8
8
9
9
set -eo pipefail
10
10
11
- echo " --- Prepare vault context :vault:"
12
- VAULT_ROLE_ID_SECRET=$( vault read -field=role-id secret/ci/elastic-ecs-logging-java/internal-ci-approle)
13
- export VAULT_ROLE_ID_SECRET
14
-
15
- VAULT_SECRET_ID_SECRET=$( vault read -field=secret-id secret/ci/elastic-ecs-logging-java/internal-ci-approle)
16
- export VAULT_SECRET_ID_SECRET
17
-
18
- VAULT_ADDR=$( vault read -field=vault-url secret/ci/elastic-ecs-logging-java/internal-ci-approle)
19
- export VAULT_ADDR
20
-
21
- # Delete the vault specific accessing the ci vault
22
- PREVIOUS_VAULT_TOKEN=$VAULT_TOKEN
23
- export PREVIOUS_VAULT_TOKEN
24
- unset VAULT_TOKEN
25
-
26
11
echo " --- Prepare a secure temp :closed_lock_with_key:"
27
12
# Prepare a secure temp folder not shared between other jobs to store the key ring
28
13
export TMP_WORKSPACE=/tmp/secured
@@ -34,20 +19,22 @@ mkdir -p $GNUPGHOME
34
19
chmod -R 700 $TMP_WORKSPACE
35
20
36
21
echo " --- Prepare keys context :key:"
37
- VAULT_TOKEN=$( vault write -field=token auth/approle/login role_id=" $VAULT_ROLE_ID_SECRET " secret_id=" $VAULT_SECRET_ID_SECRET " )
38
- export VAULT_TOKEN
39
-
40
22
# Nexus credentials
41
- SERVER_USERNAME=$( vault read -field username secret/release/nexus)
23
+ NEXUS_SECRET=kv/ci-shared/release-eng/team-release-secrets/ecs-logging/maven_central
24
+ SERVER_USERNAME=$( vault kv get --field=" username" $NEXUS_SECRET )
42
25
export SERVER_USERNAME
43
- SERVER_PASSWORD=$( vault read - field password secret/release/nexus )
26
+ SERVER_PASSWORD=$( vault kv get -- field= " password" $NEXUS_SECRET )
44
27
export SERVER_PASSWORD
45
28
46
29
# Signing keys
47
- vault read -field=key secret/release/signing > $KEY_FILE
48
- KEYPASS_SECRET=$( vault read -field=passphrase secret/release/signing)
30
+ GPG_SECRET=kv/ci-shared/release-eng/team-release-secrets/ecs-logging/gpg
31
+ vault kv get --field=" keyring" $GPG_SECRET | base64 -d > $KEY_FILE
32
+ # # NOTE: This is not a typo. "passphase" is the name of the field.
33
+ KEYPASS_SECRET=$( vault kv get --field=" passphase" $GPG_SECRET )
49
34
export KEYPASS_SECRET
50
- export KEY_ID_SECRET=D88E42B4
35
+ KEY_ID=$( vault kv get --field=" key_id" $GPG_SECRET )
36
+ KEY_ID_SECRET=${KEY_ID: -8}
37
+ export KEY_ID_SECRET
51
38
52
39
# Import the key into the keyring
53
40
echo " $KEYPASS_SECRET " | gpg --batch --import " $KEY_FILE "
0 commit comments