Migrate Vault V1 secrets to V3 by flippingbits · Pull Request #3346 · confluentinc/vscode

Stefan Sprenger (flippingbits) · 2026-03-25T22:36:06Z

Summary of Changes

Replace vault-setup with vault-get-secret in Linux Semaphore prologues
Update Windows Semaphore blocks to use V3 vault auth and paths
Update Makefile to read test credentials from env vars (set by vault-get-secret)
Update Gulpfile.js to check env vars before calling vault CLI, with V3 fallback paths
Secrets migrated: vscodeextension/testing, vscodeextension/telemetry, vscodeextension/feature-flags

Note: Some vault-setup calls remain in release/packaging/reporting pipelines that may use vault for other purposes. These need separate migration.

Click-testing instructions

Optional: Any additional details or context that should be provided?

Pull request checklist

Please check if your PR fulfills the following (if applicable):

Tests

Added new
Updated existing
Deleted existing

Release notes

Does anything in this PR need to be mentioned in the user-facing CHANGELOG?

- Replace `vault-setup` with `vault-get-secret` in Linux Semaphore prologues - Update Windows Semaphore blocks to use V3 vault auth and paths - Update Makefile to read test credentials from env vars (set by vault-get-secret) - Update Gulpfile.js to check env vars before calling vault CLI, with V3 fallback paths - Secrets migrated: vscodeextension/testing, vscodeextension/telemetry, vscodeextension/feature-flags Note: Some `vault-setup` calls remain in release/packaging/reporting pipelines that may use vault for other purposes. These need separate migration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

This PR migrates CI/test/build secret retrieval from Vault V1 to the newer Vault V3 layout, updating Semaphore pipelines and local build tooling so credentials can be injected via environment variables (e.g., vault-get-secret) rather than direct vault kv get calls from Make/Gulp.

Changes:

Update Linux Semaphore prologues to source vault-get-secret for testing/telemetry/feature-flags secrets.
Update Windows Semaphore blocks to use the new Vault address/auth mount and V3 secret paths.
Adjust Makefile/Gulpfile to prefer env vars (with Vault CLI fallback using new paths).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
`Makefile`	Writes test `.env` from pre-injected environment variables instead of calling Vault directly.
`Gulpfile.js`	Uses env vars when present; otherwise fetches Sentry/Segment/LaunchDarkly secrets from updated Vault paths.
`.semaphore/semaphore.yml`	Migrates Vault setup in Linux blocks to `vault-get-secret` and updates Windows Vault auth + paths.
`.semaphore/playwright-e2e.yml`	Same Vault migration for Playwright E2E pipelines (Linux via `vault-get-secret`, Windows via new auth + paths).

Copilot · 2026-03-25T22:39:38Z

+	@echo "Writing test credentials to .env file for testing"
 	@if [ -z "$(IDE_SIDECAR_CONNECTIONS_CCLOUD_BASE_PATH)" ] || [ "$(IDE_SIDECAR_CONNECTIONS_CCLOUD_BASE_PATH)" = "confluent.cloud" ]; then \
 			echo "Setting up prod env vars for testing"; \
-			echo "E2E_USERNAME=$(shell vault kv get -field=E2E_USERNAME v1/ci/kv/vscodeextension/testing)" > .env; \
-			echo "E2E_PASSWORD=$(shell vault kv get -field=E2E_PASSWORD v1/ci/kv/vscodeextension/testing)" >> .env; \
-			echo "E2E_SR_API_KEY=$(shell vault kv get -field=E2E_SR_API_KEY v1/ci/kv/vscodeextension/testing)" >> .env; \
-			echo "E2E_SR_API_SECRET=$(shell vault kv get -field=E2E_SR_API_SECRET v1/ci/kv/vscodeextension/testing)" >> .env; \
-			echo "E2E_SR_URL=$(shell vault kv get -field=E2E_SR_URL v1/ci/kv/vscodeextension/testing)" >> .env; \
-			echo "E2E_KAFKA_API_KEY=$(shell vault kv get -field=E2E_KAFKA_API_KEY v1/ci/kv/vscodeextension/testing)" >> .env; \
-			echo "E2E_KAFKA_API_SECRET=$(shell vault kv get -field=E2E_KAFKA_API_SECRET v1/ci/kv/vscodeextension/testing)" >> .env; \
-			echo "E2E_KAFKA_BOOTSTRAP_SERVERS=$(shell vault kv get -field=E2E_KAFKA_BOOTSTRAP_SERVERS v1/ci/kv/vscodeextension/testing)" >> .env; \
-			echo "E2E_KAFKA_CLUSTER_NAME=$(shell vault kv get -field=E2E_KAFKA_CLUSTER_NAME v1/ci/kv/vscodeextension/testing)" >> .env; \
+			echo "E2E_USERNAME=$$E2E_USERNAME" > .env; \
+			echo "E2E_PASSWORD=$$E2E_PASSWORD" >> .env; \
+			echo "E2E_SR_API_KEY=$$E2E_SR_API_KEY" >> .env; \
+			echo "E2E_SR_API_SECRET=$$E2E_SR_API_SECRET" >> .env; \
+			echo "E2E_SR_URL=$$E2E_SR_URL" >> .env; \
+			echo "E2E_KAFKA_API_KEY=$$E2E_KAFKA_API_KEY" >> .env; \
+			echo "E2E_KAFKA_API_SECRET=$$E2E_KAFKA_API_SECRET" >> .env; \
+			echo "E2E_KAFKA_BOOTSTRAP_SERVERS=$$E2E_KAFKA_BOOTSTRAP_SERVERS" >> .env; \
+			echo "E2E_KAFKA_CLUSTER_NAME=$$E2E_KAFKA_CLUSTER_NAME" >> .env; \


setup-test-env now writes credentials from environment variables without validating they are set. If any of these vars are missing/empty (e.g., running locally without vault-get-secret), this will silently generate a .env with empty values and cause confusing downstream test failures. Consider failing fast with a clear error when required variables are unset, and prefer printf over echo to avoid shell-specific escaping issues for secrets containing backslashes/newlines.

