secret-schema.yaml

apiVersion: secret.jenkins-x.io/v1alpha1
kind: Schema
spec:
  objects:
  - name: jx-basic-auth-user-password
    mandatory: true
    properties:
    - name: username
      question: the username for basic auth ingresses
      help: The username to login to basic authenticated URLs
      defaultValue: admin
    - name: password
      question: the password for basic auth ingresses
      help: The password to login to basic authenticated URLs
      minLength: 5
      maxLength: 41
      generator: password
  - name: jx-basic-auth-htpasswd
    properties:
    - name: auth
      question: the htpasswd format basic auth for Ingress
      help: The htpasswd encoded user and password for basic auth ingresses
      retry: true
      template: |-
        {{ htpasswdExtSecret "jx-basic-auth-user-password" "username" "password" }}
      onlyTemplateIfBlank: true
  - name: jenkins-release-gpg
    properties:
    - name: pubring.gpg
      question: The gpg public ring
      # lets force the secret to be created with dummy values until the user really populates it
      defaultValue: todo
  - name: jenkins-maven-settings
    properties:
    - name: settings.xml
      question: Maven settings XML contents
      help: This is the maven settings XML which is mounted for Java builds
      noMask: true
      template: |-
        <settings>
            <localRepository>/home/jenkins/.mvnrepository</localRepository>
            <!--This sends everything else to /public -->
        {{- if and (hasKey .Requirements "repository") (eq .Requirements.repository "bucketrepo") }}
              <mirrors>
                  <mirror>
                      <id>bucketrepo</id>
                      <name>bucketrepo mirror</name>
                      <mirrorOf>*</mirrorOf>
                      <url>http://bucketrepo/bucketrepo/</url>
                  </mirror>
                </mirrors>
        {{- else if and (hasKey .Requirements "repository") (eq .Requirements.repository "none") }}
              <mirrors>
                <mirror>
                  <id>central</id>
                  <name>US Central</name>
                  <url>https://repo.maven.apache.org/maven2</url>
                  <mirrorOf>central</mirrorOf>
                </mirror>
                <mirror>
                  <id>UK</id>
                  <name>UK Central</name>
                  <url>https://uk.maven.org/maven2</url>
                  <mirrorOf>central</mirrorOf>
                </mirror>
              </mirrors>
        {{- else }}
              <mirrors>
                <mirror>
                    <id>nexus</id>
                    <name>nexus mirror</name>
                    <mirrorOf>central</mirrorOf>
                    <url>http://nexus/repository/maven-group/</url>
                </mirror>
              </mirrors>
        {{- end }}

            <!-- lets disable the download progress indicator that fills up logs -->
            <interactiveMode>false</interactiveMode>

            <servers>
                <server>
                    <id>local-nexus</id>
                    <username>{{ extsecret "nexus" "username" | default "admin"}}</username>
                    <password>{{ extsecret "nexus" "password" }}</password>
                </server>
                <server>
                    <id>nexus</id>
                    <username>{{ extsecret "nexus" "username" | default "admin"}}</username>
                    <password>{{ extsecret "nexus" "password" }}</password>
                </server>
                <server>
                    <id>chartmuseum</id>
                    <username>{{ extsecret "jenkins-x-chartmuseum" "username" }}</username>
                    <password>{{ extsecret "jenkins-x-chartmuseum" "password" }}</password>
                </server>
                <server>
                    <id>bucketrepo</id>
                    <username>{{ extsecret "jenkins-x-bucketrepo" "username" }}</username>
                    <password>{{ extsecret "jenkins-x-bucketrepo" "password" }}</password>
                </server>
                <server>
                    <id>oss-sonatype-staging</id>
                    <username>{{ extsecret "sonatype" "username" }}</username>
                    <password>{{ extsecret "sonatype" "password" }}</password>
                </server>
                <server>
                    <id>docker.io</id>
                    <username>{{ extsecret "docker-hub" "username" }}</username>
                    <password>{{ extsecret "docker-hub" "password" }}</password>
                </server>
                <server>
                  <id>github</id>
                  <username>{{ extsecret "tekton-git" "username"  }}</username>
                  <password>{{ extsecret "tekton-git" "password"  }}</password>
                </server>
        {{- if and (hasKey .Requirements "repository") (not (eq .Requirements.repository "bucketrepo")) (not (eq .Requirements.repository "nexus")) (not (eq .Requirements.repository "github")) (not (eq .Requirements.repository "")) }}
                <server>
                  <id>{{ .Requirements.repository }}</id>
                  <username>{{ extsecret .Requirements.repository "username" }}</username>
                  <password>{{ extsecret .Requirements.repository "password" }}</password>
                </server>
        {{- end }}
            </servers>

