Skip to content

Commit 8f3e1bf

Browse files
pdabelf5pdabelf5
committed
Migrate nginx pat to Azure Vault
1 parent b9b71df commit 8f3e1bf

File tree

7 files changed

+146
-10
lines changed

7 files changed

+146
-10
lines changed

‎.github/workflows/cherry-pick.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ jobs:
1313
permissions:
1414
contents: write
1515
pull-requests: write
16+
id-token: write
1617
runs-on: ubuntu-24.04
1718
name: Cherry pick into release branch
1819
if: ${{ contains(github.event.pull_request.labels.*.name, 'needs cherry pick') && github.event.pull_request.merged == true }}
@@ -31,10 +32,25 @@ jobs:
3132
echo "branch=${release_branch}" >> $GITHUB_OUTPUT
3233
cat $GITHUB_OUTPUT
3334
35+
- name: Azure login
36+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
37+
with:
38+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
39+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
40+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
41+
42+
- name: Setup secrets
43+
id: secrets
44+
run: |
45+
echo "Setting secrets for job"
46+
NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
47+
echo "::add-mask::$NGINX_PAT"
48+
echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
49+
3450
- name: Cherry pick into ${{ steps.branch.outputs.branch }}
3551
uses: carloscastrojumo/github-cherry-pick-action@503773289f4a459069c832dc628826685b75b4b3 # v1.0.10
3652
with:
3753
branch: ${{ steps.branch.outputs.branch }}
38-
token: ${{ secrets.NGINX_PAT }}
54+
token: ${{ steps.secrets.outputs.NGINX_PAT }}
3955
author: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>
4056
title: "[cherry-pick] {old_title}"

‎.github/workflows/create-release-branch.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,28 @@ jobs:
3636
runs-on: ubuntu-latest
3737
permissions:
3838
contents: write
39+
id-token: write
3940
steps:
4041
- name: Checkout NIC repo
4142
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
4243
with:
4344
ref: ${{ inputs.source_branch }}
4445

46+
- name: Azure login
47+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
48+
with:
49+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
50+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
51+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
52+
53+
- name: Setup secrets
54+
id: secrets
55+
run: |
56+
echo "Setting secrets for job"
57+
NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
58+
echo "::add-mask::$NGINX_PAT"
59+
echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
60+
4561
- name: Create new release branch
4662
run: |
4763
branch="${{ inputs.branch_prefix }}${{ inputs.release_version }}"
@@ -66,4 +82,4 @@ jobs:
6682
git push --dry-run origin "${branch}"
6783
fi
6884
env:
69-
GITHUB_TOKEN: ${{ secrets.NGINX_PAT }}
85+
GITHUB_TOKEN: ${{ steps.secrets.outputs.NGINX_PAT }}

‎.github/workflows/publish-helm.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ jobs:
8989
DOCKER_PASSWORD=$(az keyvault secret show --name docker-password --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
9090
echo "::add-mask::$DOCKER_PASSWORD"
9191
echo "DOCKER_PASSWORD=$DOCKER_PASSWORD" >> $GITHUB_OUTPUT
92+
NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
93+
echo "::add-mask::$NGINX_PAT"
94+
echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
9295
9396
- name: Login to GitHub Container Registry
9497
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
@@ -125,7 +128,7 @@ jobs:
125128
with:
126129
repository: nginxinc/helm-charts
127130
fetch-depth: 1
128-
token: ${{ secrets.NGINX_PAT }}
131+
token: ${{ steps.secrets.outputs.NGINX_PAT }}
129132
path: helm-charts
130133
if: ${{ inputs.nginx_helm_repo }}
131134

‎.github/workflows/release-pr.yml‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ jobs:
5757
permissions:
5858
contents: write
5959
pull-requests: write
60+
id-token: write
6061
runs-on: ubuntu-24.04
6162
steps:
6263
- name: Branch
@@ -72,6 +73,21 @@ jobs:
7273
ref: ${{ steps.branch.outputs.branch }}
7374
token: ${{ secrets.GITHUB_TOKEN }}
7475

76+
- name: Azure login
77+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
78+
with:
79+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
80+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
81+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
82+
83+
- name: Setup secrets
84+
id: secrets
85+
run: |
86+
echo "Setting secrets for job"
87+
NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
88+
echo "::add-mask::$NGINX_PAT"
89+
echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
90+
7591
- name: Replace
7692
run: |
7793
.github/scripts/release-version-update.sh \
@@ -91,14 +107,14 @@ jobs:
91107
env:
92108
GITHUB_USERNAME: ${{ github.actor }}
93109
GITHUB_EMAIL: ${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com
94-
GITHUB_TOKEN: ${{ secrets.NGINX_PAT }}
110+
GITHUB_TOKEN: ${{ steps.secrets.outputs.NGINX_PAT }}
95111
DRY_RUN: ${{ inputs.dry_run && 'true' || 'false' }}
96112
DEBUG: ${{ inputs.debug && 'true' || 'false' }}
97113

98114
- name: Create Pull Request
99115
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
100116
with:
101-
token: ${{ secrets.NGINX_PAT }}
117+
token: ${{ steps.secrets.outputs.NGINX_PAT }}
102118
commit-message: Release ${{ github.event.inputs.new_version }}
103119
title: Release ${{ github.event.inputs.new_version }}
104120
branch: docs/release-${{ github.event.inputs.new_version }}

