anchor.diff:  [[using-secrets]]
   == Using Secrets During a Build
   
  -In some scenarios operations performed by the build require credentials to access
  -dependent resources, but it is undesirable for those credentials to be available
  -in the final application image produced by the build.
  -
  -For example, you are building a NodeJS application and you set up your private
  -mirror for NodeJS modules. In order to download modules from that private mirror,
  -you have to supply a custom *_.npmrc_* file for the build that contains a URL,
  -username and password. For security reasons, you do not want to expose your
  -credentials in the application image.
  -
  -While this example describes NodeJS, you can use the same approach for adding
  -SSL certificates into the *_/etc/ssl/certs_* directory, API keys or tokens, license
  +In some scenarios, build operations require credentials to access dependent
  +resources, but it is undesirable for those credentials to be available in the
  +final application image produced by the build.
  +
  +For example, when building a NodeJS application, you can set up your private
  +mirror for NodeJS modules. In order to download modules from that private
  +mirror, you have to supply a custom *_.npmrc_* file for the build that contains
  +a URL, user name, and password. For security reasons, you do not want to expose
  +your credentials in the application image.
  +
  +This example describes NodeJS, but you can use the same approach for adding SSL
  +certificates into the *_/etc/ssl/certs_* directory, API keys or tokens, license
   files, etc.
   
   [[using-secrets-in-the-buildconfig]]
   === Defining Secrets in the BuildConfig
   
  -First, you have to create the `Secret` you want to use. You can do that by
  -executing the following command:
  -
  +. Create the `Secret`:
  ++
  +====
   ----
   $ oc secrets new secret-npmrc .npmrc=~/.npmrc
   ----
  -
  -This command will create a new `Secret` named *_secret-npmrc_* and store
  -the base64 encoded content of the *_~/.npmrc_* file in it.
  -
  -Now, that you have the secret created, you can add references to `*secrets*`
  -into the `*source*` section in the existing `BuildConfig`:
  -
  -[source,yaml]
  +====
  ++
  +This creates a new secret named *_secret-npmrc_*, which contains the base64
  +encoded content of the *_~/.npmrc_* file.
  +
  +. Add the secret to the `*source*` section in the existing build configuration:
  ++
  +[source,yaml]
  +====
   ----
   source:
     git:
  
positive.code:         name: secret-npmrc
    type: Git
  ----
  
  If you want to create a new `BuildConfig` and you want to include the secrets
  in it, you can run the following command:
  
  ----
  $ oc new-build openshift/nodejs-010-centos7~https://github.com/openshift/nodejs-ex.git --build-secret secret-npmrc
  ----
  
  During the build in both of these examples the *_.npmrc_* will be copied into
  a directory where the source code is located. In case of the OpenShift Source-To-Image
  builder images, this will be the image working directory which is set using the
  `WORKDIR` instruction in the *_Dockerfile_*. If you want to specify another directory,
  you can add a `*destinationDir*` into the secret definition:
  
  [source,yaml]
  ----
  source:
    git:
  
negative.code: This makes the secret files available to the Docker build operation as part of
  the context directory used during the build.
  
  [NOTE]
  ====
  Users should always remove their secrets from the final application image so
  that the secrets are not present in the container running from that image.
  However, the secrets will still exist in the image itself in the layer where
  they were added. This removal should be part of the *_Dockerfile_* itself.
  ====
  
  [[using-secrets-custom-strategy]]
  === Custom Strategy
  
  When using a `Custom` strategy, then all the defined source secrets are
  available inside the builder container in the
  *_/var/run/secrets/openshift.io/build_* directory. The custom build image is
  responsible for using these secrets appropriately. The `Custom` strategy also
  allows secrets to be defined as described in link:#custom-secrets[Secrets].
  There is no technical difference between existing strategy secrets and the
  source secrets. However, your builder image might distinguish between them and
  use them differently, based on your build use case. The source secrets are
  always mounted into the *_/var/run/secrets/openshift.io/build_* directory or
  your builder can parse the `$BUILD` environment variable, which includes the
  full build object.
  
  
  [[starting-a-build]]
  