Prow

The Prow plugin (prow) shows Prow jobs as pipelines and their builds as runs. It reads Deck, starts jobs again and aborts active builds. Public instances such as https://prow.k8s.io need no credentials for read-only monitoring.

Add a providerCopy Anchor Link

Choose Prow in the Provider step and name the connection. Advanced settings holds Run history, artifact storage settings and the optional status page URL. The Credentials step groups Deck URL and Skip TLS Verification under Connection. Authentication offers No auth, Access token and Single sign-on.

Select pipelines lists jobs from Deck's current ProwJobs. Jobs with repository refs group under their organization and repository. Jobs without refs remain selectable by job name. The selection uses org/repo/job or a bare job name, stored as comma-separated selected_items.

AuthenticationCopy Anchor Link

No auth sets auth_mode = "none". Pipedash sends no Deck credential and refuses trigger, rerun and abort actions. This remains read-only even when a token or kubeconfig also exists in the saved config.

Access token supports three auth_scheme values:

Credential validation checks access to Deck. It does not prove that Deck permits actions. Pipedash sends the credential only to the Deck origin, including its scheme, host and port. It does not forward it to a separate artifact storage host.

Single sign-onCopy Anchor Link

Single sign-on uses a configurable OpenID Connect client. Set the issuer and the public client ID registered for Pipedash with PKCE. Register the exact redirect URI with the identity provider. The default http://localhost:8085/auth/callback lets Pipedash finish sign-in through a local callback.

Pipedash requests openid email profile by default and sends the resulting ID token as a bearer token. Choose access_token when the gateway expects an OAuth access token. ID-token sign-in adds openid if the configured scopes omit it. Scopes accept spaces or commas and ignore duplicates.

Extra authorization parameters use key=value pairs joined by &, for example audience=deck&connector_id=github. These settings configure the identity provider protecting Deck. They do not create a Deck GitHub login or grant Kubernetes permissions.

ConfigurationCopy Anchor Link

Provider-specific values belong under [providers.<name>.config]. Values in that table are strings. The shared auth_mode selects none, token or sign_in.

Kubeconfig paths accept ~ and environment variables. Separate multiple files with : on Unix or ; on Windows. The files must exist on the desktop machine or inside the web server container.

Run historyCopy Anchor Link

The default deck mode shows builds still listed by Deck. Its retention commonly covers 2 to 7 days and depends on the instance. Pipedash does not treat Deck as a complete historical archive.

With history_source = "storage", Pipedash merges current Deck runs with older builds in Google Cloud Storage. It reads started.json and finished.json, skips unfinished stored builds and removes duplicates. It searches progressively older time windows until it has enough runs or reaches the end.

A recent build's artifact URL supplies the bucket. Set storage_bucket when Deck no longer lists a run of the selected job. Storage lookup supports logs/<job> and pr-logs/directory/<job> layouts. Storage history listing supports Google Cloud Storage only. An S3-compatible storage_url can serve finished logs but does not add S3 history listing.

The run table adds Type, Pull request, Cluster and Description columns. Build IDs display as strings, preserving large Prow IDs. The internal run number used by Pipedash's API can differ from that displayed Build ID.

Trigger and abortCopy Anchor Link

Prow starts a job again from an existing recent ProwJob. It cannot start a job that Deck no longer lists. The optional prowjob input picks a specific recent ProwJob by name. Leaving it empty selects the newest run of that job.

Without a kubeconfig, Pipedash calls Deck's rerun and abort endpoints. The definition input defaults to latest, which rebuilds from Prow's current configuration. original reuses that run's exact spec. Deck needs --rerun-creates-job for direct reruns. Deck's action authentication accepts its GitHub login or rerun_auth_configs with allow_anyone. A gateway token alone does not satisfy those checks.

With kubeconfig_path, Pipedash reads and creates ProwJobs directly in Kubernetes to start a job again. It reuses the original spec and omits the definition selector. Abort patches the ProwJob status to aborted. The Kubernetes account needs permission to get and create ProwJobs, and patch ProwJobs and their status in the job's namespace.

Both paths need an authenticated Pipedash connection. Kubeconfig actions are unavailable on mobile. Pipedash refuses to abort finished builds, and the target build must still appear in Deck.

Build logsCopy Anchor Link

Each build has one Build log node. Scheduling and triggered jobs wait for output. A running job reads Deck's pod log endpoint. Finished builds prefer the artifact build-log.txt, with Deck as a fallback when that file is missing. Range requests resume a log from the previous byte offset when the endpoint supports them.

Artifact logs work independently of the history source. You can keep history_source = "deck" and still read finished logs from storage. Logs depend on Deck and artifact retention. Private storage on a different origin needs independently accessible objects because Pipedash does not forward Deck credentials there.

Status mapping and limitsCopy Anchor Link

Stored results map SUCCESS, FAILURE, ERROR and ABORTED to the corresponding statuses. A stored result with passed: true also counts as Success.

Discovery depends on Deck's current jobs rather than every job definition in Prow configuration. The plugin has no agent, queue or artifact browser. Read-only public monitoring does not grant action permissions. The Run logs page covers search, error navigation, downloads and cache limits.

TOML exampleCopy Anchor Link

This connection watches two public jobs without credentials. Replace the selected names with jobs available from your Deck instance.

[providers.prow-public]
name = "Prow public"
type = "prow"
refresh_interval = 30

[providers.prow-public.config]
auth_mode = "none"
deck_url = "https://prow.k8s.io"
history_source = "storage"
storage_bucket = "gs://kubernetes-ci-logs"
selected_items = "kubernetes-sigs/kind/ci-kind-unit-test,kubernetes-sigs/kind/ci-kind-test"