Skip to content

ci(buildkite): vault context switch #256

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 16, 2024
Merged

ci(buildkite): vault context switch #256

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions .buildkite/hooks/pre-command
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,10 @@ VAULT_ROLE_ID_SECRET=$(vault read -field=role-id secret/ci/elastic-apm-agent-and
export VAULT_ROLE_ID_SECRET
VAULT_SECRET_ID_SECRET=$(vault read -field=secret-id secret/ci/elastic-apm-agent-android/internal-ci-approle)
export VAULT_SECRET_ID_SECRET
VAULT_ADDR=$(vault read -field=vault-url secret/ci/elastic-apm-agent-android/internal-ci-approle)
export VAULT_ADDR
PROD_VAULT_ADDR=$(vault read -field=vault-url secret/ci/elastic-apm-agent-android/internal-ci-approle)

# Delete the vault specific accessing the ci vault
export VAULT_TOKEN_PREVIOUS=$VAULT_TOKEN
unset VAULT_TOKEN

echo "--- Prepare a secure temp :closed_lock_with_key:"
# Prepare a secure temp folder not shared between other jobs to store the key ring
Expand Down Expand Up @@ -65,15 +63,20 @@ KEY_ID=$(vault kv get --field="key_id" $GPG_SECRET)
KEY_ID_SECRET=${KEY_ID: -8}
export KEY_ID_SECRET

# TODO: this should be removed.
# TODO: BEGIN - this should be removed.
VAULT_ADDR=$PROD_VAULT_ADDR
unset VAULT_TOKEN
export VAULT_ADDR
VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID_SECRET" secret_id="$VAULT_SECRET_ID_SECRET")
export VAULT_TOKEN
# END - this should be removed.

# TODO: this should be changed with the new vault secrets.
# Gradle Plugin portal credentials
PLUGIN_PORTAL_KEY=$(vault read secret/release/gradle-plugin-portal -format=json | jq -r .data.key)
GRADLE_SECRET=secret/release/gradle-plugin-portal
PLUGIN_PORTAL_KEY=$(vault read $GRADLE_SECRET -format=json | jq -r .data.key)
export PLUGIN_PORTAL_KEY
PLUGIN_PORTAL_SECRET=$(vault read secret/release/gradle-plugin-portal -format=json | jq -r .data.secret)
PLUGIN_PORTAL_SECRET=$(vault read $GRADLE_SECRET -format=json | jq -r .data.secret)
export PLUGIN_PORTAL_SECRET

# Import the key into the keyring
Expand Down