---
title: Prow
description: Prow Deck monitoring with public read-only access, bearer/basic/cookie tokens, configurable OIDC sign-in, storage history, build logs and optional Kubernetes actions.
---

The Prow plugin (`prow`) shows Prow jobs as pipelines and their builds as runs. It reads Deck, starts jobs again and aborts active builds. Public instances such as `https://prow.k8s.io` need no credentials for read-only monitoring.

## Add a provider

Choose Prow in the Provider step and name the connection. Advanced settings holds Run history, artifact storage settings and the optional status page URL. The Credentials step groups Deck URL and Skip TLS Verification under Connection. Authentication offers No auth, Access token and Single sign-on.

<Screenshot src="provider-prow" variant="dialog" alt="Prow Credentials step with Deck URL and No auth selected" caption="Public Deck instances work without credentials. Starting and stopping runs stays off." />

Select pipelines lists jobs from Deck's current ProwJobs. Jobs with repository refs group under their organization and repository. Jobs without refs remain selectable by job name. The selection uses `org/repo/job` or a bare job name, stored as comma-separated `selected_items`.

## Authentication

No auth sets `auth_mode = "none"`. Pipedash sends no Deck credential and refuses trigger, rerun and abort actions. This remains read-only even when a token or kubeconfig also exists in the saved config.

Access token supports three `auth_scheme` values:

| Value | Credential | Request header |
|---|---|---|
| `bearer` | Gateway or OAuth token | `Authorization: Bearer <token>` |
| `basic` | `user:password` | `Authorization: Basic <base64 credential>` |
| `cookie` | Session cookie, such as `_oauth2_proxy=...` | `Cookie: <token>` |

<Screenshot src="provider-prow-token" variant="dialog" alt="Prow token authentication with bearer selected" caption="Use the credential format accepted by your Deck gateway." />

Credential validation checks access to Deck. It does not prove that Deck permits actions. Pipedash sends the credential only to the Deck origin, including its scheme, host and port. It does not forward it to a separate artifact storage host.

## Single sign-on

Single sign-on uses a configurable OpenID Connect client. Set the issuer and the public client ID registered for Pipedash with PKCE. Register the exact redirect URI with the identity provider. The default `http://localhost:8085/auth/callback` lets Pipedash finish sign-in through a local callback.

<Screenshot src="provider-prow-sso" variant="dialog" alt="Prow OIDC settings with issuer, client ID, scopes, token type and callback" caption="Configure the identity provider protecting Deck." />

Pipedash requests `openid email profile` by default and sends the resulting ID token as a bearer token. Choose `access_token` when the gateway expects an OAuth access token. ID-token sign-in adds `openid` if the configured scopes omit it. Scopes accept spaces or commas and ignore duplicates.

Extra authorization parameters use `key=value` pairs joined by `&`, for example `audience=deck&connector_id=github`. These settings configure the identity provider protecting Deck. They do not create a Deck GitHub login or grant Kubernetes permissions.

## Configuration

Provider-specific values belong under `[providers.<name>.config]`. Values in that table are strings. The shared `auth_mode` selects `none`, `token` or `sign_in`.

| Key | Required | Default | Description |
|---|---|---|---|
| `deck_url` | Yes, default supplied | `https://prow.k8s.io` | HTTP or HTTPS Deck dashboard URL |
| `insecure` | No | `false` | Skips TLS certificate verification |
| `token` | Access token mode | None | Bearer token, basic credential or cookie. A completed SSO sign-in supplies the stored token |
| `auth_scheme` | No | `bearer` | `bearer`, `basic` or `cookie` for Access token mode |
| `sso_issuer` | Single sign-on | None | OIDC issuer URL |
| `sso_client_id` | Single sign-on | None | Public PKCE client ID |
| `sso_scopes` | No | `openid email profile` | Requested OIDC scopes |
| `sso_token` | No | `id_token` | `id_token` or `access_token` sent to Deck |
| `sso_redirect_uri` | No | `http://localhost:8085/auth/callback` | Registered callback URL |
| `sso_params` | No | None | Extra authorization parameters joined by `&` |
| `history_source` | No | `deck` | `deck` for current Deck runs or `storage` to add older stored builds |
| `storage_url` | No | Google Cloud Storage for `gs` artifacts | Artifact endpoint used as `<url>/<bucket>/<path>`, including S3-compatible endpoints |
| `storage_bucket` | No | Inferred from a recent build's artifact URL | Bucket such as `gs://kubernetes-ci-logs` or `s3://ci-logs`. A bare name means `gs://` |
| `kubeconfig_path` | No | None | Kubeconfig file paths for actions, desktop or web server only |
| `kube_context` | No | Kubeconfig current context | Kubernetes context for actions |
| `status_page_url` | No | None | Optional Statuspage URL. See [Provider health](/docs/features/provider-health) |
| `selected_items` | Yes, to monitor jobs | None | Comma-separated `org/repo/job` selections or bare job names |

Kubeconfig paths accept `~` and environment variables. Separate multiple files with `:` on Unix or `;` on Windows. The files must exist on the desktop machine or inside the web server container.

