public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v9.2.x] Packaging: Use base64 key (#61822)

Browse Source 
backport

Co-authored-by: Julien Duchesne <julien.duchesne@grafana.com>
This commit is contained in:
Kevin Minehart
2023-01-19 22:48:35 +00:00
committed by GitHub
co-authored by Julien Duchesne
parent 0f40e95b54
commit 0e043fe6cc
2 changed files with 113 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.drone.yml
+39 -3
View File
@@ -5585,13 +5585,31 @@ kind: secret
name: gcp_upload_artifacts_key
---
get:
name: public-key
name: application_id
path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials
kind: secret
name: azure_sp_app_id
---
get:
name: application_secret
path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials
kind: secret
name: azure_sp_app_pw
---
get:
name: tenant_id
path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials
kind: secret
name: azure_tenant
---
get:
name: public-key-b64
path: infra/data/ci/packages-publish/gpg
kind: secret
name: packages_gpg_public_key
---
get:
name: private-key
name: private-key-b64
path: infra/data/ci/packages-publish/gpg
kind: secret
name: packages_gpg_private_key
@@ -5620,7 +5638,25 @@ get:
kind: secret
name: packages_secret_access_key
---
get:
name: aws_region
path: secret/data/common/aws-marketplace
kind: secret
name: aws_region
---
get:
name: aws_access_key_id
path: secret/data/common/aws-marketplace
kind: secret
name: aws_access_key_id
---
get:
name: aws_secret_access_key
path: secret/data/common/aws-marketplace
kind: secret
name: aws_secret_access_key
---
kind: signature
hmac: 2926632c20b97a9cf06e0315a309853a386b889711f4c61d29e6caf46842d27e
hmac: 4cd9c45598335fad9a2d337ada7b09c6620038bbd878683bb78281cf2de6d1de
...
scripts/drone/vault.star
+74 -14
View File
@@ -1,13 +1,15 @@
pull_secret = 'dockerconfigjson'
github_token = 'github_token'
drone_token = 'drone_token'
prerelease_bucket = 'prerelease_bucket'
gcp_upload_artifacts_key = 'gcp_upload_artifacts_key'
azure_sp_app_id = 'azure_sp_app_id'
azure_sp_app_pw = 'azure_sp_app_pw'
azure_tenant = 'azure_tenant'
github_token = 'github_token'
def from_secret(secret):
return {
'from_secret': secret
}
return {'from_secret': secret}
def vault_secret(name, path, key):
return {
@@ -16,22 +18,80 @@ def vault_secret(name, path, key):
'get': {
'path': path,
'name': key,
}
},
}
def secrets():
return [
vault_secret(pull_secret, 'secret/data/common/gcr', '.dockerconfigjson'),
vault_secret(github_token, 'infra/data/ci/github/grafanabot', 'pat'),
vault_secret('github_token', 'infra/data/ci/github/grafanabot', 'pat'),
vault_secret(drone_token, 'infra/data/ci/drone', 'machine-user-token'),
vault_secret(prerelease_bucket, 'infra/data/ci/grafana/prerelease', 'bucket'),
vault_secret(gcp_upload_artifacts_key, 'infra/data/ci/grafana/releng/artifacts-uploader-service-account', 'credentials.json'),
vault_secret(
gcp_upload_artifacts_key,
'infra/data/ci/grafana/releng/artifacts-uploader-service-account',
'credentials.json',
),
vault_secret(
azure_sp_app_id,
'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials',
'application_id',
),
vault_secret(
azure_sp_app_pw,
'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials',
'application_secret',
),
vault_secret(
azure_tenant,
'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials',
'tenant_id',
),
# Package publishing
vault_secret('packages_gpg_public_key', 'infra/data/ci/packages-publish/gpg', 'public-key'),
vault_secret('packages_gpg_private_key', 'infra/data/ci/packages-publish/gpg', 'private-key'),
vault_secret('packages_gpg_passphrase', 'infra/data/ci/packages-publish/gpg', 'passphrase'),
vault_secret('packages_service_account', 'infra/data/ci/packages-publish/service-account', 'credentials.json'),
vault_secret('packages_access_key_id', 'infra/data/ci/packages-publish/bucket-credentials', 'AccessID'),
vault_secret('packages_secret_access_key', 'infra/data/ci/packages-publish/bucket-credentials', 'Secret'),
vault_secret(
'packages_gpg_public_key',
'infra/data/ci/packages-publish/gpg',
'public-key-b64',
),
vault_secret(
'packages_gpg_private_key',
'infra/data/ci/packages-publish/gpg',
'private-key-b64',
),
vault_secret(
'packages_gpg_passphrase',
'infra/data/ci/packages-publish/gpg',
'passphrase',
),
vault_secret(
'packages_service_account',
'infra/data/ci/packages-publish/service-account',
'credentials.json',
),
vault_secret(
'packages_access_key_id',
'infra/data/ci/packages-publish/bucket-credentials',
'AccessID',
),
vault_secret(
'packages_secret_access_key',
'infra/data/ci/packages-publish/bucket-credentials',
'Secret',
),
vault_secret(
'aws_region',
'secret/data/common/aws-marketplace',
'aws_region',
),
vault_secret(
'aws_access_key_id',
'secret/data/common/aws-marketplace',
'aws_access_key_id',
),
vault_secret(
'aws_secret_access_key',
'secret/data/common/aws-marketplace',
'aws_secret_access_key',
),
]