securityibm-cloudtoolchaincontinuous-deliverydevops-services

How can I change the API key for an IBM Cloud toolchain


I have created over time several toolchains, for several apps, in my IBM Cloud environment. In the end I only kept a couple of APPS.

So now when I go to IAM > API Keys > IBM Cloud API keys I have a dozen of keys labelled: "API Key for APPX" or "DevEx API Key2019-10-07T11:49:21.641"

Now I would like to clean this up to avoid having keys left open.

My issue: I can't find anywhere in the toolchains themselves any reference to the API key. I only could insert the API key at the toolchain creation. So I thought of just recreating new keys, but here again, how can I update a API key in a toolchain?


Allow me to extend my question a little:

THe key present in the devops service is a "IBM cloud user key". It is global to the platform and depends on the user that created it. It seems that if I remove that user the key probably disappears too.

So instead IBM recommend to change it for a Service ID Key. So I created one service ID Key. But I can't figure out the "access rule" to be equivalent to the "platform" (like the previous key). In particular, what should be the "service instance". I tried leaving "any instance" "any region".

But when I change the key in the devops service (in my "staging" stage), it says "No available organisation" and "no available space".

Am I doing smtg wrong or is there no way to use a service ID key there?


Solution

  • You can update the API key as part of the environment variables for the pipeline. The API key typically is needed for the DEPLOY stage.

    1. For the specific toolchain drill down until you see the stages.
    2. For the DEPLOY stage click on the gear / cog wheel icon for the context menu.
    3. Click Configure stage and
    4. in the jobs tab scroll down to API key.
    5. Click into the API key field for the configuration menu to come up.