Copilot · 2026-03-25T22:39:38Z

 function setupSentry() {
+  // If env vars already set (e.g., by vault-get-secret in CI), use them directly
+  if (process.env.SENTRY_AUTH_TOKEN && process.env.SENTRY_DSN) {
+    const sentryRelease = getSentryReleaseVersion();
+    console.log(`Setting SENTRY_RELEASE to "${sentryRelease}"`);
+    process.env.SENTRY_RELEASE = sentryRelease;
+    return;
+  }


setupSentry() only takes the “env vars already set” fast path when both SENTRY_AUTH_TOKEN and SENTRY_DSN are present. If SENTRY_AUTH_TOKEN is provided via env (common in CI) but SENTRY_DSN is missing, the function will still attempt Vault access and may fail without ever setting SENTRY_RELEASE, even though the Sentry rollup plugin depends on SENTRY_AUTH_TOKEN + SENTRY_RELEASE. Consider: (1) computing/setting SENTRY_RELEASE whenever SENTRY_AUTH_TOKEN is set, and (2) fetching only the missing values from Vault (don’t refetch/require Vault when one var is already present).

Copilot · 2026-03-25T22:39:38Z

 function setupLaunchDarkly() {
+  // If env var already set (e.g., by vault-get-secret in CI), use it directly
+  if (process.env.LD_CLIENT_ID) {
+    process.env.LAUNCHDARKLY_CLIENT_ID = process.env.LD_CLIENT_ID;
+    return;
+  }


setupLaunchDarkly() only checks process.env.LD_CLIENT_ID, but local/dev configuration (see .env.example) uses LAUNCHDARKLY_CLIENT_ID. With the current logic, a production build that already has LAUNCHDARKLY_CLIENT_ID set will still try to call the Vault CLI and overwrite/fail unnecessarily. Consider short-circuiting when LAUNCHDARKLY_CLIENT_ID is already set, and only mapping LD_CLIENT_ID -> LAUNCHDARKLY_CLIENT_ID when the latter is absent.

Stefan Sprenger (flippingbits) · 2026-03-26T13:17:22Z

              echo "Skipping Vault setup for Semaphore CI"
            else
-              . vault-setup
+              . vault-setup --version v3 --role vscode


Dave Shoup (@shouples) I think we need to change instances of . vault-setup to . vault-setup --version v3 --role vscode, if we want to minimize changes applied to Gulpfile.js and Makefile.

sonarqube-confluent · 2026-03-26T20:51:04Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

Copilot AI review requested due to automatic review settings March 25, 2026 22:36

Copilot started reviewing on behalf of Stefan Sprenger (flippingbits) March 25, 2026 22:36 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Dave Shoup (shouples) self-assigned this Mar 25, 2026

chore: point vault-setup to v3

1c439f4

Stefan Sprenger (flippingbits) commented Mar 26, 2026

View reviewed changes

Stefan Sprenger (flippingbits) added 4 commits March 26, 2026 17:56

chore: fix Vault path for Windows agents

d9d10f8

chore: fix setup-test-env

b22bcdd

chore: pick username/password depending on base path

3f46737

chore: run npx gulp format

72cdb55

Stefan Sprenger (flippingbits) marked this pull request as ready for review March 26, 2026 20:47

Stefan Sprenger (flippingbits) requested a review from a team as a code owner March 26, 2026 20:47

Dave Shoup (shouples) approved these changes Mar 26, 2026

View reviewed changes

Stefan Sprenger (flippingbits) merged commit 52c3fc2 into main Mar 26, 2026
14 checks passed

Stefan Sprenger (flippingbits) deleted the vault-migration branch March 26, 2026 21:41

Dave Shoup (shouples) mentioned this pull request Mar 26, 2026

fix(CI): remove telemetry and feature-flag secret loading for tests #3349

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate Vault V1 secrets to V3#3346

Migrate Vault V1 secrets to V3#3346
Stefan Sprenger (flippingbits) merged 6 commits intomainfrom
vault-migration

Stefan Sprenger (flippingbits) commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Stefan Sprenger (flippingbits) Mar 26, 2026 •

edited

Loading

Uh oh!

sonarqube-confluent Bot commented Mar 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Stefan Sprenger (flippingbits) commented Mar 25, 2026

Summary of Changes

Click-testing instructions

Optional: Any additional details or context that should be provided?

Pull request checklist

Tests

Release notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Stefan Sprenger (flippingbits) Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqube-confluent Bot commented Mar 26, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Stefan Sprenger (flippingbits) Mar 26, 2026 •

edited

Loading