Integrate Sonatype Nexus With OpenShift OAuth

[InfoSec812]

As a CI/CD administrator, it would be very nice if Nexus were to use OpenShift authentication instead of it's own authentication. Using OpenShift OAuth Proxy as a sidecar, it should be possible to integrate with the Nexus "Remote User Token" feature for authentication.

[springdo]

This would be cool @InfoSec812! We did some work on my current client to change the default nexus password using the post hook in ci/cd and a custom script but its not great as it replaces the admin password on the first run after configuring repos etc..... then on a replay of the inventory it fails to replace as the password has already changed!! It doesn't sync with openshift but we store teh secret there anyway.

[pcarney8]

@springdo you should checkout encrypting the string with ansible vault and replacing it in your local repo with that custom script after it updates the password (or just put the custom password you want into an encrypted string in a file). Check out my example for secrets with applier here

[InfoSec812]

We had some additional discussions around just using the service account token which is associated with the Jenkins service account. Since that is a long-lived token it would be sufficient for Jenkins to interact with Nexus.