Skip to content

Commit 582bfae

Browse files
dustymabedustymabe
committed
updates for Azure credential handling
This PR updates our Azure credential docs and handling to match what was implemented in coreos/coreos-assembler#3349 Mainly we now only need one `azureCreds.json` file for authentication (this means Azure is now more like the others that only need a single file for authentication) and we must update CLI calls to use --azure-credentials.
1 parent 10b47db commit 582bfae

File tree

3 files changed

+30
-46
lines changed

3 files changed

+30
-46
lines changed

‎HACKING.md‎

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -187,31 +187,29 @@ NOTE: For the prod pipeline these secrets can be found in BitWarden
187187

188188
### [OPTIONAL] Creating Azure credentials configs
189189

190-
If you want to run kola tests against Azure images you need to
191-
create a secret with an `azureProfile.json` and a file called an
192-
azure auth file. See the
190+
If you want to do image uploads or run kola tests against Azure
191+
images you need to create a file called `azureCreds.json`. See the
193192
[kola docs](https://github.com/coreos/coreos-assembler/blob/main/docs/mantle/credentials.md#azure)
194193
for more information on those files.
195194

196-
Once you have the azureAuth.json and azureProfile.json for connecting to Azure,
197-
create the secrets in OpenShift:
195+
Once you have the azureCreds.json for connecting to Azure, create the secrets in OpenShift:
198196

199197
```
200-
oc create secret generic azure-kola-tests-config-profile \
201-
--from-literal=filename=azureProfile.json \
202-
--from-file=data=/path/to/azureProfile.json
203-
oc label secret/azure-kola-tests-config-profile \
198+
oc create secret generic azure-image-upload-config \
199+
--from-literal=filename=azure_config_file \
200+
--from-file=data=/path/to/upload-secret
201+
oc label secret/azure-image-upload-config \
204202
jenkins.io/credentials-type=secretFile
205-
oc annotate secret/azure-kola-tests-config-profile \
206-
jenkins.io/credentials-description="Azure kola tests azureProfile.json"
203+
oc annotate secret/azure-image-upload-config \
204+
jenkins.io/credentials-description="Azure image upload credentials config"
207205
208-
oc create secret generic azure-kola-tests-config-auth \
209-
--from-literal=filename=azureAuth.json \
210-
--from-file=data=/path/to/azureAuth.json
211-
oc label secret/azure-kola-tests-config-auth \
206+
oc create secret generic azure-kola-tests-config \
207+
--from-literal=filename=azure_config_file \
208+
--from-file=data=/path/to/kola-secret
209+
oc label secret/azure-kola-tests-config \
212210
jenkins.io/credentials-type=secretFile
213-
oc annotate secret/azure-kola-tests-config-auth \
214-
jenkins.io/credentials-description="Azure kola tests azureAuth.json"
211+
oc annotate secret/azure-kola-tests-config \
212+
jenkins.io/credentials-description="Azure kola tests credentials config"
215213
```
216214

217215
NOTE: For the prod pipeline these secrets can be found in BitWarden

‎jobs/kola-azure.Jenkinsfile‎

Lines changed: 11 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,8 @@ timeout(time: 75, unit: 'MINUTES') {
8686
azure_image_name = "kola-fedora-coreos-${params.STREAM}-${params.ARCH}.vhd"
8787
}
8888

89-
withCredentials([file(variable: 'AZURE_KOLA_TESTS_CONFIG_PROFILE',
90-
credentialsId: 'azure-kola-tests-config-profile'),
91-
file(variable: 'AZURE_KOLA_TESTS_CONFIG_AUTH',
92-
credentialsId: 'azure-kola-tests-config-auth')]) {
89+
withCredentials([file(variable: 'AZURE_KOLA_TESTS_CONFIG',
90+
credentialsId: 'azure-kola-tests-config')]) {
9391