## Run history

The default `deck` mode shows builds still listed by Deck. Its retention commonly covers 2 to 7 days and depends on the instance. Pipedash does not treat Deck as a complete historical archive.

With `history_source = "storage"`, Pipedash merges current Deck runs with older builds in Google Cloud Storage. It reads `started.json` and `finished.json`, skips unfinished stored builds and removes duplicates. It searches progressively older time windows until it has enough runs or reaches the end.

<Screenshot src="provider-prow-history" alt="Prow run history with build IDs, statuses, job types and pull requests" caption="The Build column preserves Prow's build ID. Type and Pull request describe the tested job." />

A recent build's artifact URL supplies the bucket. Set `storage_bucket` when Deck no longer lists a run of the selected job. Storage lookup supports `logs/<job>` and `pr-logs/directory/<job>` layouts. Storage history listing supports Google Cloud Storage only. An S3-compatible `storage_url` can serve finished logs but does not add S3 history listing.

The run table adds Type, Pull request, Cluster and Description columns. Build IDs display as strings, preserving large Prow IDs. The internal run number used by Pipedash's API can differ from that displayed Build ID.

## Trigger and abort

Prow starts a job again from an existing recent ProwJob. It cannot start a job that Deck no longer lists. The optional `prowjob` input picks a specific recent ProwJob by name. Leaving it empty selects the newest run of that job.

Without a kubeconfig, Pipedash calls Deck's rerun and abort endpoints. The `definition` input defaults to `latest`, which rebuilds from Prow's current configuration. `original` reuses that run's exact spec. Deck needs `--rerun-creates-job` for direct reruns. Deck's action authentication accepts its GitHub login or `rerun_auth_configs` with `allow_anyone`. A gateway token alone does not satisfy those checks.

With `kubeconfig_path`, Pipedash reads and creates ProwJobs directly in Kubernetes to start a job again. It reuses the original spec and omits the `definition` selector. Abort patches the ProwJob status to `aborted`. The Kubernetes account needs permission to get and create ProwJobs, and patch ProwJobs and their status in the job's namespace.

Both paths need an authenticated Pipedash connection. Kubeconfig actions are unavailable on mobile. Pipedash refuses to abort finished builds, and the target build must still appear in Deck.

## Build logs

Each build has one Build log node. Scheduling and triggered jobs wait for output. A running job reads Deck's pod log endpoint. Finished builds prefer the artifact `build-log.txt`, with Deck as a fallback when that file is missing. Range requests resume a log from the previous byte offset when the endpoint supports them.

<Screenshot src="provider-prow-logs" alt="Prow build log inside Pipedash with search and error navigation" caption="The Build log opens inside Pipedash for public and authenticated Deck connections." />

Artifact logs work independently of the history source. You can keep `history_source = "deck"` and still read finished logs from storage. Logs depend on Deck and artifact retention. Private storage on a different origin needs independently accessible objects because Pipedash does not forward Deck credentials there.

## Status mapping and limits

| Prow state | Pipedash status |
|---|---|
| `pending` | Running |
| `success` | Success |
| `failure`, `error` | Failed |
| `aborted` | Cancelled |
| `scheduling`, `triggered` and unknown states | Pending |

Stored results map `SUCCESS`, `FAILURE`, `ERROR` and `ABORTED` to the corresponding statuses. A stored result with `passed: true` also counts as Success.

Discovery depends on Deck's current jobs rather than every job definition in Prow configuration. The plugin has no agent, queue or artifact browser. Read-only public monitoring does not grant action permissions. The [Run logs](/docs/features/run-logs) page covers search, error navigation, downloads and cache limits.

## TOML example

This connection watches two public jobs without credentials. Replace the selected names with jobs available from your Deck instance.

```toml
[providers.prow-public]
name = "Prow public"
type = "prow"
refresh_interval = 30

[providers.prow-public.config]
auth_mode = "none"
deck_url = "https://prow.k8s.io"
history_source = "storage"
storage_bucket = "gs://kubernetes-ci-logs"
selected_items = "kubernetes-sigs/kind/ci-kind-unit-test,kubernetes-sigs/kind/ci-kind-test"
```