Skip to content

Commit 6739595

Browse files
pdabelf5pdabelf5
committed
Merge branch 'dependabot/go_modules/go_modules-dd7da38a6b' of github.com:nginx/kubernetes-ingress into dependabot/go_modules/go_modules-dd7da38a6b
2 parents 6deb6dd + 7700119 commit 6739595

25 files changed

+871
-156
lines changed

‎.github/workflows/build-base-images.yml‎

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,31 @@ jobs:
6565
with:
6666
platforms: arm64
6767

68+
- name: Azure login
69+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
70+
with:
71+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
72+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
73+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
74+
75+
- name: Setup secrets
76+
id: secrets
77+
run: |
78+
echo "Setting secrets for job"
79+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
80+
echo "::add-mask::$GCR_WORKLOAD_ID"
81+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
82+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
83+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
84+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
85+
6886
- name: Authenticate to Google Cloud
6987
id: auth
7088
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
7189
with:
7290
token_format: access_token
73-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
74-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
91+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
92+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
7593

7694
- name: Login to GCR
7795
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
@@ -133,6 +151,12 @@ jobs:
133151
id: secrets
134152
run: |
135153
echo "Setting secrets for job"
154+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
155+
echo "::add-mask::$GCR_WORKLOAD_ID"
156+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
157+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
158+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
159+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
136160
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
137161
echo "::add-mask::$PLUS_CREDS"
138162
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
@@ -159,8 +183,8 @@ jobs:
159183
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
160184
with:
161185
token_format: access_token
162-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
163-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
186+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
187+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
164188

165189
- name: Login to GCR
166190
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
@@ -230,6 +254,12 @@ jobs:
230254
id: secrets
231255
run: |
232256
echo "Setting secrets for job"
257+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
258+
echo "::add-mask::$GCR_WORKLOAD_ID"
259+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
260+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
261+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
262+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
233263
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
234264
echo "::add-mask::$PLUS_CREDS"
235265
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
@@ -256,8 +286,8 @@ jobs:
256286
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
257287
with:
258288
token_format: access_token
259-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
260-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
289+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
290+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
261291

262292
- name: Login to GCR
263293
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0

‎.github/workflows/build-oss.yml‎

Lines changed: 43 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,52 @@ jobs:
6161
ref: ${{ inputs.branch }}
6262
fetch-depth: 0
6363

64+
- name: Azure login
65+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
66+
with:
67+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
68+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
69+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
70+
if: ${{ inputs.authenticated }}
71+
72+
- name: Setup secrets
73+
id: secrets
74+
run: |
75+
echo "Setting secrets for job"
76+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
77+
echo "::add-mask::$GCR_WORKLOAD_ID"
78+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
79+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
80+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
81+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
82+
83+
- name: Azure login Common Vault
84+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
85+
with:
86+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
87+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
88+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
89+
if: ${{ inputs.authenticated }}
90+
91+
- name: Setup secrets Common Vault
92+
id: secrets-common
93+
run: |
94+
echo "Setting secrets for job"
95+
DOCKER_USERNAME=$(az keyvault secret show --name docker-username --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
96+
echo "::add-mask::$DOCKER_USERNAME"
97+
echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_OUTPUT
98+
DOCKER_PASSWORD=$(az keyvault secret show --name docker-password --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
99+
echo "::add-mask::$DOCKER_PASSWORD"
100+
echo "DOCKER_PASSWORD=$DOCKER_PASSWORD" >> $GITHUB_OUTPUT
101+
if: ${{ inputs.authenticated }}
102+
64103
- name: Authenticate to Google Cloud
65104
id: auth
66105
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
67106
with:
68107
token_format: access_token
69-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
70-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
108+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
109+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
71110
if: ${{ inputs.authenticated }}
72111

73112
- name: Login to GCR
@@ -81,8 +120,8 @@ jobs:
81120
- name: DockerHub Login
82121
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
83122
with:
84-
username: ${{ secrets.DOCKER_USERNAME }}
85-
password: ${{ secrets.DOCKER_PASSWORD }}
123+
username: ${{ steps.secrets-common.outputs.DOCKER_USERNAME }}
124+
password: ${{ steps.secrets-common.outputs.DOCKER_PASSWORD }}
86125
if: ${{ inputs.authenticated }}
87126

88127
- name: Docker meta

‎.github/workflows/build-plus.yml‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,12 @@ jobs:
7575
id: secrets
7676
run: |
7777
echo "Setting secrets for job"
78+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
79+
echo "::add-mask::$GCR_WORKLOAD_ID"
80+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
81+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
82+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
83+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
7884
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
7985
echo "::add-mask::$PLUS_CREDS"
8086
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
@@ -94,13 +100,33 @@ jobs:
94100
echo $RHEL_CREDS > rhel_license
95101
if: ${{ inputs.authenticated }}
96102

103+
- name: Azure login Common Vault
104+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
105+
with:
106+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
107+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
108+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
109+
if: ${{ inputs.authenticated }}
110+
111+
- name: Setup secrets - Common Vault
112+
id: secrets-common
113+
run: |
114+
echo "Setting secrets for job"
115+
DOCKER_USERNAME=$(az keyvault secret show --name docker-username --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
116+
echo "::add-mask::$DOCKER_USERNAME"
117+
echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_OUTPUT
118+
DOCKER_PASSWORD=$(az keyvault secret show --name docker-password --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
119+
echo "::add-mask::$DOCKER_PASSWORD"
120+
echo "DOCKER_PASSWORD=$DOCKER_PASSWORD" >> $GITHUB_OUTPUT
121+
if: ${{ inputs.authenticated }}
122+
97123
- name: Authenticate to Google Cloud
98124
id: auth
99125
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
100126
with:
101127
token_format: access_token
102-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
103-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
128+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
129+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
104130
if: ${{ inputs.authenticated }}
105131

