Chapter 1. Adding secrets and variables to Azure Pipelines for integration with external tools

Procedure

1. Log in to https://dev.azure.com and open your Azure DevOps project.
2. In the left navigation panel, select Pipelines, then select Library.
3. Select Variable group to create a new variable group.
4. Enter a name for the variable group, for example, rhtap.

5. In the variable group editor:

   1. Select Add to add a new variable.
   2. In the Name field, enter the key. For example, GITOPS_AUTH_PASSWORD.
   3. In the Value field, enter the value used to authenticate with the GitOps repository for pushing updated image information.
   4. Select the Keep this value secret checkbox to mask the value in the UI and logs.

6. Repeat step 5 to add all required secrets:

   Expand

   Table 1.1. Image registry and GitOps secrets

   Variable	Description
   IMAGE_REGISTRY_PASSWORD	Password for accessing your container image registry.
   GITOPS_AUTH_PASSWORD	The token the system uses to update the GitOps repository for newly built images.

   Show more
   Expand

   Table 1.2. Secrets required for ACS and SBOM tasks

   Variable	Description
   ROX_API_TOKEN	API token for accessing the ROX server.
   COSIGN_SECRET_PASSWORD	Password for Cosign signing key.
   COSIGN_SECRET_KEY	Private key for Cosign.
   TRUSTIFICATION_OIDC_CLIENT_SECRET	Client secret used alongside the client ID to authenticate to the Trustification Bombastic API.

   Show more

6. Now add regular environment variables and don’t mask their values. In the variable group editor:

   1. Select Add.
   2. In the Name field, enter the key. For example, IMAGE_REGISTRY_USER.
   3. In the Value field, enter the value. In our example: a username for accessing your container image registry.
   4. Do not select the Keep this value secret checkbox.

7. Repeat step 6 to add all required environment variables:

   Expand

   Table 1.3. Image registry and GitOps variables

   Variable	Description
   IMAGE_REGISTRY_USER	Username for accessing your container image registry.
   GITOPS_AUTH_USERNAME (optional)	Your OpenShift GitOps username. This variable is required for Azure to work with Bitbucket. By default, lines with this variable are commented in the azure-pipelines.yml file. To start using Bitbucket, uncomment all 5 instances of the line # GITOPS_AUTH_USERNAME: $(GITOPS_AUTH_USERNAME).

   Show more
   Expand

   Table 1.4. Variables required for ACS and SBOM tasks

   Variable	Description
   ROX_CENTRAL_ENDPOINT	Endpoint for the ROX Central server.
   COSIGN_PUBLIC_KEY	Public key for Cosign.
   TRUSTIFICATION_BOMBASTIC_API_URL	URL for Trustification Bombastic API used in SBOM generation.
   TRUSTIFICATION_OIDC_ISSUER_URL	OIDC issuer URL used for authentication when interacting with the Trustification Bombastic API.
   TRUSTIFICATION_OIDC_CLIENT_ID	Client ID for authenticating to the Trustification Bombastic API using OIDC.
   TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION	Specifies the CycloneDX SBOM version that is supported and generated by the system.

   Show more

   Optional: Set the Rekor and TUF variables if your CI provider runners do not run on the same cluster as the RHADS - SSC instance.

   Expand

   Table 1.5. Rekor and TUF variables

   Variable	Description
   REKOR_HOST	URL of your Rekor server.
   TUF_MIRROR	URL of your TUF service.

   Show more

8. Select Save.

9. To authorize pipelines to use this variable group:

   1. Select the Pipeline permissions tab.
   2. Select Add pipeline.
   3. Select the pipelines that require access to this variable group and select Authorize selected pipelines.

10. Optional: If you use a different name for the variable group other than rhtap, you must update the variable group name in the azure-pipelines.yml file.

    variables:
        - group: <my-variable-group>

    Copy to Clipboard Toggle word wrap

Verification

1. Rerun the latest pipeline. If the secrets are applied correctly, the pipeline will complete successfully. After a successful run, verify that tasks such as RHACS or SBOM display the expected details.