Loading...

XML

Word

Printable

Type: Feature Request
Resolution: Unresolved
Priority: Major
Fix Version/s: None
Affects Version/s: None
Component/s: Quay
Labels:
None

Target Version:
None
Activity Type:
Product / Portfolio Work
Status Summary:
None
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Products:
None
Hierarchy Progress Bar:
None

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

PX Review Complete:
None
PX Impact Score:
None
PX Impact Range:
None
PX Priority Data:
None
PX Technical Impact:
None
PX Technical Impact Notes:
None
PX Scheduling Request:
None

In CI/CD setups using OpenShift Pipelines, the pipeline ServiceAccount is the default SA used by PipelineRuns.

Quay Bridge Operator currently only configures the builder SA to push images to quay, which is primarily used by BuildConfig/S2I, not Tekton.

This forces users to either:
Rebind secrets manually.
Grant high-permission SCCs to builder, which may not be desirable.

Suggested Enhancements

New ConfigMap/CR parameter to set the SA name (quay.targetServiceAccount: pipeline).
Auto-bind Quay robot secret to that SA in the target namespace.
Optionally generate imagePullSecrets or mount options.

Assignee:: Tony Wu

Reporter:: Ashwani Kumar Singh

Need Info From:: None

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Created:: 2025/07/08 12:04 PM

Updated:: 2025/07/11 2:59 PM

Target start:: None

Target end:: None