Skip to content

Commit b9b71df

Browse files
pdabelf5pdabelf5
committed
Migrate docker credentials to Azure Vault
1 parent 88bbd54 commit b9b71df

File tree

6 files changed

+533
-381
lines changed

6 files changed

+533
-381
lines changed

‎.github/workflows/build-oss.yml‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,26 @@ jobs:
6161
ref: ${{ inputs.branch }}
6262
fetch-depth: 0
6363

64+
- name: Azure login
65+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
66+
with:
67+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
68+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
69+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
70+
if: ${{ inputs.authenticated }}
71+
72+
- name: Setup secrets
73+
id: secrets
74+
run: |
75+
echo "Setting secrets for job"
76+
DOCKER_USERNAME=$(az keyvault secret show --name docker-username --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
77+
echo "::add-mask::$DOCKER_USERNAME"
78+
echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_OUTPUT
79+
DOCKER_PASSWORD=$(az keyvault secret show --name docker-password --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
80+
echo "::add-mask::$DOCKER_PASSWORD"
81+
echo "DOCKER_PASSWORD=$DOCKER_PASSWORD" >> $GITHUB_OUTPUT
82+
if: ${{ inputs.authenticated }}
83+
6484
- name: Authenticate to Google Cloud
6585
id: auth
6686
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
@@ -81,8 +101,8 @@ jobs:
81101
- name: DockerHub Login
82102
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
83103
with:
84-
username: ${{ secrets.DOCKER_USERNAME }}
85-
password: ${{ secrets.DOCKER_PASSWORD }}
104+
username: ${{ steps.secrets.outputs.DOCKER_USERNAME }}
105+
password: ${{ steps.secrets.outputs.DOCKER_PASSWORD }}
86106
if: ${{ inputs.authenticated }}
87107

88108
- name: Docker meta

‎.github/workflows/build-plus.yml‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,26 @@ jobs:
6363
ref: ${{ inputs.branch }}
6464
fetch-depth: 0
6565

66+
- name: Azure login
67+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
68+
with:
69+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
70+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
71+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
72+
if: ${{ inputs.authenticated }}
73+
74+
- name: Setup secrets
75+
id: secrets
76+
run: |
77+
echo "Setting secrets for job"
78+
DOCKER_USERNAME=$(az keyvault secret show --name docker-username --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
79+
echo "::add-mask::$DOCKER_USERNAME"
80+
echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_OUTPUT
81+
DOCKER_PASSWORD=$(az keyvault secret show --name docker-password --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
82+
echo "::add-mask::$DOCKER_PASSWORD"
83+
echo "DOCKER_PASSWORD=$DOCKER_PASSWORD" >> $GITHUB_OUTPUT
84+
if: ${{ inputs.authenticated }}
85+
6686
- name: Authenticate to Google Cloud
6787
id: auth
6888
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
@@ -83,8 +103,8 @@ jobs:
83103
- name: DockerHub Login
84104
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
85105
with:
86-
username: ${{ secrets.DOCKER_USERNAME }}
87-
password: ${{ secrets.DOCKER_PASSWORD }}
106+
username: ${{ steps.secrets.outputs.DOCKER_USERNAME }}
107+
password: ${{ steps.secrets.outputs.DOCKER_PASSWORD }}
88108
if: ${{ inputs.authenticated }}
89109

90110
- name: NAP modules

‎.github/workflows/dockerhub-description.yml‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ permissions:
1717
jobs:
1818
dockerHubDescription:
1919
runs-on: ubuntu-24.04
20+
permissions:
21+
contents: read
22+
id-token: write
2023
if: ${{ github.event.repository.fork == false }}
2124
steps:
2225
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -25,10 +28,28 @@ jobs:
2528
run: |
2629
sed -i '3,4d' README.md
2730
31+
- name: Azure login
32+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
33+
with:
34+
client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
35+
tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
36+
subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}
37+
38+
- name: Setup secrets
39+
id: secrets
40+
run: |
41+
echo "Setting secrets for job"
42+
DOCKER_USERNAME=$(az keyvault secret show --name docker-username --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
43+
echo "::add-mask::$DOCKER_USERNAME"
44+
echo "DOCKER_USERNAME=$DOCKER_USERNAME" >> $GITHUB_OUTPUT
45+
DOCKER_PASSWORD=$(az keyvault secret show --name docker-password --vault-name ${{ secrets.COMMON_KEYVAULT_NAME }} --query value -o tsv)
46+
echo "::add-mask::$DOCKER_PASSWORD"
47+
echo "DOCKER_PASSWORD=$DOCKER_PASSWORD" >> $GITHUB_OUTPUT
48+
2849
- name: Docker Hub Description
2950
uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
3051
with:
31-
username: ${{ secrets.DOCKER_USERNAME }}
32-
password: ${{ secrets.DOCKER_PASSWORD }}
52+
username: ${{ steps.secrets.outputs.DOCKER_USERNAME }}
53+
password: ${{ steps.secrets.outputs.DOCKER_PASSWORD }}
3354
repository: nginx/nginx-ingress
3455
short-description: ${{ github.event.repository.description }}

0 commit comments

Comments
 (0)