            <profiles>
                <profile>
                    <id>nexus</id>
                    <properties>
        {{- if and (hasKey .Requirements "repository") (eq .Requirements.repository "bucketrepo") }}
                      <altDeploymentRepository>local-nexus::default::http://bucketrepo/bucketrepo/</altDeploymentRepository>
                      <altReleaseDeploymentRepository>local-nexus::default::http://bucketrepo/bucketrepo/</altReleaseDeploymentRepository>
                      <altSnapshotDeploymentRepository>local-nexus::default::http://bucketrepo/bucketrepo/snapshots/</altSnapshotDeploymentRepository>
        {{- else if and (hasKey .Requirements "repository") (eq .Requirements.repository "github") }}

          {{- if and (hasKey .Requirements "repositories") (hasKey .Requirements.repositories "maven")  (hasKey .Requirements.repositories.maven "releaseUrl") }}
                      <altDeploymentRepository>github::default::{{ .Requirements.repositories.maven.releaseUrl }}</altDeploymentRepository>
                      <altReleaseDeploymentRepository>github::default::{{ .Requirements.repositories.maven.releaseUrl }}</altReleaseDeploymentRepository>
                      <altSnapshotDeploymentRepository>github::default::{{ .Requirements.repositories.maven.snapshotUrl | default .Requirements.repositories.maven.releaseUrl }}</altSnapshotDeploymentRepository>
          {{- else }}
                      <!-- TODO add a specific github package after https://maven.pkg.github.com/ like https://maven.pkg.github.com/myorg/myrepo -->
                      <altDeploymentRepository>github::default::https://maven.pkg.github.com/</altDeploymentRepository>
                      <altReleaseDeploymentRepository>github::default::https://maven.pkg.github.com/</altReleaseDeploymentRepository>
                      <altSnapshotDeploymentRepository>github::default::https://maven.pkg.github.com/</altSnapshotDeploymentRepository>
          {{- end }}
        {{- else if not (hasKey .Requirements "repository") }}
                      <altDeploymentRepository>local-nexus::default::http://nexus/repository/maven-releases/</altDeploymentRepository>
                      <altReleaseDeploymentRepository>local-nexus::default::http://nexus/repository/maven-releases/</altReleaseDeploymentRepository>
                      <altSnapshotDeploymentRepository>local-nexus::default::http://nexus/repository/maven-snapshots/</altSnapshotDeploymentRepository>
        {{- else if and (hasKey .Requirements "repository") (or (eq .Requirements.repository "nexus") (eq .Requirements.repository "") ) }}
                      <altDeploymentRepository>local-nexus::default::http://nexus/repository/maven-releases/</altDeploymentRepository>
                      <altReleaseDeploymentRepository>local-nexus::default::http://nexus/repository/maven-releases/</altReleaseDeploymentRepository>
                      <altSnapshotDeploymentRepository>local-nexus::default::http://nexus/repository/maven-snapshots/</altSnapshotDeploymentRepository>
        {{- else }}
                      <altDeploymentRepository>local-nexus::{{ .Requirements.repository }}::{{ .Requirements.repositories.maven.releaseUrl }}</altDeploymentRepository>
                      <altReleaseDeploymentRepository>local-nexus::{{ .Requirements.repository }}::{{ .Requirements.repositories.maven.releaseUrl }}</altReleaseDeploymentRepository>
                      <altSnapshotDeploymentRepository>local-nexus::{{ .Requirements.repository }}::{{ .Requirements.repositories.maven.snapshotUrl | default .Requirements.repositories.maven.releaseUrl }}</altSnapshotDeploymentRepository>
        {{- end }}
                    </properties>

                    <repositories>
                        <repository>
                            <id>central</id>
                            <url>http://central</url>
                            <releases><enabled>true</enabled></releases>
                            <snapshots><enabled>true</enabled></snapshots>
                        </repository>
                    </repositories>
                    <pluginRepositories>
                        <pluginRepository>
                            <id>central</id>
                            <url>http://central</url>
                            <releases><enabled>true</enabled></releases>
                            <snapshots><enabled>true</enabled></snapshots>
                        </pluginRepository>
                    </pluginRepositories>
                </profile>
                <profile>
                    <id>repo.jenkins-ci.org</id>
                    <properties>
                        <altDeploymentRepository>repo.jenkins-ci.org::default::https://repo.jenkins-ci.org/releases/</altDeploymentRepository>
                        <altReleaseDeploymentRepository>repo.jenkins-ci.org::default::https://repo.jenkins-ci.org/releases/</altReleaseDeploymentRepository>
                        <altSnapshotDeploymentRepository>repo.jenkins-ci.org::default::https://repo.jenkins-ci.org/snapshots/</altSnapshotDeploymentRepository>
                    </properties>

