux via the CLI and have access to the `ocp-serverless` workspace. Check for example the [Konflux kickstart recording](https://drive.google.com/drive/u/0/folders/0AB3Zk0vHI6ulUk9PVA) or the [Konflux docs](https://gitlab.cee.redhat.com/konflux/docs/users/-/blob/main/topics/getting-started/getting-access.md#accessing-konflux-via-cli) -2. Recreate the `gh-action` service account: +1. Make sure, you're logged in to Konflux via the CLI and have access to the `ocp-serverless-tenant` workspace. Check for example the [Konflux kickstart recording](https://drive.google.com/drive/u/0/folders/0AB3Zk0vHI6ulUk9PVA) or the [Konflux docs](https://gitlab.cee.redhat.com/konflux/docs/users/-/blob/main/topics/getting-started/getting-access.md#accessing-konflux-via-cli) +2. Recreate the `konflux-bot-0` service account: ```shell kubectl delete -f https://raw.githubusercontent.com/openshift-knative/hack/main/cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml kubectl apply -f https://raw.githubusercontent.com/openshift-knative/hack/main/cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml ``` 3. Create a new Token for 6 months and [update the `KONFLUX_SA_TOKEN` secret](https://github.com/openshift-knative/hack/settings/secrets/actions) with its value: ```shell - kubectl create token gh-action --duration $((6*30*24))h + kubectl create token konflux-bot-0 --duration $((6*30*24))h ``` \ No newline at end of file diff --git a/cmd/konflux-apply/manifests/gh-action-rolebinding.yaml b/cmd/konflux-apply/manifests/gh-action-rolebinding.yaml index e908b01a8..274727d31 100644 --- a/cmd/konflux-apply/manifests/gh-action-rolebinding.yaml +++ b/cmd/konflux-apply/manifests/gh-action-rolebinding.yaml @@ -5,7 +5,7 @@ metadata: name: gh-action subjects: - kind: ServiceAccount - name: gh-action + name: konflux-bot-0 apiGroup: "" roleRef: kind: Role diff --git a/cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml b/cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml index be0f03feb..f83a6de9d 100644 --- a/cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml +++ b/cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml @@ -2,4 +2,4 @@ apiVersion: v1 kind: ServiceAccount metadata: namespace: ocp-serverless-tenant - name: gh-action + name: konflux-bot-0