convoy docs
Search

Credentials

The auth types of each kind, and which ones convoy implements.

convoy reads credentials from Secrets in the namespace of the object that references them. SSH known_hosts data comes from a ConfigMap. A reference to a key has the form {name, key}. A missing Secret or key gives Ready=False with reason VerifyFailed (sources) or ProbeFailed (Cluster).

KindImplementedAccepted, but Unsupported
Cluster (agentless)kubeconfigtoken, clientCert, execPlugin, oidc
GitRepositorynone, basic, token, sshKeygithubApp, oidc, cloudIdentity
HelmRegistrynone, basic, tokenoidc, cloudIdentity
OCIRegistrynone, basic, tokendockerConfig, oidc, cloudIdentity

An Unsupported auth type gives Ready=False with reason Unsupported. The controller does not retry with backoff.

How each type is sent#

Kindbasictoken
GitRepositoryHTTP basic authHTTP basic auth, username git, the token as the password
HelmRegistryHTTP basic authAuthorization: Bearer <token>
OCIRegistryRegistry loginRegistry login, username convoy, the token as the password

Shapes#

yaml 
auth:
  type: basic
  basic:
    username: deploy                       # a string, not a Secret reference
    passwordRef: { name: creds, key: password }
---
auth:
  type: token
  token:
    tokenRef: { name: creds, key: token }
---
auth:                                      # GitRepository only
  type: sshKey
  sshKey:
    sshKeyRef: { name: git-ssh, key: identity }
    knownHostsRef: { name: git-known-hosts, key: known_hosts }   # a ConfigMap, required
---
auth:                                      # Cluster (spec.agentless.auth) only
  type: kubeconfig
  kubeconfig:
    secretRef: { name: prod-kubeconfig, key: config }

In the code

convoy v0.9.0