From 18426f19d617a0cc643714ef8dc9828ff5be9909 Mon Sep 17 00:00:00 2001
From: Kevin Minehart <kmineh0151@gmail.com>
Date: Thu, 19 Jan 2023 16:49:21 -0600
Subject: [PATCH] [v8.5.x] Packaging: Use base64 key (#61821)

backport

Co-authored-by: Julien Duchesne <julien.duchesne@grafana.com>
---
 .drone.yml               | 74 +++++++++++++++++++++++++++++++++++-
 scripts/drone/vault.star | 81 +++++++++++++++++++++++++++++++++++++---
 2 files changed, 148 insertions(+), 7 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 6cd9cb9adfd..dcbd36eaf15 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -4565,7 +4565,79 @@ get:
 kind: secret
 name: gcp_upload_artifacts_key
 ---
+get:
+  name: application_id
+  path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials
+kind: secret
+name: azure_sp_app_id
+---
+get:
+  name: application_secret
+  path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials
+kind: secret
+name: azure_sp_app_pw
+---
+get:
+  name: tenant_id
+  path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials
+kind: secret
+name: azure_tenant
+---
+get:
+  name: public-key-b64
+  path: infra/data/ci/packages-publish/gpg
+kind: secret
+name: packages_gpg_public_key
+---
+get:
+  name: private-key-b64
+  path: infra/data/ci/packages-publish/gpg
+kind: secret
+name: packages_gpg_private_key
+---
+get:
+  name: passphrase
+  path: infra/data/ci/packages-publish/gpg
+kind: secret
+name: packages_gpg_passphrase
+---
+get:
+  name: credentials.json
+  path: infra/data/ci/packages-publish/service-account
+kind: secret
+name: packages_service_account
+---
+get:
+  name: AccessID
+  path: infra/data/ci/packages-publish/bucket-credentials
+kind: secret
+name: packages_access_key_id
+---
+get:
+  name: Secret
+  path: infra/data/ci/packages-publish/bucket-credentials
+kind: secret
+name: packages_secret_access_key
+---
+get:
+  name: aws_region
+  path: secret/data/common/aws-marketplace
+kind: secret
+name: aws_region
+---
+get:
+  name: aws_access_key_id
+  path: secret/data/common/aws-marketplace
+kind: secret
+name: aws_access_key_id
+---
+get:
+  name: aws_secret_access_key
+  path: secret/data/common/aws-marketplace
+kind: secret
+name: aws_secret_access_key
+---
 kind: signature
-hmac: 5c4e5c07f77a1fb4df97b363e1fd487731f292219fca3abc76a7f43c5650b59b
+hmac: b65ffdb9332c4fa65a76b25e84b5b5e71719d51e76d1cc84a9b230464b1b311c
 
 ...
diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star
index 997f8b443bb..98a101ae4ba 100644
--- a/scripts/drone/vault.star
+++ b/scripts/drone/vault.star
@@ -1,13 +1,16 @@
 pull_secret = 'dockerconfigjson'
-github_token = 'github_token'
 drone_token = 'drone_token'
 prerelease_bucket = 'prerelease_bucket'
 gcp_upload_artifacts_key = 'gcp_upload_artifacts_key'
+azure_sp_app_id = 'azure_sp_app_id'
+azure_sp_app_pw = 'azure_sp_app_pw'
+azure_tenant = 'azure_tenant'
+github_token = 'github_token'
+
 
 def from_secret(secret):
-    return {
-        'from_secret': secret
-    }
+    return {'from_secret': secret}
+
 
 def vault_secret(name, path, key):
     return {
@@ -16,14 +19,80 @@ def vault_secret(name, path, key):
         'get': {
             'path': path,
             'name': key,
-        }
+        },
     }
 
+
 def secrets():
     return [
         vault_secret(pull_secret, 'secret/data/common/gcr', '.dockerconfigjson'),
         vault_secret(github_token, 'infra/data/ci/github/grafanabot', 'pat'),
         vault_secret(drone_token, 'infra/data/ci/drone', 'machine-user-token'),
         vault_secret(prerelease_bucket, 'infra/data/ci/grafana/prerelease', 'bucket'),
-        vault_secret(gcp_upload_artifacts_key, 'infra/data/ci/grafana/releng/artifacts-uploader-service-account', 'credentials.json'),
+        vault_secret(
+            gcp_upload_artifacts_key,
+            'infra/data/ci/grafana/releng/artifacts-uploader-service-account',
+            'credentials.json',
+        ),
+        vault_secret(
+            azure_sp_app_id,
+            'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials',
+            'application_id',
+        ),
+        vault_secret(
+            azure_sp_app_pw,
+            'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials',
+            'application_secret',
+        ),
+        vault_secret(
+            azure_tenant,
+            'infra/data/ci/datasources/cpp-azure-resourcemanager-credentials',
+            'tenant_id',
+        ),
+        # Package publishing
+        vault_secret(
+            'packages_gpg_public_key',
+            'infra/data/ci/packages-publish/gpg',
+            'public-key-b64',
+        ),
+        vault_secret(
+            'packages_gpg_private_key',
+            'infra/data/ci/packages-publish/gpg',
+            'private-key-b64',
+        ),
+        vault_secret(
+            'packages_gpg_passphrase',
+            'infra/data/ci/packages-publish/gpg',
+            'passphrase',
+        ),
+        vault_secret(
+            'packages_service_account',
+            'infra/data/ci/packages-publish/service-account',
+            'credentials.json',
+        ),
+        vault_secret(
+            'packages_access_key_id',
+            'infra/data/ci/packages-publish/bucket-credentials',
+            'AccessID',
+        ),
+        vault_secret(
+            'packages_secret_access_key',
+            'infra/data/ci/packages-publish/bucket-credentials',
+            'Secret',
+        ),
+        vault_secret(
+            'aws_region',
+            'secret/data/common/aws-marketplace',
+            'aws_region',
+        ),
+        vault_secret(
+            'aws_access_key_id',
+            'secret/data/common/aws-marketplace',
+            'aws_access_key_id',
+        ),
+        vault_secret(
+            'aws_secret_access_key',
+            'secret/data/common/aws-marketplace',
+            'aws_secret_access_key',
+        ),
     ]