Skip to content

Commit 0fb6d4f

Browse files
lcarvalcarva
committed
Use curl instead of jenkins-cli
This change removes the need to execute the embedded jenkins-cli JAR in this repo. Instead, Jenkins' REST API is used via curl to create and retrieve secrets from a Jenkins server. Signed-off-by: Luiz Carvalho <[email protected]>
1 parent bdcfee6 commit 0fb6d4f

File tree

6 files changed

+83
-70
lines changed

6 files changed

+83
-70
lines changed

‎hack/jenkins-cli.jar

-3.47 MB
Binary file not shown.

‎hack/jenkins-create-secret

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,28 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
24
SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
35

46
SECRET_NAME=$1
57
SECRET_VALUE=$2
68

7-
CREDS=$(mktemp)
8-
cat << CREDS > $CREDS
9-
<org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl plugin="[email protected]_de8f1dd5a_2b_">
10-
<scope>GLOBAL</scope>
11-
<id>$SECRET_NAME</id>
12-
<description></description>
13-
<secret>$SECRET_VALUE</secret>
14-
</org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl>
15-
CREDS
9+
CREDS=$(
10+
cat << EOF
11+
{
12+
"": "0",
13+
"credentials": {
14+
"scope": "GLOBAL",
15+
"id": "${SECRET_NAME}",
16+
"secret": "${SECRET_VALUE}",
17+
"description": "",
18+
"\$class": "org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl"
19+
}
20+
}
21+
EOF
22+
)
1623

17-
#cat $CREDS
1824
echo "Creating Jenkins credential $SECRET_NAME"
19-
java -jar $SCRIPTDIR/jenkins-cli.jar -s $MY_JENKINS_SERVER \
20-
-auth $MY_JENKINS_USER:$MY_JENKINS_TOKEN \
21-
delete-credentials system::system::jenkins _ $SECRET_NAME
22-
java -jar $SCRIPTDIR/jenkins-cli.jar -s $MY_JENKINS_SERVER \
23-
-auth $MY_JENKINS_USER:$MY_JENKINS_TOKEN \
24-
create-credentials-by-xml system::system::jenkins _ \
25-
< $CREDS
25+
26+
curl "${MY_JENKINS_SERVER}/credentials/store/system/domain/_/createCredentials" \
27+
--user "${MY_JENKINS_USER}:${MY_JENKINS_TOKEN}" \
28+
--data-urlencode "json=${CREDS}"

‎hack/jenkins-create-user-password

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,30 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
24
SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
35

46
SECRET_NAME=$1
57
USER_NAME=$2
68
USER_PW=$3
79

8-
CREDS=$(mktemp)
9-
cat << CREDS > $CREDS
10-
<com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl plugin="[email protected]_3f65a_1e173">
11-
<scope>GLOBAL</scope>
12-
<id>$SECRET_NAME</id>
13-
<description></description>
14-
<username>$USER_NAME</username>
15-
<password>$USER_PW</password>
16-
<usernameSecret>false</usernameSecret>
17-
</com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl>
18-
CREDS
10+
CREDS=$(
11+
cat << EOF
12+
{
13+
"": "0",
14+
"credentials": {
15+
"scope": "GLOBAL",
16+
"id": "${SECRET_NAME}",
17+
"username": "${USER_NAME}",
18+
"password": "${USER_PW}",
19+
"description": "",
20+
"\$class": "com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl"
21+
}
22+
}
23+
EOF
24+
)
1925

20-
#cat $CREDS
2126
echo "Creating Jenkins credential $SECRET_NAME"
2227

23-
java -jar $SCRIPTDIR/jenkins-cli.jar -http -s $MY_JENKINS_SERVER \
24-
-auth $MY_JENKINS_USER:$MY_JENKINS_TOKEN \
25-
create-credentials-by-xml system::system::jenkins _ \
26-
< $CREDS
28+
curl "${MY_JENKINS_SERVER}/credentials/store/system/domain/_/createCredentials" \
29+
--user "${MY_JENKINS_USER}:${MY_JENKINS_TOKEN}" \
30+
--data-urlencode "json=${CREDS}"