106132
- name: Login to GCR
@@ -114,8 +140,8 @@ jobs:
114140
- name: DockerHub Login
115141
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
116142
with:
117-
username: ${{ secrets.DOCKER_USERNAME }}
118-
password: ${{ secrets.DOCKER_PASSWORD }}
143+
username: ${{ steps.secrets-common.outputs.DOCKER_USERNAME }}
144+
password: ${{ steps.secrets-common.outputs.DOCKER_PASSWORD }}
119145
if: ${{ inputs.authenticated }}
120146

121147
- name: NAP modules

‎.github/workflows/build-single-image.yml‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -64,33 +64,23 @@ jobs:
6464
echo "ic_version=${IC_VERSION}" >> $GITHUB_OUTPUT
6565
cat $GITHUB_OUTPUT
6666
67-
- name: Authenticate to Google Cloud
68-
id: auth
69-
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
70-
with:
71-
token_format: access_token
72-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
73-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
74-
75-
- name: Login to GCR
76-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
77-
with:
78-
registry: gcr.io
79-
username: oauth2accesstoken
80-
password: ${{ steps.auth.outputs.access_token }}
81-
8267
- name: Azure login
8368
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
8469
with:
8570
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
8671
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
8772
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
88-
if: ${{ contains(inputs.target, 'plus') }}
8973

9074
- name: Setup secrets
9175
id: secrets
9276
run: |
9377
echo "Setting secrets for job"
78+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
79+
echo "::add-mask::$GCR_WORKLOAD_ID"
80+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
81+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
82+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
83+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
9484
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
9585
echo "::add-mask::$PLUS_CREDS"
9686
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
@@ -108,7 +98,21 @@ jobs:
10898
echo "::add-mask::${line}"
10999
done <<< "${RHEL_CREDS}"
110100
echo $RHEL_CREDS > rhel_license
111-
if: ${{ contains(inputs.target, 'plus') }}
101+
102+
- name: Authenticate to Google Cloud
103+
id: auth
104+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
105+
with:
106+
token_format: access_token
107+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
108+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
109+
110+
- name: Login to GCR
111+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
112+
with:
113+
registry: gcr.io
114+
username: oauth2accesstoken
115+
password: ${{ steps.auth.outputs.access_token }}
112116

113117
- name: Fetch Cached Binary Artifacts
114118
id: binary-cache

‎.github/workflows/build-test-image.yml‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,31 @@ jobs:
3333
- name: Docker Buildx
3434
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
3535

36+
- name: Azure login
37+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
38+
with:
39+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
40+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
41+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
42+
43+
- name: Setup secrets
44+
id: secrets
45+
run: |
46+
echo "Setting secrets for job"
47+
GCR_WORKLOAD_ID=$(az keyvault secret show --name gcr-workload-identity --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
48+
echo "::add-mask::$GCR_WORKLOAD_ID"
49+
echo "GCR_WORKLOAD_ID=$GCR_WORKLOAD_ID" >> $GITHUB_OUTPUT
50+
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
51+
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
52+
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
53+
3654
- name: Authenticate to Google Cloud
3755
id: auth
3856
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
3957
with:
4058
token_format: access_token
41-
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
42-
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
59+
workload_identity_provider: ${{ steps.secrets.outputs.GCR_WORKLOAD_ID }}
60+
service_account: ${{ steps.secrets.outputs.GCR_SERVICE_ACCOUNT }}
4361

4462
- name: Login to GCR
4563
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0

‎.github/workflows/cherry-pick.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ jobs:
1313
permissions:
1414
contents: write
1515
pull-requests: write
16+
id-token: write
1617
runs-on: ubuntu-24.04
1718
name: Cherry pick into release branch
1819
if: ${{ contains(github.event.pull_request.labels.*.name, 'needs cherry pick') && github.event.pull_request.merged == true }}
@@ -31,10 +32,25 @@ jobs:
3132
echo "branch=${release_branch}" >> $GITHUB_OUTPUT
3233
cat $GITHUB_OUTPUT
3334
35+
- name: Azure login
36+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
37+
with:
38+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
39+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
40+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
41+
42+
- name: Setup secrets
43+
id: secrets
44+
run: |
45+
echo "Setting secrets for job"
46+
NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
47+
echo "::add-mask::$NGINX_PAT"
48+
echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
49+
3450
- name: Cherry pick into ${{ steps.branch.outputs.branch }}
3551
uses: carloscastrojumo/github-cherry-pick-action@503773289f4a459069c832dc628826685b75b4b3 # v1.0.10
3652
with:
3753
branch: ${{ steps.branch.outputs.branch }}
38-
token: ${{ secrets.NGINX_PAT }}
54+
token: ${{ steps.secrets.outputs.NGINX_PAT }}
3955
author: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>
4056
title: "[cherry-pick] {old_title}"

0 commit comments

Comments
 (0)