‎.github/workflows/release.yml‎

Lines changed: 56 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -345,11 +345,29 @@ jobs:
345345
name: Trigger PR for Operator
346346
runs-on: ubuntu-24.04
347347
needs: [variables,publish-helm-chart]
348+
permissions:
349+
contents: read
350+
id-token: write
348351
steps:
352+
- name: Azure login
353+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
354+
with:
355+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
356+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
357+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
358+
359+
- name: Setup secrets
360+
id: secrets
361+
run: |
362+
echo "Setting secrets for job"
363+
NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
364+
echo "::add-mask::$NGINX_PAT"
365+
echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
366+
349367
- name:
350368
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
351369
with:
352-
github-token: ${{ secrets.NGINX_PAT }}
370+
github-token: ${{ steps.secrets.outputs.NGINX_PAT }}
353371
script: |
354372
await github.rest.actions.createWorkflowDispatch({
355373
owner: context.repo.owner,
@@ -370,11 +388,29 @@ jobs:
370388
# name: Trigger PR for GCP Marketplace
371389
# runs-on: ubuntu-24.04
372390
# needs: [publish-helm-chart,release-plus-gcr-mktpl]
391+
# permissions:
392+
# contents: read
393+
# id-token: write
373394
# steps:
395+
# - name: Azure login
396+
# uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
397+
# with:
398+
# client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
399+
# tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
400+
# subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
401+
402+
# - name: Setup secrets
403+
# id: secrets
404+
# run: |
405+
# echo "Setting secrets for job"
406+
# NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
407+
# echo "::add-mask::$NGINX_PAT"
408+
# echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
409+
374410
# - name:
375411
# uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
376412
# with:
377-
# github-token: ${{ secrets.NGINX_PAT }}
413+
# github-token: ${{ steps.secrets.outputs.NGINX_PAT }}
378414
# script: |
379415
# await github.rest.actions.createWorkflowDispatch({
380416
# owner: context.repo.owner,
@@ -391,12 +427,29 @@ jobs:
391427
# if: ${{ ! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'azure-marketplace') }}
392428
# name: Trigger CNAB Build for Azure Marketplace
393429
# runs-on: ubuntu-24.04
430+
# permissions:
431+
# contents: read
432+
# id-token: write
394433
# needs: [publish-helm-chart,release-plus-azure-mktpl]
395434
# steps:
435+
# - name: Azure login
436+
# uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
437+
# with:
438+
# client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
439+
# tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
440+
# subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
441+
442+
# - name: Setup secrets
443+
# id: secrets
444+
# run: |
445+
# echo "Setting secrets for job"
446+
# NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
447+
# echo "::add-mask::$NGINX_PAT"
448+
# echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
396449
# - name:
397450
# uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
398451
# with:
399-
# github-token: ${{ secrets.NGINX_PAT }}
452+
# github-token: ${{ steps.secrets.outputs.NGINX_PAT }}
400453
# script: |
401454
# await github.rest.actions.createWorkflowDispatch({
402455
# owner: context.repo.owner,

‎.github/workflows/update-docker-sha.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ jobs:
4545
permissions:
4646
contents: write
4747
pull-requests: write
48+
id-token: write
4849
runs-on: ubuntu-24.04
4950
needs: [vars]
5051
steps:
@@ -74,11 +75,26 @@ jobs:
7475
echo "docker_md5=${docker_md5:0:8}" >> $GITHUB_OUTPUT
7576
echo $GITHUB_OUTPUT
7677
78+
- name: Azure login
79+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
80+
with:
81+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
82+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
83+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
84+
85+
- name: Setup secrets
86+
id: secrets
87+
run: |
88+
echo "Setting secrets for job"
89+
NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
90+
echo "::add-mask::$NGINX_PAT"
91+
echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
92+
7793
- name: Create Pull Request
7894
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
7995
id: pr
8096
with:
81-
token: ${{ secrets.NGINX_PAT }}
97+
token: ${{ steps.secrets.outputs.NGINX_PAT }}
8298
commit-message: Update docker images ${{ steps.update_images.outputs.docker_md5 }}
8399
title: Docker image update ${{ steps.update_images.outputs.docker_md5 }}
84100
branch: deps/image-update-${{ needs.vars.outputs.source_branch }}-${{ steps.update_images.outputs.docker_md5 }}

‎.github/workflows/version-bump.yml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ jobs:
2828
permissions:
2929
contents: write
3030
pull-requests: write
31+
id-token: write
3132
runs-on: ubuntu-24.04
3233
steps:
3334
- name: Checkout Repository
@@ -52,10 +53,25 @@ jobs:
5253
run: |
5354
make test-update-snaps
5455
56+
- name: Azure login
57+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
58+
with:
59+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
60+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
61+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
62+
63+
- name: Setup secrets
64+
id: secrets
65+
run: |
66+
echo "Setting secrets for job"
67+
NGINX_PAT=$(az keyvault secret show --name nginx-bot-pat --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
68+
echo "::add-mask::$NGINX_PAT"
69+
echo "NGINX_PAT=$NGINX_PAT" >> $GITHUB_OUTPUT
70+
5571
- name: Create Pull Request
5672
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
5773
with:
58-
token: ${{ secrets.NGINX_PAT }}
74+
token: ${{ steps.secrets.outputs.NGINX_PAT }}
5975
commit-message: Version Bump for ${{ github.event.inputs.ic_version }}
6076
title: Version Bump for ${{ github.event.inputs.ic_version }}
6177
branch: chore/version-bump-${{ github.event.inputs.ic_version }}

0 commit comments

Comments
 (0)