Skip to content

Commit 4c38b90

Browse files
pdabelf5pdabelf5
committed
Migrate GCR secrets to Azure vault
1 parent f2e172e commit 4c38b90

14 files changed

+1006
-442
lines changed

‎.github/workflows/build-base-images.yml‎

Lines changed: 60 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,31 @@ jobs:
6565
with:
6666
platforms: arm64
6767

68+
- name: Azure login
69+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
70+
with:
71+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
72+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
73+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
74+
75+
- name: Setup secrets
76+
id: secrets
77+
run: |
78+
echo "Setting secrets for job"
79+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
80+
echo "::add-mask::$GCR_WORKLOAD_ID"
81+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
82+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
83+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
84+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
85+
6886
- name: Authenticate to Google Cloud
6987
id: auth
7088
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
7189
with:
7290
token_format: access_token
73-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
74-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
91+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
92+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
7593

7694
- name: Login to GCR
7795
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
@@ -122,6 +140,24 @@ jobs:
122140
- name: Checkout Repository
123141
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
124142

143+
- name: Azure login
144+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
145+
with:
146+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
147+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
148+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
149+
150+
- name: Setup secrets
151+
id: secrets
152+
run: |
153+
echo "Setting secrets for job"
154+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
155+
echo "::add-mask::$GCR_WORKLOAD_ID"
156+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
157+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
158+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
159+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
160+
125161
- name: Docker Buildx
126162
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
127163

@@ -135,8 +171,8 @@ jobs:
135171
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
136172
with:
137173
token_format: access_token
138-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
139-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
174+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
175+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
140176

141177
- name: Login to GCR
142178
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
@@ -190,6 +226,24 @@ jobs:
190226
- name: Checkout Repository
191227
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
192228

229+
- name: Azure login
230+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
231+
with:
232+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
233+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
234+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
235+
236+
- name: Setup secrets
237+
id: secrets
238+
run: |
239+
echo "Setting secrets for job"
240+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
241+
echo "::add-mask::$GCR_WORKLOAD_ID"
242+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
243+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
244+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
245+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
246+
193247
- name: Docker Buildx
194248
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
195249

@@ -198,8 +252,8 @@ jobs:
198252
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
199253
with:
200254
token_format: access_token
201-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
202-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
255+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
256+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
203257

204258
- name: Login to GCR
205259
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0

‎.github/workflows/build-oss.yml‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,31 @@ jobs:
6161
ref: ${{ inputs.branch }}
6262
fetch-depth: 0
6363

64+
- name: Azure login
65+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
66+
with:
67+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
68+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
69+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
70+
71+
- name: Setup secrets
72+
id: secrets
73+
run: |
74+
echo "Setting secrets for job"
75+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
76+
echo "::add-mask::$GCR_WORKLOAD_ID"
77+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
78+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
79+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
80+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
81+
6482
- name: Authenticate to Google Cloud
6583
id: auth
6684
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
6785
with:
6886
token_format: access_token
69-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
70-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
87+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
88+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
7189
if: ${{ inputs.authenticated }}
7290

7391
- name: Login to GCR

‎.github/workflows/build-plus.yml‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,13 +63,34 @@ jobs:
6363
ref: ${{ inputs.branch }}
6464
fetch-depth: 0
6565

66+
- name: Azure login
67+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
68+
with:
69+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
70+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
71+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
72+
if: ${{ inputs.authenticated }}
73+
74+
- name: Setup secrets
75+
id: secrets
76+
run: |
77+
echo "Setting secrets for job"
78+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
79+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
80+
echo "::add-mask::$GCR_WORKLOAD_ID"
81+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
82+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
83+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
84+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
85+
if: ${{ inputs.authenticated }}
86+
6687
- name: Authenticate to Google Cloud
6788
id: auth
6889
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
6990
with:
7091
token_format: access_token
71-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
72-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
92+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
93+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
7394
if: ${{ inputs.authenticated }}
7495

7596
- name: Login to GCR

‎.github/workflows/build-single-image.yml‎

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,31 @@ jobs:
6464
echo "ic_version=${IC_VERSION}" >> $GITHUB_OUTPUT
6565
cat $GITHUB_OUTPUT
6666
67+
- name: Azure login
68+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
69+
with:
70+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
71+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
72+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
73+
74+
- name: Setup secrets
75+
id: secrets
76+
run: |
77+
echo "Setting secrets for job"
78+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
79+
echo "::add-mask::$GCR_WORKLOAD_ID"
80+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
81+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
82+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
83+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
84+
6785
- name: Authenticate to Google Cloud
6886
id: auth
6987
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
7088
with:
7189
token_format: access_token
72-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
73-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
90+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
91+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
7492

7593
- name: Login to GCR
7694
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
@@ -79,19 +97,6 @@ jobs:
7997
username: oauth2accesstoken
8098
password: ${{ steps.auth.outputs.access_token }}
8199

82-
- name: Setup plus credentials
83-
run: |
84-
printf '%s\n' "${CERT}" > nginx-repo.crt
85-
printf '%s\n' "${KEY}" > nginx-repo.key
86-
if [[ "${{ inputs.target }}" =~ ubi ]]; then
87-
printf '%s\n' "${RHEL}" > rhel_license
88-
fi
89-
env:
90-
CERT: ${{ secrets.NGINX_CRT }}
91-
KEY: ${{ secrets.NGINX_KEY }}
92-
RHEL: ${{ secrets.RHEL_LICENSE }}
93-
if: ${{ contains(inputs.target, 'plus') }}
94-
95100
- name: Fetch Cached Binary Artifacts
96101
id: binary-cache
97102
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0

‎.github/workflows/build-test-image.yml‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,31 @@ jobs:
3333
- name: Docker Buildx
3434
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
3535

36+
- name: Azure login
37+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
38+
with:
39+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
40+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
41+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
42+
43+
- name: Setup secrets
44+
id: secrets
45+
run: |
46+
echo "Setting secrets for job"
47+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
48+
echo "::add-mask::$GCR_WORKLOAD_ID"
49+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
50+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
51+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
52+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
53+
3654
- name: Authenticate to Google Cloud
3755
id: auth
3856
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
3957
with:
4058
token_format: access_token
41-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
42-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
59+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
60+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
4361

4462
- name: Login to GCR
4563
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0

0 commit comments

Comments
 (0)