Merge pull request #130 from chmeliik/azure-vars

Add script for setting Azure secrets

Author: lcarva

.env.template

@@ -54,3 +54,16 @@ export jenkins_enabled=false
 export JENKINS_API_TOKEN=
 export JENKINS_URL=
 export JENKINS_USERNAME=
+
+#### Azure
+# A Personal Access Token with the following permissions:
+#   Variable Groups (Read, create, & manage)
+export AZURE_DEVOPS_EXT_PAT=
+# If you have access to https://dev.azure.com/rhtap-test, feel free to use it
+export AZURE_ORGANIZATION=rhtap-test
+# https://dev.azure.com/rhtap-test/shared-public has unlimited parallel jobs on self-hosted agents.
+# If the self-hosted agents are down, you can try 'shared-private' and use a microsoft-hosted agent.
+export AZURE_PROJECT=shared-public
+# Your RHTAP variables within the project specified above. Keep this unique enough to avoid clashing
+# with other users of the same project.
+export AZURE_VARIABLE_GROUP_NAME=${USER}-variables

hack/_azure-set-vars.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+set -o errexit -o pipefail
+
+: "${AZURE_DEVOPS_EXT_PAT:?}"
+: "${AZURE_VARIABLE_GROUP_NAME:?}"
+: "${AZURE_ORGANIZATION:?}"
+: "${AZURE_PROJECT:?}"
+
+# Set xtrace after checking variables to avoid logging the PAT
+set -o xtrace
+
+# Needed for Azure Pipelines related functionality
+az extension add --name azure-devops
+
+az devops configure --defaults \
+    organization="https://dev.azure.com/$AZURE_ORGANIZATION" \
+    project="$AZURE_PROJECT"
+
+get_or_create_vargroup() {
+    local group_name=$1
+
+    local group_id
+    group_id=$(
+        az pipelines variable-group list --group-name "$group_name" --query '[0].id'
+    )
+
+    if [[ -z $group_id ]]; then
+        group_id=$(
+            az pipelines variable-group create \
+                --name "$group_name" \
+                --variables unused="need at least one variable in group" \
+                --authorize true \
+                --query id
+        )
+    fi
+
+    echo "$group_id"
+}
+
+VARGROUP_ID=$(get_or_create_vargroup "$AZURE_VARIABLE_GROUP_NAME")
+if [[ -z $VARGROUP_ID ]]; then
+    echo "Variable group creation sometimes fails despite succeeding, trying again..." >&2
+    VARGROUP_ID=$(get_or_create_vargroup "$AZURE_VARIABLE_GROUP_NAME")
+fi
+
+set_var() {
+    local name=$1
+    local value=$2
+    local secret=${3:-true}
+
+    if [[ -z "$value" ]]; then
+        # Can't set empty values via the az CLI :/
+        value=none
+    fi
+
+    local args=(--group-id "${VARGROUP_ID:?}" --name "$name" --value "$value" --secret "$secret")
+
+    if ! az pipelines variable-group variable update "${args[@]}"; then
+        echo "Creating a new variable..." >&2
+        az pipelines variable-group variable create "${args[@]}"
+    fi
+}
+
+# Don't log secrets
+set +o xtrace
+
+set_var ROX_CENTRAL_ENDPOINT "$ROX_CENTRAL_ENDPOINT" false
+set_var ROX_API_TOKEN "$ROX_API_TOKEN"
+
+set_var GITOPS_AUTH_PASSWORD "$GITOPS_AUTH_PASSWORD"
+
+set_var QUAY_IO_CREDS_USR "$QUAY_IO_CREDS_USR" false
+set_var QUAY_IO_CREDS_PSW "$QUAY_IO_CREDS_PSW"
+
+set_var COSIGN_SECRET_PASSWORD "$COSIGN_SECRET_PASSWORD"
+set_var COSIGN_SECRET_KEY "$COSIGN_SECRET_KEY"
+set_var COSIGN_PUBLIC_KEY "$COSIGN_PUBLIC_KEY" false
+
+set_var TRUSTIFICATION_BOMBASTIC_API_URL "$TRUSTIFICATION_BOMBASTIC_API_URL" false
+set_var TRUSTIFICATION_OIDC_ISSUER_URL "$TRUSTIFICATION_OIDC_ISSUER_URL" false
+set_var TRUSTIFICATION_OIDC_CLIENT_ID "$TRUSTIFICATION_OIDC_CLIENT_ID" false
+set_var TRUSTIFICATION_OIDC_CLIENT_SECRET "$TRUSTIFICATION_OIDC_CLIENT_SECRET"
+set_var TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "$TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION" false

hack/azure-set-vars.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -o errexit -o nounset -o pipefail
+
+SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
+
+# Find available versions with
+# curl https://mcr.microsoft.com/v2/azure-cli/tags/list | jq -r '.tags[]' | sort --version-sort
+: "${AZURE_CLI_IMAGE=mcr.microsoft.com/azure-cli:2.69.0}"
+
+podman_extra_args=("$@")
+
+# Mount volumes with SELinux label if necessary
+if command -v getenforce > /dev/null && [[ "$(getenforce)" == Enforcing ]]; then
+    z=":z"
+else
+    z=""
+fi
+
+podman run --rm -ti \
+    --env 'AZURE_*' \
+    --env 'ROX_*' \
+    --env 'GITOPS_*' \
+    --env 'QUAY_*' \
+    --env 'COSIGN_*' \
+    --env 'TRUSTIFICATION_*' \
+    -v "$SCRIPTDIR/_azure-set-vars.sh:/tmp/_azure-set-vars.sh$z" \
+    "${podman_extra_args[@]}" \
+    "$AZURE_CLI_IMAGE" \
+    bash /tmp/_azure-set-vars.sh