‎hack/jenkins-get-credentials

Lines changed: 13 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,21 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
24
SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
35

46
SECRET_NAME=$1
5-
CREDS=$(mktemp)
6-
java -jar $SCRIPTDIR/jenkins-cli.jar -http -s $MY_JENKINS_SERVER \
7-
-auth $MY_JENKINS_USER:$MY_JENKINS_TOKEN \
8-
get-credentials-as-xml system::system::jenkins _ $SECRET_NAME \
9-
> $CREDS
107

11-
ERR=$?
12-
if [ $ERR != 0 ]; then
13-
echo "No credentials named $SECRET_NAME"
14-
exit $ERR
15-
fi
8+
SECRET_INFO="$(curl -s \
9+
"${MY_JENKINS_SERVER}/credentials/store/system/domain/_/credential/${SECRET_NAME}/api/json" \
10+
--user "${MY_JENKINS_USER}:${MY_JENKINS_TOKEN}")"
11+
12+
TYPE_NAME="$(echo "${SECRET_INFO}" | jq -r '.typeName')"
1613

17-
ID=$(cat $CREDS | sed -ne '/<id>/s#\s*<[^>]*>\s*##gp')
18-
if [ $(grep -ic "<secret>" $CREDS) -eq 1 ]; then
19-
TEMP=$(cat $CREDS | tr -d '\n' | tr -d ' ')
20-
one=${TEMP#*<secret>}
21-
SECRET=${one%</secret>*}
22-
echo "$ID with secret $SECRET"
14+
if [[ "$TYPE_NAME" =~ ^(S|s)ecret ]]; then
15+
echo "${SECRET_NAME} with secret <redacted>"
16+
elif [[ "$TYPE_NAME" =~ ^(U|u)sername ]]; then
17+
username="$(echo "${SECRET_INFO}" | jq -r '.displayName | split("/")[0]')"
18+
echo "${SECRET_NAME} with user ${username} and password <redacted>"
2319
else
24-
TEMP=$(cat $CREDS | tr -d '\n' | tr -d ' ')
25-
one=${TEMP#*<username>}
26-
USER=${one%</username>*}
27-
TEMP=$(cat $CREDS | tr -d '\n' | tr -d ' ')
28-
one=${TEMP#*<password>}
29-
PW=${one%</password>*}
30-
echo "$ID with user <$USER> and password $PW"
20+
echo "${SECRET_NAME} with unknown type name: ${TYPE_NAME}"
3121
fi

‎hack/jenkins-get-secrets

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
24
SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
35

4-
source $SCRIPTDIR/../rhtap/verify-deps-exist "MY_JENKINS_SERVER MY_JENKINS_USER MY_JENKINS_TOKEN" "java tr grep"
6+
source $SCRIPTDIR/../rhtap/verify-deps-exist "MY_JENKINS_SERVER MY_JENKINS_USER MY_JENKINS_TOKEN" "curl jq"
57

68
bash $SCRIPTDIR/jenkins-get-credentials ROX_API_TOKEN
79
bash $SCRIPTDIR/jenkins-get-credentials ROX_CENTRAL_ENDPOINT

‎hack/jenkins-set-secrets

Lines changed: 27 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,35 @@
11
#!/bin/bash
2+
set -euo pipefail
3+
24
SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
35

46
ENV="MY_JENKINS_SERVER MY_JENKINS_USER MY_JENKINS_TOKEN COSIGN_SECRET_PASSWORD COSIGN_SECRET_KEY COSIGN_PUBLIC_KEY "
57

68
ENV+=" ACS__API_TOKEN ACS__CENTRAL_ENDPOINT GITOPS_AUTH_PASSWORD "
7-
source $SCRIPTDIR/../rhtap/verify-deps-exist "$ENV" "java "
9+
source $SCRIPTDIR/../rhtap/verify-deps-exist "$ENV" "curl"
810

