Conversation
|
Blocked by #74 |
| bucket: {{ $config.s3minibroker.bucket }} | ||
| access_key_id: ((aws-cf-user-suse-rd.access-key)) | ||
| secret_access_key: ((aws-cf-user-suse-rd.secret-key)) | ||
| access_key_id: ((aws-access-key)) |
There was a problem hiding this comment.
This won't work as this bucket is in suse-rd account and not our account. Unless, minibroker CI has moved the s3 bucket.
There was a problem hiding this comment.
There seems to be a mismatch between secret names in concourse.suse.de and concourse.suse.dev. One way to fix it was to do the change here and swap aws-access-key and aws-capbot-access-key values in concourse.suse.dev.
With the latest developments, seems we need to change the secrets layout in Vault so the Concourse instances can seamlessly pull them.
There was a problem hiding this comment.
I think its confusing to name rd account creds as aws-access-key/secret-key. In black box we have a liberty to add comments but we don't have the same in k8s secrets.
I am okay with using aws-capbot-access-key/secret-key, but for rd account I guess we should stick to aws-cf-user-suse-rd.access-key/secret-key, for clarity.
Also, we have this issue right now with rd account https://jira.suse.com/browse/CAP-1655
There was a problem hiding this comment.
I agree, the name is confusing, aws-cf-user-suse-rd.access-key/secret-key is a better name. But migrating all the pipelines and reflying them to consume it is not trivial (sometimes one has problems when flying some pipelines).
This would get solved automatically with cloudfoundry-incubator/kubecf#1607 or cloudfoundry-incubator/kubecf#1608, but maybe we just need to fix it apart from those cards.
There was a problem hiding this comment.
These 2 latest commits (yet to be merged) may inform on what the secrets need to be:
https://github.com/SUSE/cloudfoundry/pull/213/commits/9a24ef5dc9578159a642d5febd2d23209b86c885
https://github.com/SUSE/cloudfoundry/pull/213/commits/e12187619fe028a8d4822c8c60640c572797796b
2 participants
These changes update the pipeline code to match the renaming of secrets in concourse.suse.dev. This is needed to make secrets in Vault and concourse.suse.dev consistent.