Alibaba Cloud DevOps:Service connection management

Use cases

Common pipeline scenarios that use service connections:

• Code repository: Link to Codeup to complete RAM authorization automatically, without hard-coding credentials or requiring extra permissions.

• Packages: Link to Packages to complete RAM authorization automatically.

• Image repository: Link to a private image repository to handle docker login automatically.

• Kubernetes cluster: Link cluster credentials so pipelines can call kubectl to perform rolling updates.

Service connection types

Flow supports the following service connection types:

Create a service connection

1. In the Flow console, click Global Settings, and then click Service Connection Management.

2. On the Service Connection Management page, click Create or New Service Connection.

   Note

   The Create button appears when no service connections exist. Otherwise, the New Service Connection button appears in the upper-right corner.

3. Select a Service Connection type. This example uses Codeup. Click Next.

4. In the New Service Connection dialog box, configure the following parameters:

   • Service Connection name: Enter a name for the service connection.

   • Service Connection ID: Optional. Use the default value unless you need a custom ID.

   • Service authorization/certificate: Select an existing credential from the Service authorization/certificate dropdown, or click + New to create a new authorization credential.

     Note

     • For non-Alibaba Cloud services, manually enter a username and a token or password to create the certificate.

     • If a service connection becomes invalid (for example, after an employee leaves), update its authorization/certificate instead of modifying each associated pipeline.

   • Usage Scope: Control who can use this service connection:

     • Private: Visible only to you.

     • Public: Visible to everyone.

     • Custom: Visible only to specified members.

5. After you confirm the settings, click Create.

GitHub service connection (Region sites)

Flow connects to GitHub repositories through a GitHub App. Create and install a GitHub App on GitHub, then use it to create a service connection in Flow:

1. In GitHub, go to and click New GitHub App.

   In the Developer settings left navigation pane, select GitHub Apps.

2. On the Register new GitHub App page, configure the following:

   • GitHub App name: Enter a name for your GitHub App.

   • Homepage URL: Enter a custom URL.

   • Permissions: Under Repository permissions, grant Contents - Read and write permission. This allows Flow to read from and write to your repository branches.

   • Click Create GitHub App.

3. On the app's General page, copy the Client ID. Click Generate a private key to download the .pem file. Save it securely — you need it later to create the certificate.

   The private key file content is in PEM format. Example:

   -----BEGIN RSA PRIVATE KEY-----
   MIIEpAIBAAKCAQEAgiCCYTPSvYLq0w5pC7tH2gXnR++kcoB1DjY6XDCRZ1yhqZZY
   nSpLFfusXUtb1gu64V1igLcWy24yiV7aIM3yLw3tcCXGx5HjFXRdNUulJ1LuPeFm
   E/WHs+Ifew0NprKUB1Dlxxx/TvVxxx8PNY6cP6OF6YUKHRxylYIxQ6lh
   D8DfRQZcnOkfHDjWxxx...xxx4RqtlIGHkIWI
   ZJXzdMVPJ11CfcA01pTYbfD/1zepeDj0i0SPRSkcvOp6ggynSmiK6sEnAp34Cxr5
   uuctk1biJ4AVs/fb+8gam2FYEYCcj5Il177LHQIDAQABAoIBAERES00p+Hl4GTab
   37cfbZ0lLsuE9B4mOdJ0HDMGIjKxzwU4GVLnt72Yge/l33IivtjUGqt5zKHRFGJf
   N3RWb8pF8nNAFWXbup3PVd+e/SSseIFIOyfbLJsYL7223TV5D0FoOFMgeZks0Jn4
   ep6N0x6u4xF6RTNvAFGcWxSXZ7tqHPO3u8UNCgxVhT42/MhuixNz2SkfWbNc134y
   2k791mxCxDrJ2TUA3pmhmGwx4LZpxZqls4LU5/visx4LVEnHQBkJltNcGJl2sa4Z
   zzIFUBOubEasxVAVPxxx...xxxK/rcDzFm0Qrlu
   PQbmbkECqYEA3wJg+5AJ+pSB+GIE/SuqkZltmblxxxtokMzMmXR6AJrGvFm
   /Bsh9NkJlivUFA35+VN9/WwTDaF7Mp+d8aT9BaGePTmuR4q8ySEWMVYiZ0MJAaJA
   5GK5fvjb6EAqozE3KuuGN0/XTKsnw3mNZc/QUK9Cs6AnBv0fSPu0KPUCqYEAw0tk
   a/pX9NNaYI8MPXzc0B3amrR7/p7SYgiwONESj3q090od3I7sGNCPyE0yqDy2ImC7
   5jSe6dGwdHxqrIF8DiIkKJHtIbAFDxkerm0KibD0PzrMdTBMLMrR/VNsij9w7Aov
   +LiGi4dr40s33UkxFNsoYFxGv0BIHiG7em6zYIkCqYEApo0ea5a61vcCwHuli9nt
   APuWDLm4GaWcqkm0HK1Mvv3mIS4FGWYdNqtvzGpuzRHG1n6lI3UjOvH6jBqCbIdg
   oPlH8HeAN0klh8xxx...xxxCtQ4LtC400gldcEC
   Qn5MlaJ21LcFzSMdxBoJSS0CgYASErsTZxKWvKyDfRmD4zdIJ0sgwA0tjiMoIW2h
   xG90ScXPWI805yEgVsTHos043413dv5MmpgOSXKMBSuWFVGWursv6flJAdImCIwX
   VXjIL03GXDmpqr0R/Z8bU4oa7S4VGghAe0swozavzTk5SFm7dWCyMif2/Vbv0u3v
   saj2CQKBqOCcMokki1iJK2SrhTa3LT/KFRjylAMkyYmTU6gyz0GCWXKUkHVNOBvE
   lkPq17iIRA2pG5kDOSlNnkLkFic04m/tIsyfPQpdHNcd1WFEn18Zjb+on/mqTwED
   nPhnrk0LV4MAx200qCvNiZ8tNpw7f3pZqF90krvkZ1hzURqnBmAGnA==
   -----END RSA PRIVATE KEY-----

4. Go to the Install App page. Select the target account or organization, choose the repositories to grant access to, and click Install. After installation, find the Installation ID in the URL or on the installed app's configuration page.

   To find the Installation ID, check the number at the end of the browser address bar URL after installation. The URL format is:

   https://github.com/organizations/{org-name}/settings/installations/{INSTALLATION_ID}

5. In Flow, go to and click New Service Connection. Select the GitHub type. Create a GitHub certificate by entering the Client ID, the Private key file contents, and the Installation ID from previous steps. Create the certificate and then create the service connection.

   Enter the Service connection name and set the Usage Scope (options: Private: visible only to yourself, Public: visible to everyone, Custom: visible to specified members; default is Private).

6. Create a pipeline and add a code source. Select the GitHub service connection you created. You can now select the repository and branches. The pipeline can clone code, merge branches, and delete branches.

Connect to an internal self-hosted GitLab

If your self-hosted GitLab is accessible only through your internal network, use a Flow Region site to connect. The central Flow site does not support this feature.

1. In the Flow console, activate the VPC domain and add a reverse access IP address for your GitLab site. Network settings.

2. When you create the Service Connection, select Self-hosted GitLab (API v4 and later) as the type.

3. Create a new service authorization/certificate. Select The GitLab domain can be accessed only through an internal network. Then select the VPC, enter the internal IP address, and provide your GitLab domain name and credentials.

4. Click Test Connection to verify connectivity. If the test fails, the connection cannot be used. Use the error message to troubleshoot.