|
| 1 | +--- |
| 2 | +title:"Pipeline execution context" |
| 3 | +description:"A managed entity to make API calls on your behalf during pipeline execution" |
| 4 | +group:administration |
| 5 | +redirect_from: |
| 6 | + -/docs/administration/pipeline-execution-context/ |
| 7 | +toc:true |
| 8 | +--- |
| 9 | + |
| 10 | +##Prerequisites |
| 11 | + |
| 12 | +**Account Level:** Pro and above |
| 13 | + |
| 14 | +>At this time, you will need to reach out to support to enable pipeline execution context. |
| 15 | +
|
| 16 | +##About Pipeline Execution Context |
| 17 | + |
| 18 | +A pipeline execution context is an entity attached to the pipeline that makes API calls on your behalf. To create an execution context, navigate to Account Settings then Execution Context under the Security section. The execution context does not have permission at first. To control what this execution context can access, you will need to define ABAC rules. You can create multiple execution contexts in the account, but only one can be set as the default. The default execution context is there for a pipeline that does not have a specific execution context associated with it. As with all other integration contexts, you will not be able to delete an execution context if linked to a pipeline. |
| 19 | + |
| 20 | +##Permissions |
| 21 | + |
| 22 | +When a new execution context is created, it has no permissions at first. An account admin must add ABAC rules to grant permissions to that execution context. The enforcement of the execution context permissions will be based on the existing[ABAC model]({{site.baseurl}}/docs/administration/account-user-management/access-control/) that we have today on our platform. The available permissions for execution context will be the same as we have today for codefresh teams. There will be a new tab on the Permissions page for assigning ABAC rules to the execution context. |
| 23 | + |
| 24 | +In addition, there will be a new action for team rules: assigning execution context to pipelines. Account admins will be able to control which teams will be able to set execution contexts to certain pipelines by creating a rule like: “Dev team can assign execution context with tags ‘dev-context’ to pipelines that have ‘dev’ tags.” |
| 25 | + |
| 26 | +##Restrictions |
| 27 | + |
| 28 | +Pipeline execution contexts are restricted to the[pipelines](https://codefresh-io.github.io/cli/pipelines/){:target="\_blank"} and "[builds](https://codefresh-io.github.io/cli/builds/){:target="\_blank"} endpoints of the CLI. Also, there are some additional resources related to pipeline resources in the[Operate On Resources](https://codefresh-io.github.io/cli/operate-on-resources/){:target="\_blank"} section. Any other endpoints will be blocked when using the execution context. With that being said, some of Codefresh’s Steps in the Steps Marketplace will not work when using execution contexts. Some known steps to not work are argocd-rollout, argocd-sync, and launch-composition, as they use additional endpoints behind the scenes. |
| 29 | + |
| 30 | +A user can override the environment variable CF_API_KEY with their API Key to access other endpoints. Below is an example of how to do this in a single step. |
| 31 | + |
| 32 | +{% highlight yaml %} |
| 33 | +{% raw %} |
| 34 | +steps: |
| 35 | + this_step_will_ succeed: |
| 36 | + title: "will succeed" |
| 37 | + type: "freestyle" # Run any command |
| 38 | + image: "quay.io/codefresh/cli" |
| 39 | + commands: |
| 40 | + - "export CF_API_KEY=${{MY_API_KEY}}" # this will override the default token with my own token |
| 41 | + - "codefresh create team ${{TEAM_NAME}}" |
| 42 | +{% endraw %} |
| 43 | +{% endhighlight %} |
| 44 | + |
| 45 | +You can use cf_export instead of export to make CF_API_KEY available for the following steps if needed. |
| 46 | + |
| 47 | +##Related articles |
| 48 | +[API Key Creation]({{site.baseurl}}/docs/administration/user-self-management/user-settings/#api-key-creation) |
| 49 | + |