From 0e043fe6cc3b803f8c3a90ce0b3728e5559b49f6 Mon Sep 17 00:00:00 2001 From: Kevin Minehart Date: Thu, 19 Jan 2023 16:48:35 -0600 Subject: [PATCH] [v9.2.x] Packaging: Use base64 key (#61822) backport Co-authored-by: Julien Duchesne --- .drone.yml | 42 +++++++++++++++++-- scripts/drone/vault.star | 88 +++++++++++++++++++++++++++++++++------- 2 files changed, 113 insertions(+), 17 deletions(-) diff --git a/.drone.yml b/.drone.yml index 251bee30b4d..5fa1f9ca595 100644 --- a/.drone.yml +++ b/.drone.yml @@ -5585,13 +5585,31 @@ kind: secret name: gcp_upload_artifacts_key --- get: - name: public-key + name: application_id + path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials +kind: secret +name: azure_sp_app_id +--- +get: + name: application_secret + path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials +kind: secret +name: azure_sp_app_pw +--- +get: + name: tenant_id + path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials +kind: secret +name: azure_tenant +--- +get: + name: public-key-b64 path: infra/data/ci/packages-publish/gpg kind: secret name: packages_gpg_public_key --- get: - name: private-key + name: private-key-b64 path: infra/data/ci/packages-publish/gpg kind: secret name: packages_gpg_private_key @@ -5620,7 +5638,25 @@ get: kind: secret name: packages_secret_access_key --- +get: + name: aws_region + path: secret/data/common/aws-marketplace +kind: secret +name: aws_region +--- +get: + name: aws_access_key_id + path: secret/data/common/aws-marketplace +kind: secret +name: aws_access_key_id +--- +get: + name: aws_secret_access_key + path: secret/data/common/aws-marketplace +kind: secret +name: aws_secret_access_key +--- kind: signature -hmac: 2926632c20b97a9cf06e0315a309853a386b889711f4c61d29e6caf46842d27e +hmac: 4cd9c45598335fad9a2d337ada7b09c6620038bbd878683bb78281cf2de6d1de ... diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star index b30d486cfec..b7ebbd54e8b 100644 --- a/scripts/drone/vault.star +++ b/scripts/drone/vault.star @@ -1,13 +1,15 @@ pull_secret = 'dockerconfigjson' -github_token = 'github_token' drone_token = 'drone_token' prerelease_bucket = 'prerelease_bucket' gcp_upload_artifacts_key = 'gcp_upload_artifacts_key' +azure_sp_app_id = 'azure_sp_app_id' +azure_sp_app_pw = 'azure_sp_app_pw' +azure_tenant = 'azure_tenant' +github_token = 'github_token' def from_secret(secret): - return { - 'from_secret': secret - } + return {'from_secret': secret} + def vault_secret(name, path, key): return { @@ -16,22 +18,80 @@ def vault_secret(name, path, key): 'get': { 'path': path, 'name': key, - } + }, } + def secrets(): return [ vault_secret(pull_secret, 'secret/data/common/gcr', '.dockerconfigjson'), - vault_secret(github_token, 'infra/data/ci/github/grafanabot', 'pat'), + vault_secret('github_token', 'infra/data/ci/github/grafanabot', 'pat'), vault_secret(drone_token, 'infra/data/ci/drone', 'machine-user-token'), vault_secret(prerelease_bucket, 'infra/data/ci/grafana/prerelease', 'bucket'), - vault_secret(gcp_upload_artifacts_key, 'infra/data/ci/grafana/releng/artifacts-uploader-service-account', 'credentials.json'), - + vault_secret( + gcp_upload_artifacts_key, + 'infra/data/ci/grafana/releng/artifacts-uploader-service-account', + 'credentials.json', + ), + vault_secret( + azure_sp_app_id, + 'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials', + 'application_id', + ), + vault_secret( + azure_sp_app_pw, + 'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials', + 'application_secret', + ), + vault_secret( + azure_tenant, + 'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials', + 'tenant_id', + ), # Package publishing - vault_secret('packages_gpg_public_key', 'infra/data/ci/packages-publish/gpg', 'public-key'), - vault_secret('packages_gpg_private_key', 'infra/data/ci/packages-publish/gpg', 'private-key'), - vault_secret('packages_gpg_passphrase', 'infra/data/ci/packages-publish/gpg', 'passphrase'), - vault_secret('packages_service_account', 'infra/data/ci/packages-publish/service-account', 'credentials.json'), - vault_secret('packages_access_key_id', 'infra/data/ci/packages-publish/bucket-credentials', 'AccessID'), - vault_secret('packages_secret_access_key', 'infra/data/ci/packages-publish/bucket-credentials', 'Secret'), + vault_secret( + 'packages_gpg_public_key', + 'infra/data/ci/packages-publish/gpg', + 'public-key-b64', + ), + vault_secret( + 'packages_gpg_private_key', + 'infra/data/ci/packages-publish/gpg', + 'private-key-b64', + ), + vault_secret( + 'packages_gpg_passphrase', + 'infra/data/ci/packages-publish/gpg', + 'passphrase', + ), + vault_secret( + 'packages_service_account', + 'infra/data/ci/packages-publish/service-account', + 'credentials.json', + ), + vault_secret( + 'packages_access_key_id', + 'infra/data/ci/packages-publish/bucket-credentials', + 'AccessID', + ), + vault_secret( + 'packages_secret_access_key', + 'infra/data/ci/packages-publish/bucket-credentials', + 'Secret', + ), + vault_secret( + 'aws_region', + 'secret/data/common/aws-marketplace', + 'aws_region', + ), + vault_secret( + 'aws_access_key_id', + 'secret/data/common/aws-marketplace', + 'aws_access_key_id', + ), + vault_secret( + 'aws_secret_access_key', + 'secret/data/common/aws-marketplace', + 'aws_secret_access_key', + ), ]