Skip to content

Commit 7f51697

Browse files
JakubDurkacJakubDurkac
committed
fix: Pass overwrite tokens using env vars instead of CLI args
1 parent 09f0795 commit 7f51697

5 files changed

Lines changed: 19 additions & 42 deletions

File tree

‎ansible/roles/operator-pipeline/templates/openshift/tasks/add-bundle-to-index.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ spec:
113113
if [[ "$(workspaces.iib-credentials.bound)" == "true" ]]; then
114114
IIB_QUAY_USER=$(cat $(workspaces.iib-credentials.path)/username)
115115
IIB_QUAY_TOKEN=$(cat $(workspaces.iib-credentials.path)/password)
116-
EXTRA_ARGS+=" --iib-overwrite-token ${IIB_QUAY_USER}:${IIB_QUAY_TOKEN}"
116+
export IIB_OVERWRITE_TOKEN="${IIB_QUAY_USER}:${IIB_QUAY_TOKEN}"
117117
118118
# Add build tags suffix for consistent tagging with publish task
119119
if [[ "$(params.build_tags_suffix)" != "" ]]; then

‎ansible/roles/operator-pipeline/templates/openshift/tasks/build-fbc-index-images.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -99,28 +99,28 @@ spec:
9999
exit 0
100100
fi
101101
102-
# Build IIB token argument if credentials workspace is provided (for release pipeline)
103-
TOKEN_ARG=""
102+
# Add IIB overwrite token if credentials workspace is provided (for release pipeline)
103+
EXTRA_ARGS=""
104104
if [[ "$(workspaces.iib-credentials.bound)" == "true" ]]; then
105105
IIB_QUAY_USER=$(cat $(workspaces.iib-credentials.path)/username)
106106
IIB_QUAY_TOKEN=$(cat $(workspaces.iib-credentials.path)/password)
107-
TOKEN_ARG="--iib-overwrite-token ${IIB_QUAY_USER}:${IIB_QUAY_TOKEN}"
107+
export IIB_OVERWRITE_TOKEN="${IIB_QUAY_USER}:${IIB_QUAY_TOKEN}"
108108
109109
# Add build tags suffix for consistent tagging with publish task
110110
if [[ "$(params.build_tags_suffix)" != "" ]]; then
111-
TOKEN_ARG+=" --build-tags-suffix $(params.build_tags_suffix)"
111+
EXTRA_ARGS+=" --build-tags-suffix $(params.build_tags_suffix)"
112112
fi
113113
fi
114114
115-
# DO NOT use `--verbose` to avoid auth headers appearing in logs
116115
add-fbc-fragments-to-index \
117116
--iib-url "$(params.iib_url)" \
118117
--indices $INDEX_IMAGES \
119118
--catalog-names "$(params.catalogs_with_added_or_modified_operators)" \
120119
--image-repository "$(params.image_repository)" \
121120
--commit-sha "$(params.commit_sha)" \
122121
--image-output index-image-paths.txt \
123-
$TOKEN_ARG
122+
--verbose \
123+
$EXTRA_ARGS
124124
125125
cat index-image-paths.txt
126126
@@ -158,26 +158,26 @@ spec:
158158
exit 0
159159
fi
160160
161-
# Build IIB token argument if credentials workspace is provided (for release pipeline)
162-
TOKEN_ARG=""
161+
# Add IIB overwrite token if credentials workspace is provided (for release pipeline)
162+
EXTRA_ARGS=""
163163
if [[ "$(workspaces.iib-credentials.bound)" == "true" ]]; then
164164
IIB_QUAY_USER=$(cat $(workspaces.iib-credentials.path)/username)
165165
IIB_QUAY_TOKEN=$(cat $(workspaces.iib-credentials.path)/password)
166-
TOKEN_ARG="--iib-overwrite-token ${IIB_QUAY_USER}:${IIB_QUAY_TOKEN}"
166+
export IIB_OVERWRITE_TOKEN="${IIB_QUAY_USER}:${IIB_QUAY_TOKEN}"
167167
168168
# Add build tags suffix for consistent tagging with publish task
169169
if [[ "$(params.build_tags_suffix)" != "" ]]; then
170-
TOKEN_ARG+=" --build-tags-suffix $(params.build_tags_suffix)"
170+
EXTRA_ARGS+=" --build-tags-suffix $(params.build_tags_suffix)"
171171
fi
172172
fi
173173
174-
# DO NOT use `--verbose` to avoid auth headers appearing in logs
175174
rm-operator-from-index \
176175
--iib-url "$(params.iib_url)" \
177176
--indices $INDEX_IMAGES \
178177
--fragment-builds-output index-image-paths.txt \
179178
--rm-catalog-operators "$(params.deleted_catalog_operators)" \
180179
--image-output index-image-paths.txt \
181-
$TOKEN_ARG
180+
--verbose \
181+
$EXTRA_ARGS
182182
183183
cat index-image-paths.txt

