Configure Artifacts on Spinnaker

Configure a Git Repo Artifact Account

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Each time a pipeline needs a Git repo artifact during execution, Clouddriver clones the entire repo, sends the repo artifact to the pipeline, and then deletes the cloned repo immediately.

Spinnaker includes a feature for caching a Git repo artifact. Clouddriver clones the Git repo the first time a pipeline needs it and then caches the repo for a configured retention time. Each subsequent time the pipeline needs to use that Git repo artifact, Clouddriver does a git pull to fetch updates rather than cloning the entire repo again. This behavior is especially useful if you have large repositories. Clouddriver deletes the cloned Git repo when the configured retention time expires.
This is an opt-in feature that is disabled by default. See the Enable git pull support section for details.

Configure a GitHub artifact account

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

You need a GitHub account.

Download credentials

Start by generating an access token for GitHub. The token requires the repo scope.

Add the credentials either to a secrets manager for use by reference or to a volume mounted into the clouddriver pods by modifying the deployment.yaml for clouddriver.

Add the account and enable it

Add the below to clouddriver-local.yml to enable artifacts and add a github account

artifacts:
  enabled: true
  github:
    enabled: true
    accounts:
    - name: my-github-account
      tokenFile: /mnt/some/file|secretReference

There are more options available if you look at the github account definition code

Configure a GitLab artifact account

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

You need a GitLab account.

Download credentials

Start by generating an access token for GitLab.

Add the credentials either to a secrets manager for use by reference or to a volume mounted into the clouddriver pods by modifying the deployment.yaml for clouddriver.

Add the account and enable it

All that’s required are the following configuration:

artifacts:
  enabled: true
  gitlab:
    enabled: true
    accounts:
    - name: my-gitlab-account
      token: patToken
      tokenFile: /mnt/someplace/tokenFile

There are more options including URL restrictions that can be set to allow only internal gitlab hosts. See the gitlab account definition for information.

Configure Bitbucket Artifact Credentials

Mon, 01 Jan 0001 00:00:00 +0000

If the files are hidden behind basic auth, you can configure an artifact account with the needed credentials to read your artifact.

Download credentials

Collect your basic auth $USERNAME and $PASSWORD
Pick a $USERNAME_PASSWORD_FILE location on your disk

Run:

echo ${USERNAME}:${PASSWORD} > $USERNAME_PASSWORD_FILE

Add the credentials either to a secrets manager for use by reference or to a volume mounted into the clouddriver pods by modifying the deployment.yaml for clouddriver.

Add the account and enable it

Enable the Bitbucket artifact provider in clouddriver-local.yml and add an artifact account:

Configure Helm Artifact account

Mon, 01 Jan 0001 00:00:00 +0000

The provider can be an Artifactory like Nexus , JFrog , or Chartmuseum .

If the files are hidden behind basic auth, you can configure an artifact account with the needed credentials to read your artifacts. Basic auth is the only authentication mechanism supported for accessing a Helm artifact account.

Setup usage in pipeline executions

Download credentials

Collect your basic auth $USERNAME and $PASSWORD
Pick a $USERNAME_PASSWORD_FILE location on your disk

Run:

echo ${USERNAME}:${PASSWORD} > $USERNAME_PASSWORD_FILE

Add the credentials either to a secrets manager for use by reference or to a volume mounted into the clouddriver pods by modifying the deployment.yaml for clouddriver.

Configure HTTP Artifact Credentials

Mon, 01 Jan 0001 00:00:00 +0000

If the files are hidden behind basic auth, you can configure an artifact account with the needed credentials to read your artifact. If not, no further configuration is needed, Spinnaker can automatically add a no-auth-http-account for this purpose.

You can configure more than one artifact account, each with separate credentials. Specify which account to use in the configuration for the stage that reads the data. If you have only one such account configured, the stage config for this is hidden, and the single account is automatically used.

Configure Maven Artifact Credentials

Mon, 01 Jan 0001 00:00:00 +0000

Spinnaker can be configured to deploy artifacts stored in a Maven repository.

You can configure more than one artifact account, each with separate credentials. Specify which account to use in the configuration for the stage that reads the data.

Download credentials

Maven accounts at this time do not support credential authorization. We’d welcome PRs to enable this and get maven closer to full artifact support.

Add the account and enable it

artifacts:
  enabled: true
  maven:
    enabled: true
    accounts:
    - name:  nexus-internal
      repositoryUrl: https://my.repo.example.com

Configure S3 Artifact

Mon, 01 Jan 0001 00:00:00 +0000

All that’s required are the following values:

API_ENDPOINT=
API_REGION=
REGION=
ARTIFACT_ACCOUNT_NAME=my-s3-account

Download credentials

Create a user with an accessKey or secretKey. Otherwise, spinnaker will use the credentials of the clouddriver pod to attempt to access the s3 resource.

Add the accesskey and secret key either to a secrets manager for use by reference or to a volume mounted into the clouddriver pods by modifying the deployment.yaml for clouddriver.

Add the account and enable it

Add the following to clouddriver-local.yml

Configuring GCS Artifact Credentials

Mon, 01 Jan 0001 00:00:00 +0000

Spinnaker stages that read data from artifacts can consume GCS objects as artifacts.

Prerequisites

You need a Google Cloud Platform (GCP) project to host a bucket in. The next steps assume you’ve already created a project , and installed gcloud . You can check that gcloud is installed and authenticated by running:

gcloud info

Download credentials

Spinnaker needs a service account to authenticate as against GCP, with the roles/storage.admin role enabled. If you don’t already have such a service account with the corresponding JSON key downloaded, you can run the following commands to do so:

Configuring Oracle Object Storage Artifact Credentials

Mon, 01 Jan 0001 00:00:00 +0000

Spinnaker stages that read data from artifacts can consume Oracle Object Storage objects as artifacts.

Download credentials

If you have enabled Oracle Cloud provider in Spinnaker, you may use the same region, Tenancy’s OCID, user’s OCID, private key file, and fingerprint to enable Oracle Object Storage Artifact. You will need the following to enable Oracle Object Storage Artifact in Spinnaker:

A user in IAM for the person or system who will be using Spinnaker, and that user must be granted access to Object Storage or in one IAM group with permissions of Object Storage.