Skip to content

Commit 78e484f

Browse files
tnevrlkatnevrlka
committed
Update Jenkins templates with global variables
Currently, every environment variable is treated as a credential and thus masked in the logs. Some of the environment variables should be visible in the logs. Change the templates so they use global variables in Jenkins for them. Signed-off-by: Tomáš Nevrlka <tnevrlka@redhat.com> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
1 parent a178b9c commit 78e484f

File tree

6 files changed

+44
-31
lines changed

6 files changed

+44
-31
lines changed

‎generated/gitops-template/jenkins/Jenkinsfile‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,26 +11,25 @@ pipeline {
1111
COSIGN_SECRET_PASSWORD = 'dummy'
1212
COSIGN_SECRET_KEY = 'dummy'
1313
/* Used to verify the image signature and attestation */
14-
COSIGN_PUBLIC_KEY = credentials('COSIGN_PUBLIC_KEY')
14+
COSIGN_PUBLIC_KEY = "${ env.COSIGN_PUBLIC_KEY }"
1515
/* URL of the BOMbastic api host (e.g. https://sbom.trustification.dev) */
16-
TRUSTIFICATION_BOMBASTIC_API_URL = credentials('TRUSTIFICATION_BOMBASTIC_API_URL')
16+
TRUSTIFICATION_BOMBASTIC_API_URL = "${ env.TRUSTIFICATION_BOMBASTIC_API_URL }"
1717
/* URL of the OIDC token issuer (e.g. https://sso.trustification.dev/realms/chicken) */
18-
TRUSTIFICATION_OIDC_ISSUER_URL = credentials('TRUSTIFICATION_OIDC_ISSUER_URL')
19-
TRUSTIFICATION_OIDC_CLIENT_ID = credentials('TRUSTIFICATION_OIDC_CLIENT_ID')
20-
TRUSTIFICATION_OIDC_CLIENT_SECRET = credentials('TRUSTIFICATION_OIDC_CLIENT_SECRET')
21-
TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION = credentials('TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION')
18+
TRUSTIFICATION_OIDC_ISSUER_URL = "${ env.TRUSTIFICATION_OIDC_ISSUER_URL }"
19+
TRUSTIFICATION_OIDC_CLIENT_ID = "${ env.TRUSTIFICATION_OIDC_CLIENT_ID }"
20+
TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION = "${ env.TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION }"
21+
/* Set when using Jenkins on non-local cluster and using an external Rekor instance */
22+
/* REKOR_HOST = "${ env.REKOR_HOST }" */
23+
/* Set when using Jenkins on non-local cluster and using an external TUF instance */
24+
/* TUF_MIRROR = "${ env.TUF_MIRROR }" */
2225
/* Set this to the user for your specific registry */
23-
/* IMAGE_REGISTRY_USER = credentials('IMAGE_REGISTRY_USER') */
26+
/* IMAGE_REGISTRY_USER = "${ env.IMAGE_REGISTRY_USER }" */
27+
TRUSTIFICATION_OIDC_CLIENT_SECRET = credentials('TRUSTIFICATION_OIDC_CLIENT_SECRET')
2428
/* Set this password for your specific registry */
2529
/* IMAGE_REGISTRY_PASSWORD = credentials('IMAGE_REGISTRY_PASSWORD') */
2630
QUAY_IO_CREDS = credentials('QUAY_IO_CREDS')
2731
/* ARTIFACTORY_IO_CREDS = credentials('ARTIFACTORY_IO_CREDS') */
28-
/* NEXUS_IO_CREDS = credentials('NEXUS_IO_CREDS') */
29-
/* Set when using Jenkins on non-local cluster and using an external Rekor instance */
30-
/* REKOR_HOST = credentials('REKOR_HOST') */
31-
/* Set when using Jenkins on non-local cluster and using an external TUF instance */
32-
/* TUF_MIRROR = credentials('TUF_MIRROR') */
33-
}
32+
/* NEXUS_IO_CREDS = credentials('NEXUS_IO_CREDS') */}
3433
stages {
3534
stage('Verify EC') {
3635
steps {