                </profile>
                <profile>
                    <id>maven.jenkins-ci.org</id>
                    <properties>
                        <altDeploymentRepository>maven.jenkins-ci.org::default::https://maven.jenkins-ci.org/releases/</altDeploymentRepository>
                        <altReleaseDeploymentRepository>maven.jenkins-ci.org::default::https://maven.jenkins-ci.org/releases/</altReleaseDeploymentRepository>
                        <altSnapshotDeploymentRepository>maven.jenkins-ci.org::default::https://maven.jenkins-ci.org/snapshots/</altSnapshotDeploymentRepository>
                    </properties>

                </profile>
                <profile>
                    <id>release</id>
                    <properties>
                        <gpg.executable>gpg</gpg.executable>
                        <!-- TODO use: .Parameters.gpg.passphrase when it is always populated -->
                        <gpg.passphrase>{{ extsecret "gpg" "passphrase" }}</gpg.passphrase>
                    </properties>
                </profile>
            </profiles>

            <activeProfiles>
                <activeProfile>nexus</activeProfile>
            </activeProfiles>
        </settings>
    - name: settings-security.xml
      question: Maven security XML contents
      help: This is the maven security XML which is mounted for Java builds
      noMask: true
      template: |-
        <settingsSecurity/>
  - name: tekton-git
    mandatory: true
    properties:
    - name: username
      noMask: true
      key: secret/data/jx/pipelineUser
      question: the pipeline username
      help: the user name used by pipelines running in Jenkins X
      generator: gitOperator.username
    - name: password
      key: secret/data/jx/pipelineUser
      question: the pipeline token or password
      help: the token or password used by pipelines running in Jenkins X
      generator: gitOperator.password
  - name: tekton-container-registry-auth
    mandatory: true
    properties:
    - name: .dockerconfigjson
      question: Docker JSON Configuration
      noMask: true
      help: This is the docker JSON configuration for authenticating with container
        registries
      template: |-
        {
        {{- if eq .Requirements.cluster.provider "gke" }}

          "credHelpers": {
              "gcr.io": "gcr",
              "us.gcr.io": "gcr",
              "eu.gcr.io": "gcr",
              "asia.gcr.io": "gcr",
              "staging-k8s.gcr.io": "gcr"
          },

        {{- else if and (eq .Requirements.cluster.provider "eks") (hasKey .Requirements "cluster") (hasKey .Requirements.cluster "registry") (contains "aws" .Requirements.cluster.registry) }}

        {{- if and (hasKey .Requirements "cluster") (hasKey .Requirements.cluster "registry") (not (eq .Requirements.cluster.registry (secret "jx.container-registry-auth" "url"))) }}
          "credHelpers": {
            "{{ .Requirements.cluster.registry }}": "ecr-login"
          },
        {{- end }}

        {{- else if eq .Requirements.cluster.provider "aws" }}

          "credsStore": "ecr-login",

        {{- else if eq .Requirements.cluster.provider "aks" }}

        {{- if and (hasKey .Requirements "cluster") (hasKey .Requirements.cluster "registry") (not (eq .Requirements.cluster.registry (secret "jx.container-registry-auth" "url"))) }}
          "credHelpers": {
            "{{ .Requirements.cluster.registry }}": "acr-env"
          },
        {{- end }}

        {{- end }}

          "auths":{
          {{- if secret "jx.container-registry-auth" "password" }}
            {{ secret "jx.container-registry-auth" "url" | default "https://index.docker.io/v1/" | quote }}: {
                "auth": {{ auth "jx.container-registry-auth" "username" "password" | b64enc | quote}},
                "email": {{ secret "jx.container-registry-auth" "email" | default "jenkins-x@googlegroups.com" | quote }}
            }
          {{- end }}
          {{- if or (eq .Requirements.cluster.gitServer "https://github.com") (eq .Requirements.cluster.gitServer "https://github.com/") }}
            {{- if secret "jx.container-registry-auth" "password" }}
            ,
            {{- end }}
            "ghcr.io": {
              {{- if secret "jx-git-operator.jx-boot" "email" }}
                "email": {{ secret "jx-git-operator.jx-boot" "email" | quote }},
              {{- end }}
                "auth": {{ auth "jx-git-operator.jx-boot" "username" "password" | b64enc | quote}}
            }
          {{- end }}
          }
        }