Skip to content

Commit 611ba4c

Browse files
githubofkrishnadhasgithubofkrishnadhas
committed
DEVOPS-41 update secrets from KV
1 parent c6aa80b commit 611ba4c

File tree

9 files changed

+391
-335
lines changed

9 files changed

+391
-335
lines changed

‎.github/workflows/simple-az-check-secret.yaml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
11
name: Azure Auth and az account show
22

33
on:
4-
push:
5-
workflo_dispatch:
4+
# push:
5+
workflow_dispatch:
66

77
jobs:
88
azure-auth:
99
runs-on: ubuntu-latest
1010

1111
steps:
12-
- name: Checkout repository
13-
uses: actions/checkout@v2
12+
- name: Checkout repository
13+
uses: actions/checkout@v2
1414

15-
- name: Set up Azure CLI
16-
uses: azure/CLI@v1
15+
- name: Azure CLI script
16+
uses: azure/cli@v2
17+
with:
18+
azcliversion: latest
19+
inlineScript: |
20+
az login --service-principal -u ${{ secrets.ARM_CLIENT_ID }} -p ${{ secrets.ARM_CLIENT_SECRET }} --tenant ${{ secrets.ARM_TENANT_ID }}
21+
az account set --subscription ${{ secrets.ARM_SUBSCRIPTION_ID }}
22+
az account show -o json
1723
18-
- name: Login via Azure CLI
19-
run: |
20-
az login --service-principal -u ${{ secrets.ARM_CLIENT_ID }} -p ${{ secrets.ARM_CLIENT_SECRET }} --tenant ${{ secrets.ARM_TENANT_ID }}
21-
az account set --subscription ${{ secrets.ARM_SUBSCRIPTION_ID }}
22-
az account show -o json
23-
24-
- name: Completed
25-
run: echo 'completed'
24+
- name: Completed
25+
run: echo 'completed'

‎README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,20 @@
11
# github-get-secrets-from-azure-kv-and-configure-as-repo-secrets
2+
23
Fetch Specific Secrets from Azure key vault and configure as repo secrets
4+
5+
# Mandatory Environment variables
6+
7+
The below are used for authentication and programatical usage
8+
9+
```commandline
10+
AZURE_CLIENT_ID
11+
AZURE_TENANT_ID
12+
AZURE_CLIENT_ID
13+
```
14+
15+
The below one is used to determine the owner of repo. This is a environment variable provided by GitHub.
16+
17+
```commandline
18+
GITHUB_REPOSITORY_OWNER
19+
```
20+

‎create_repo_secrets.py‎

Lines changed: 47 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,63 @@
1-
import requests
21
import os
32
from datetime import datetime
3+
44
import pytz
5+
import requests
6+
57

68
def current_ist_time():
7-
"""code to return time in IST"""
8-
# Get the current time in IST
9-
ist = pytz.timezone('Asia/Kolkata')
10-
ist_now = datetime.now(ist)
9+
"""code to return time in IST"""
10+
# Get the current time in IST
11+
ist = pytz.timezone('Asia/Kolkata')
12+
ist_now = datetime.now(ist)
1113

12-
# Format and print the current time in IST
13-
ist_now_formatted = ist_now.strftime('%Y-%m-%d %H:%M:%S %Z%z')
14-
return ist_now_formatted
14+
# Format and print the current time in IST
15+
ist_now_formatted = ist_now.strftime('%Y-%m-%d %H:%M:%S %Z%z')
16+
return ist_now_formatted
1517

1618

1719
def create_or_update_repository_secret_github(repo_name: str, secret_name: str, secret_value: str, public_key_id: int):
18-
"""
19-
Create or update org level secret in GitHub
20-
Ref https://docs.github.com/en/rest/actions/secrets?apiVersion=2022-11-28#create-or-update-an-organization-secret
21-
22-
The token must have the following permission set: organization_secrets:write
23-
"""
24-
encrypted_secret = secret_value
25-
organization = os.getenv('GITHUB_REPOSITORY_OWNER')
26-
27-
if not encrypted_secret:
28-
print("ENCRYPTED_SECRET environment variable is not set or is empty.")
29-
# print(f'encrypted sec is: {encrypted_secret}')
30-
ist_now_formatted = current_ist_time()
31-
github_repo_secret_endpoint = f"https://api.github.com/repos/{organization}/{repo_name}/actions/secrets/{secret_name}"
32-
33-
headers = {
34-
"Accept": "application/vnd.github+json",
35-
"Authorization": f"Bearer {os.getenv('GH_TOKEN')}",
36-
"X-GitHub-Api-Version": "2022-11-28"
37-
}
38-
data = {
39-
"encrypted_value": encrypted_secret,
40-
"visibility": "all",
41-
"key_id": public_key_id
42-
}
43-
response = requests.put(github_repo_secret_endpoint, headers=headers, json=data)
44-
if response.status_code == 201:
45-
print(f"Secret {secret_name} created on {repo_name} at {ist_now_formatted} ")
46-
else:
47-
print(f"Secret {secret_name} updated on {repo_name} at {ist_now_formatted} ")
20+
"""
21+
Create or update org level secret in GitHub
22+
Ref https://docs.github.com/en/rest/actions/secrets?apiVersion=2022-11-28#create-or-update-an-organization-secret
23+
24+
The token must have the following permission set: organization_secrets:write
25+
"""
26+
encrypted_secret = secret_value
27+
organization = os.getenv('GITHUB_REPOSITORY_OWNER')
28+
29+
if not encrypted_secret:
30+
print("ENCRYPTED_SECRET environment variable is not set or is empty.")
31+
# print(f'encrypted sec is: {encrypted_secret}')
32+
ist_now_formatted = current_ist_time()
33+
github_repo_secret_endpoint = f"https://api.github.com/repos/{organization}/{repo_name}/actions/secrets/{secret_name}"
34+
35+
headers = {
36+
"Accept": "application/vnd.github+json",
37+
"Authorization": f"Bearer {os.getenv('GH_TOKEN')}",
38+
"X-GitHub-Api-Version": "2022-11-28"
39+
}
40+
data = {
41+
"encrypted_value": encrypted_secret,
42+
"visibility": "all",
43+
"key_id": public_key_id
44+
}
45+
response = requests.put(github_repo_secret_endpoint, headers=headers, json=data)
46+
if response.status_code == 201:
47+
print(f"Secret {secret_name} created on {repo_name} at {ist_now_formatted} ")
48+
else:
49+
print(f"Secret {secret_name} updated on {repo_name} at {ist_now_formatted} ")
4850