‎operatorcert/entrypoints/add_fbc_fragments_to_index.py‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
IIB module for building a file based catalog for a bundle
33
"""
44

5-
# pylint: disable=duplicate-code
6-
75
import argparse
86
import logging
97
import os
@@ -63,14 +61,6 @@ def setup_argparser() -> argparse.ArgumentParser:
6361
"unpublished index images built by IIB.",
6462
)
6563

66-
parser.add_argument(
67-
"--iib-overwrite-token",
68-
help=(
69-
"Token for IIB to authenticate with from_index registry "
70-
"and enable overwrite (format: username:password)"
71-
),
72-
)
73-
7464
parser.add_argument(
7565
"--build-tags-suffix",
7666
help="Timestamp suffix for build tags (used with overwrite to ensure consistent tagging)",
@@ -265,6 +255,7 @@ def main() -> None:
265255
setup_logger(level=log_level)
266256

267257
utils.set_client_keytab(os.environ.get("KRB_KEYTAB_FILE", "/etc/krb5.krb"))
258+
overwrite_token = os.environ.get("IIB_OVERWRITE_TOKEN")
268259

269260
index_fragment_mapping = map_index_to_fragment(
270261
args.indices,
@@ -277,7 +268,7 @@ def main() -> None:
277268
args.iib_url,
278269
index_fragment_mapping,
279270
args.image_output,
280-
args.iib_overwrite_token,
271+
overwrite_token,
281272
args.build_tags_suffix,
282273
)
283274

‎operatorcert/entrypoints/index.py‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -61,14 +61,6 @@ def setup_argparser() -> argparse.ArgumentParser: # pragma: no cover
6161
)
6262
parser.add_argument("--authfile", help="")
6363

64-
parser.add_argument(
65-
"--iib-overwrite-token",
66-
help=(
67-
"Token for IIB to authenticate with from_index registry "
68-
"and enable overwrite (format: username:password)"
69-
),
70-
)
71-
7264
parser.add_argument(
7365
"--build-tags-suffix",
7466
help="Timestamp suffix for build tags (used with overwrite to ensure consistent tagging)",
@@ -175,14 +167,15 @@ def main() -> None: # pragma: no cover
175167
setup_logger(level=log_level)
176168

177169
utils.set_client_keytab(os.environ.get("KRB_KEYTAB_FILE", "/etc/krb5.krb"))
170+
overwrite_token = os.environ.get("IIB_OVERWRITE_TOKEN")
178171

179172
iib_response = add_bundle_to_index(
180173
args.bundle_pullspec,
181174
args.iib_url,
182175
args.indices,
183176
args.image_output,
184177
args.mode,
185-
args.iib_overwrite_token,
178+
overwrite_token,
186179
args.build_tags_suffix,
187180
)
188181
if args.index_image_destination:

‎operatorcert/entrypoints/rm_operator_from_index.py‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,6 @@ def setup_argparser() -> argparse.ArgumentParser:
4949
help="Base URL for IIB API",
5050
)
5151

52-
parser.add_argument(
53-
"--iib-overwrite-token",
54-
help=(
55-
"Token for IIB to authenticate with from_index registry "
56-
"and enable overwrite (format: username:password)"
57-
),
58-
)
59-
6052
parser.add_argument(
6153
"--build-tags-suffix",
6254
help="Timestamp suffix for build tags (used with overwrite to ensure consistent tagging)",
@@ -305,6 +297,7 @@ def main() -> None: # pragma: no cover
305297
setup_logger(level=log_level)
306298

307299
utils.set_client_keytab(os.environ.get("KRB_KEYTAB_FILE", "/etc/krb5.krb"))
300+
overwrite_token = os.environ.get("IIB_OVERWRITE_TOKEN")
308301

309302
# In case there was a previous run of fragment builds, read the output and use
310303
# it as a base for removal process. In case the file does not exist, set it to
@@ -326,7 +319,7 @@ def main() -> None: # pragma: no cover
326319

327320
# Remove operators from the index images using IIB API
328321
iib_rm_response = rm_operator_from_index(
329-
index_images, args.iib_url, args.iib_overwrite_token, args.build_tags_suffix
322+
index_images, args.iib_url, overwrite_token, args.build_tags_suffix
330323
)
331324

332325
# Merge the output from the removal process with the output from the

0 commit comments

Comments
 (0)