Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions cmd/konflux-apply/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ The Konflux manifests are applied automatically via the [konflux-apply](../../.g

For this workflow, we use a token for Konflux setup as described in [the docs](https://konflux.pages.redhat.com/docs/users/getting-started/getting-access.html#accessing-konflux-via-cli). Therefor we need to setup a service account, role & rolebinding:

1. Service account `gh-action`:
1. Service account `konflux-bot-0`:
```shell
kubectl apply -f ./cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml
```
Expand All @@ -16,22 +16,22 @@ For this workflow, we use a token for Konflux setup as described in [the docs](h
```shell
kubectl apply -f ./cmd/konflux-apply/manifests/gh-action-rolebinding.yaml
```
4. Use the token from the `gh-action` Service account as the `KONFLUX_SA_TOKEN` repository secret used by the Github workflow
4. Use the token from the `konflux-bot-0` Service account as the `KONFLUX_SA_TOKEN` repository secret used by the Github workflow
```shell
kubectl create token gh-action --duration $((6*30*24))h
kubectl create token konflux-bot-0 --duration $((6*30*24))h
```

## Revoke and Recreate Token

As we use by default Tokens with a validity of 6 months, we need to recreate them periodically. This is done via the following:

1. Make sure, you're logged in to Konflux via the CLI and have access to the `ocp-serverless` workspace. Check for example the [Konflux kickstart recording](https://drive.google.com/drive/u/0/folders/0AB3Zk0vHI6ulUk9PVA) or the [Konflux docs](https://gitlab.cee.redhat.com/konflux/docs/users/-/blob/main/topics/getting-started/getting-access.md#accessing-konflux-via-cli)
2. Recreate the `gh-action` service account:
1. Make sure, you're logged in to Konflux via the CLI and have access to the `ocp-serverless-tenant` workspace. Check for example the [Konflux kickstart recording](https://drive.google.com/drive/u/0/folders/0AB3Zk0vHI6ulUk9PVA) or the [Konflux docs](https://gitlab.cee.redhat.com/konflux/docs/users/-/blob/main/topics/getting-started/getting-access.md#accessing-konflux-via-cli)
2. Recreate the `konflux-bot-0` service account:
```shell
kubectl delete -f https://raw.githubusercontent.com/openshift-knative/hack/main/cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml
kubectl apply -f https://raw.githubusercontent.com/openshift-knative/hack/main/cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml
```
3. Create a new Token for 6 months and [update the `KONFLUX_SA_TOKEN` secret](https://github.com/openshift-knative/hack/settings/secrets/actions) with its value:
```shell
kubectl create token gh-action --duration $((6*30*24))h
kubectl create token konflux-bot-0 --duration $((6*30*24))h
```
2 changes: 1 addition & 1 deletion cmd/konflux-apply/manifests/gh-action-rolebinding.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ metadata:
name: gh-action
subjects:
- kind: ServiceAccount
name: gh-action
name: konflux-bot-0
apiGroup: ""
roleRef:
kind: Role
Expand Down
2 changes: 1 addition & 1 deletion cmd/konflux-apply/manifests/gh-action-serviceaccount.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ apiVersion: v1
kind: ServiceAccount
metadata:
namespace: ocp-serverless-tenant
name: gh-action
name: konflux-bot-0
Loading