4951

5052
def main():
51-
"""To test the code"""
53+
"""To test the code"""
54+
55+
organization = os.getenv('GITHUB_REPOSITORY_OWNER')
56+
secret_name = os.getenv('secret_name')
5257

53-
organization = os.getenv('organization')
54-
secret_name = os.getenv('secret_name')
58+
# Function call
59+
create_or_update_repository_secret_github(organization, secret_name)
5560

56-
# Function call
57-
create_or_update_repository_secret_github(organization, secret_name)
5861

5962
if __name__ == "__main__":
60-
main()
63+
main()

‎encrypt_using_libnacl.py‎

Lines changed: 34 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -4,40 +4,45 @@
44
# The function then encrypts the provided value using the public key and returns the result in a Base64-encoded format.
55
# For example, calling encrypt("aSBhbSBrcmlzaG5hZGhhcwo=", "aSBhbSBrcmlzaG5hZGhhcwo=") demonstrates how to encrypt a sample Unicode string using a specified public key.
66
# Ensure proper handling and security of public keys and secret values within your application.
7-
from get_repo_public_key import get_repository_public_key
7+
import os
88
from base64 import b64encode
9+
910
from nacl import encoding, public
10-
import os
11+
12+
from get_repo_public_key import get_repository_public_key
13+
1114

1215
def encrypt(public_key: str, secret_value: str) -> str:
13-
"""Encrypt a Unicode string using the public key."""
14-
public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
15-
sealed_box = public.SealedBox(public_key)
16-
encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
17-
return b64encode(encrypted).decode("utf-8")
16+
"""Encrypt a Unicode string using the public key."""
17+
public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
18+
sealed_box = public.SealedBox(public_key)
19+
encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
20+
return b64encode(encrypted).decode("utf-8")
21+
1822

1923
def main():
20-
organization = os.getenv('organization')
21-
repository_name = os.getenv('repository_name')
22-
repo_public_key = get_repository_public_key(organization=organization, repository_name=repository_name)
23-
# repo_public_key = os.environ.get("REPOSITORY_PUBLIC_KEY")
24-
# secret_value = os.environ.get("SECRET_VALUE")
25-
# public_key = "<public key here for local testing>"
26-
secret_value = "Krishnadhas"
27-
28-
if not (repo_public_key and secret_value):
29-
print("Please set REPOSITORY_PUBLIC_KEY and SECRET_VALUE environment variables.")
30-
exit(1)
31-
32-
try:
33-
encrypted_secret = encrypt(repo_public_key, secret_value)
34-
os.system(f'echo "ENCRYPTED_SECRET={encrypted_secret}" >> $GITHUB_ENV')
35-
print(f"Encrypted Secret: {encrypted_secret}")
36-
print(f"Encrypted secret added as a environment variable")
37-
return encrypted_secret
38-
except Exception as e:
39-
print(f"Error encrypting secret: {e}")
40-
exit(1)
24+
organization = os.getenv('organization')
25+
repository_name = os.getenv('repository_name')
26+
repo_public_key = get_repository_public_key(organization=organization, repository_name=repository_name)
27+
# repo_public_key = os.environ.get("REPOSITORY_PUBLIC_KEY")
28+
# secret_value = os.environ.get("SECRET_VALUE")
29+
# public_key = "<public key here for local testing>"
30+
secret_value = "Krishnadhas"
31+
32+
if not (repo_public_key and secret_value):
33+
print("Please set REPOSITORY_PUBLIC_KEY and SECRET_VALUE environment variables.")
34+
exit(1)
35+
36+
try:
37+
encrypted_secret = encrypt(repo_public_key, secret_value)
38+
os.system(f'echo "ENCRYPTED_SECRET={encrypted_secret}" >> $GITHUB_ENV')
39+
print(f"Encrypted Secret: {encrypted_secret}")
40+
print(f"Encrypted secret added as a environment variable")
41+
return encrypted_secret
42+
except Exception as e:
43+
print(f"Error encrypting secret: {e}")
44+
exit(1)
45+
4146

4247
if __name__ == "__main__":
43-
main()
48+
main()

0 commit comments

Comments
 (0)