‎generated/source-repo/jenkins/Jenkinsfile‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,27 +7,25 @@ library identifier: 'RHTAP_Jenkins@main', retriever: modernSCM(
77
pipeline {
88
agent any
99
environment {
10+
ROX_CENTRAL_ENDPOINT = "${ env.ROX_CENTRAL_ENDPOINT }"
11+
/* GITOPS_AUTH_USERNAME = "${ env.GITOPS_AUTH_USERNAME }" */
12+
/* Set this to the user for your specific registry */
13+
/* IMAGE_REGISTRY_USER = "${ env.IMAGE_REGISTRY_USER }" */
14+
/* Set this only when using an external Rekor instance */
15+
/* REKOR_HOST = "${ env.REKOR_HOST }" */
16+
/* Set this only when using an external TUF instance */
17+
/* TUF_MIRROR = "${ env.TUF_MIRROR }" */
18+
COSIGN_PUBLIC_KEY = "${ env.COSIGN_PUBLIC_KEY }"
1019
ROX_API_TOKEN = credentials('ROX_API_TOKEN')
11-
ROX_CENTRAL_ENDPOINT = credentials('ROX_CENTRAL_ENDPOINT')
1220
GITOPS_AUTH_PASSWORD = credentials('GITOPS_AUTH_PASSWORD')
13-
/* Uncomment this when using Gitlab */
14-
/* GITOPS_AUTH_USERNAME = credentials('GITOPS_AUTH_USERNAME') */
15-
/* Set this to the user for your specific registry */
16-
/* IMAGE_REGISTRY_USER = credentials('IMAGE_REGISTRY_USER') */
1721
/* Set this password for your specific registry */
1822
/* IMAGE_REGISTRY_PASSWORD = credentials('IMAGE_REGISTRY_PASSWORD') */
1923
/* Default registry is set to quay.io */
2024
QUAY_IO_CREDS = credentials('QUAY_IO_CREDS')
2125
/* ARTIFACTORY_IO_CREDS = credentials('ARTIFACTORY_IO_CREDS') */
2226
/* NEXUS_IO_CREDS = credentials('NEXUS_IO_CREDS') */
2327
COSIGN_SECRET_PASSWORD = credentials('COSIGN_SECRET_PASSWORD')
24-
COSIGN_SECRET_KEY = credentials('COSIGN_SECRET_KEY')
25-
COSIGN_PUBLIC_KEY = credentials('COSIGN_PUBLIC_KEY')
26-
/* Set when using Jenkins on non-local cluster and using an external Rekor instance */
27-
/* REKOR_HOST = credentials('REKOR_HOST') */
28-
/* Set when using Jenkins on non-local cluster and using an external TUF instance */
29-
/* TUF_MIRROR = credentials('TUF_MIRROR') */
30-
}
28+
COSIGN_SECRET_KEY = credentials('COSIGN_SECRET_KEY')}
3129
stages {
3230
stage('init') {
3331
steps {

‎templates/gitops-template/Jenkinsfile.njk‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,14 @@ pipeline {
88
/* Not used but init.sh will fail if they're missing */
99
COSIGN_SECRET_PASSWORD = 'dummy'
1010
COSIGN_SECRET_KEY = 'dummy'
11+
{%- filter indent(8) -%}
12+
{%- for var in gitops_variables -%}
13+
{%- include "jenkins-variable.njk" -%}
14+
{%- endfor %}
1115
{%- for secret in gitops_secrets -%}
1216
{%- include "jenkins-secret.njk" -%}
1317
{%- endfor %}
18+
{%- endfilter -%}
1419
}
1520
stages {
1621
{%- for step in gitops_steps %}

‎templates/partials/jenkins-secret.njk‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
{%- if secret | eval_if_condition %}
2-
{%- if secret.comment %}
3-
/* {{ secret.comment }} */
4-
{%- endif %}
5-
{% if secret.commented_out %}/* {% endif %}{{ secret.name }} = credentials('{{ secret.name }}'){% if secret.commented_out %} */{% endif -%}
6-
{%- endif -%}
1+
{%- if secret | eval_if_condition %}
2+
{%- if secret.comment %}
3+
/* {{ secret.comment }} */
4+
{%- endif %}
5+
{% if secret.commented_out %}/* {% endif %}{{ secret.name }} = credentials('{{ secret.name }}'){% if secret.commented_out %} */{% endif -%}
6+
{%- endif -%}

‎templates/partials/jenkins-variable.njk‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{%- if var | eval_if_condition %}
2+
{%- if var.comment %}
3+
/* {{ var.comment }} */
4+
{%- endif %}
5+
{% if var.commented_out %}/* {% endif %}{{ var.name }} = "${ env.{{ var.name }} }"{% if var.commented_out %} */{% endif -%}
6+
{%- endif -%}

‎templates/source-repo/Jenkinsfile.njk‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,14 @@
55
pipeline {
66
agent any
77
environment {
8+
{%- filter indent(8) -%}
9+
{%- for var in build_variables -%}
10+
{%- include "jenkins-variable.njk" -%}
11+
{%- endfor %}
812
{%- for secret in build_secrets -%}
913
{%- include "jenkins-secret.njk" -%}
1014
{%- endfor %}
15+
{%- endfilter -%}
1116
}
1217
stages {
1318
{%- for step in build_steps %}

0 commit comments

Comments
 (0)