KubeSphere DevOps Credentials

Overview

Credentials in KubeSphere DevOps are Kubernetes Secrets with specific labels and annotations. They are synced to Jenkins for use in pipelines. Supported types include SSH keys, username/password, and secret tokens.

When to Use

• Creating credentials for Git repositories
• Setting up deployment credentials (kubeconfig, registry)
• Managing API tokens for external services
• Troubleshooting credential access issues
• Migrating credentials between DevOps projects

Credential Types

Type	Use Case	Secret Key
SSH	Git repositories	username, privatekey
Basic	Username/password	username, password
Secret	API tokens, secrets	secret
Kubeconfig	Kubernetes clusters	kubeconfig (v1.1.x only)
SSH Username/Pass	Git with user/pass	username, password
String	Generic text/tokens	secret

Resource Structure

Credentials are stored as Kubernetes Secrets with DevOps labels:

apiVersion: v1
kind: Secret
metadata:
  name: my-credential
  namespace: project-xxx  # DevOps project namespace
  labels:
    devops.kubesphere.io/credential: "true"
  annotations:
    credential.devops.kubesphere.io/syncstatus: successful
    credential.devops.kubesphere.io/type: ssh|basic-auth|secret-text
stringData:
  username: git-user
  privatekey: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    ...
    -----END OPENSSH PRIVATE KEY-----
type: credential.devops.kubesphere.io/ssh  # CRITICAL: Must use credential.devops.kubesphere.io/* type, NOT Opaque!

⚠️ CRITICAL: Secret Type Must Be credential.devops.kubesphere.io/*

The type field must be one of:

• credential.devops.kubesphere.io/basic-auth
• credential.devops.kubesphere.io/ssh-auth
• credential.devops.kubesphere.io/secret-text
• credential.devops.kubesphere.io/kubeconfig