9492
def azure_testing_resource_group = pipecfg.clouds?.azure?.test_resource_group
9593
def azure_testing_storage_account = pipecfg.clouds?.azure?.test_storage_account
@@ -100,32 +98,28 @@ timeout(time: 75, unit: 'MINUTES') {
10098
shwrap("""
10199
# First delete the blob/image since we re-use it.
102100
ore azure delete-image --log-level=INFO \
103-
--azure-auth \${AZURE_KOLA_TESTS_CONFIG_AUTH} \
104-
--azure-profile \${AZURE_KOLA_TESTS_CONFIG_PROFILE} \
101+
--azure-credentials \${AZURE_KOLA_TESTS_CONFIG} \
105102
--azure-location $region \
106103
--resource-group ${azure_testing_resource_group} \
107104
--image-name ${azure_image_name}
108105
ore azure delete-blob --log-level=INFO \
109-
--azure-auth \${AZURE_KOLA_TESTS_CONFIG_AUTH} \
110-
--azure-profile \${AZURE_KOLA_TESTS_CONFIG_PROFILE} \
106+
--azure-credentials \${AZURE_KOLA_TESTS_CONFIG} \
111107
--azure-location $region \
112108
--resource-group $azure_testing_resource_group \
113109
--storage-account $azure_testing_storage_account \
114110
--container $azure_testing_storage_container \
115111
--blob-name $azure_image_name
116112
# Then create them fresh
117113
ore azure upload-blob --log-level=INFO \
118-
--azure-auth \${AZURE_KOLA_TESTS_CONFIG_AUTH} \
119-
--azure-profile \${AZURE_KOLA_TESTS_CONFIG_PROFILE} \
114+
--azure-credentials \${AZURE_KOLA_TESTS_CONFIG} \
120115
--azure-location $region \
121116
--resource-group $azure_testing_resource_group \
122117
--storage-account $azure_testing_storage_account \
123118
--container $azure_testing_storage_container \
124119
--blob-name $azure_image_name \
125120
--file ${azure_image_filepath}
126121
ore azure create-image --log-level=INFO \
127-
--azure-auth \${AZURE_KOLA_TESTS_CONFIG_AUTH} \
128-
--azure-profile \${AZURE_KOLA_TESTS_CONFIG_PROFILE} \
122+
--azure-credentials \${AZURE_KOLA_TESTS_CONFIG} \
129123
--resource-group $azure_testing_resource_group \
130124
--azure-location $region \
131125
--image-name $azure_image_name \
@@ -136,29 +130,26 @@ timeout(time: 75, unit: 'MINUTES') {
136130
// Since we don't have permanent images uploaded to Azure we'll
137131
// skip the upgrade test.
138132
try {
139-
def azure_subscription = shwrapCapture("jq -r .subscriptionId \${AZURE_KOLA_TESTS_CONFIG_AUTH}")
133+
def azure_subscription = shwrapCapture("jq -r .subscription \${AZURE_KOLA_TESTS_CONFIG}")
140134
kola(cosaDir: env.WORKSPACE, parallel: 10,
141135
build: params.VERSION, arch: params.ARCH,
142136
extraArgs: params.KOLA_TESTS,
143137
skipUpgrade: true,
144138
platformArgs: """-p=azure \
145-
--azure-auth \${AZURE_KOLA_TESTS_CONFIG_AUTH} \
146-
--azure-profile \${AZURE_KOLA_TESTS_CONFIG_PROFILE} \
139+
--azure-credentials \${AZURE_KOLA_TESTS_CONFIG} \
147140
--azure-location $region \
148141
--azure-disk-uri /subscriptions/${azure_subscription}/resourceGroups/${azure_testing_resource_group}/providers/Microsoft.Compute/images/${azure_image_name}""")
149142
} finally {
150143
parallel "Delete Image": {
151144
// Delete the image in Azure
152145
shwrap("""
153146
ore azure delete-image --log-level=INFO \
154-
--azure-auth \${AZURE_KOLA_TESTS_CONFIG_AUTH} \
155-
--azure-profile \${AZURE_KOLA_TESTS_CONFIG_PROFILE} \
147+
--azure-credentials \${AZURE_KOLA_TESTS_CONFIG} \
156148
--azure-location $region \
157149
--resource-group $azure_testing_resource_group \
158150
--image-name $azure_image_name
159151
ore azure delete-blob --log-level=INFO \
160-
--azure-auth \${AZURE_KOLA_TESTS_CONFIG_AUTH} \
161-
--azure-profile \${AZURE_KOLA_TESTS_CONFIG_PROFILE} \
152+
--azure-credentials \${AZURE_KOLA_TESTS_CONFIG} \
162153
--azure-location $region \
163154
--resource-group $azure_testing_resource_group \
164155
--storage-account $azure_testing_storage_account \
@@ -168,8 +159,7 @@ timeout(time: 75, unit: 'MINUTES') {
168159
}, "Garbage Collection": {
169160
shwrap("""
170161
ore azure gc --log-level=INFO \
171-
--azure-auth \${AZURE_KOLA_TESTS_CONFIG_AUTH} \
172-
--azure-profile \${AZURE_KOLA_TESTS_CONFIG_PROFILE} \
162+
--azure-credentials \${AZURE_KOLA_TESTS_CONFIG} \
173163
--azure-location $region
174164
""")
175165
}

‎libcloud.groovy‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -186,23 +186,19 @@ def upload_to_clouds(pipecfg, basearch, buildID, stream) {
186186
}
187187
}
188188

189-
credentials = [file(variable: 'AZURE_IMAGE_UPLOAD_CONFIG_AUTH',
190-
credentialsId: 'azure-image-upload-config-auth'),
191-
file(variable: 'AZURE_IMAGE_UPLOAD_CONFIG_PROFILE',
192-
credentialsId: 'azure-image-upload-config-profile')]
189+
credentials = [file(variable: 'AZURE_IMAGE_UPLOAD_CONFIG',
190+
credentialsId: 'azure-image-upload-config')]
193191
if (pipecfg.clouds?.azure &&
194192
artifacts.contains("azure") &&
195193
utils.credentialsExist(credentials)) {
196194
def creds = credentials
197195
uploaders["☁️ ⬆️ :azure"] = {
198196
withCredentials(creds) {
199-
utils.syncCredentialsIfInRemoteSession(["AZURE_IMAGE_UPLOAD_CONFIG_AUTH",
200-
"AZURE_IMAGE_UPLOAD_CONFIG_PROFILE"])
197+
utils.syncCredentialsIfInRemoteSession(["AZURE_IMAGE_UPLOAD_CONFIG"])
201198
def c = pipecfg.clouds.azure
202199
shwrap("""cosa buildextend-azure \
203200
--upload \
204-
--auth \${AZURE_IMAGE_UPLOAD_CONFIG_AUTH} \
205-
--profile \${AZURE_IMAGE_UPLOAD_CONFIG_PROFILE} \
201+
--credentials \${AZURE_IMAGE_UPLOAD_CONFIG} \
206202
--build=${buildID} \
207203
--resource-group ${c.resource_group} \
208204
--storage-account ${c.storage_account} \

0 commit comments

Comments
 (0)