9-
bash $SCRIPTDIR/jenkins-create-secret ROX_API_TOKEN $ACS__API_TOKEN
10-
bash $SCRIPTDIR/jenkins-create-secret ROX_CENTRAL_ENDPOINT $ACS__CENTRAL_ENDPOINT
11-
bash $SCRIPTDIR/jenkins-create-secret GITOPS_AUTH_PASSWORD $GITOPS_AUTH_PASSWORD
12-
bash $SCRIPTDIR/jenkins-create-secret COSIGN_SECRET_PASSWORD $COSIGN_SECRET_PASSWORD
13-
bash $SCRIPTDIR/jenkins-create-secret COSIGN_SECRET_KEY $COSIGN_SECRET_KEY
14-
bash $SCRIPTDIR/jenkins-create-secret COSIGN_PUBLIC_KEY $COSIGN_PUBLIC_KEY
15-
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_BOMBASTIC_API_URL "$TRUSTIFICATION_BOMBASTIC_API_URL"
16-
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_OIDC_ISSUER_URL "$TRUSTIFICATION_OIDC_ISSUER_URL"
17-
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_OIDC_CLIENT_ID "$TRUSTIFICATION_OIDC_CLIENT_ID"
18-
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_OIDC_CLIENT_SECRET "$TRUSTIFICATION_OIDC_CLIENT_SECRET"
19-
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "$TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION"
11+
bash $SCRIPTDIR/jenkins-create-secret ROX_API_TOKEN "${ACS__API_TOKEN}"
12+
bash $SCRIPTDIR/jenkins-create-secret ROX_CENTRAL_ENDPOINT "${ACS__CENTRAL_ENDPOINT}"
13+
bash $SCRIPTDIR/jenkins-create-secret GITOPS_AUTH_PASSWORD "${GITOPS_AUTH_PASSWORD}"
14+
bash $SCRIPTDIR/jenkins-create-secret COSIGN_SECRET_PASSWORD "${COSIGN_SECRET_PASSWORD}"
15+
bash $SCRIPTDIR/jenkins-create-secret COSIGN_SECRET_KEY "${COSIGN_SECRET_KEY}"
16+
bash $SCRIPTDIR/jenkins-create-secret COSIGN_PUBLIC_KEY "${COSIGN_PUBLIC_KEY}"
17+
if [[ -n "${TRUSTIFICATION_BOMBASTIC_API_URL:-}" ]]; then
18+
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_BOMBASTIC_API_URL "${TRUSTIFICATION_BOMBASTIC_API_URL}"
19+
fi
20+
if [[ -n "${TRUSTIFICATION_OIDC_ISSUER_URL:-}" ]]; then
21+
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_OIDC_ISSUER_URL "${TRUSTIFICATION_OIDC_ISSUER_URL}"
22+
fi
23+
if [[ -n "${TRUSTIFICATION_OIDC_CLIENT_ID:-}" ]]; then
24+
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_OIDC_CLIENT_ID "${TRUSTIFICATION_OIDC_CLIENT_ID}"
25+
fi
26+
if [[ -n "${TRUSTIFICATION_OIDC_CLIENT_SECRET:-}" ]]; then
27+
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_OIDC_CLIENT_SECRET "${TRUSTIFICATION_OIDC_CLIENT_SECRET}"
28+
fi
29+
if [[ -n "${TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION:-}" ]]; then
30+
bash $SCRIPTDIR/jenkins-create-secret TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "${TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION}"
31+
fi
2032

21-
bash $SCRIPTDIR/jenkins-create-user-password QUAY_IO_CREDS $MY_QUAY_USER $MY_QUAY_PW
33+
if [[ -n "${MY_QUAY_USER:-}" && -n "${MY_QUAY_PW:-}" ]]; then
34+
bash $SCRIPTDIR/jenkins-create-user-password QUAY_IO_CREDS "${MY_QUAY_USER}" "${MY_QUAY_PW}"
35+
fi

0 commit comments

Comments
 (0)