Skip to content

Commit 9e95ffe

Browse files
AlexFenlonpdabelf5
AlexFenlon
authored and
pdabelf5
committed
Update CRT and KEY to use az
1 parent 1ca073d commit 9e95ffe

File tree

5 files changed

+125
-32
lines changed

5 files changed

+125
-32
lines changed

‎.github/workflows/build-base-images.yml‎

Lines changed: 50 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,22 @@ jobs:
122122
- name: Checkout Repository
123123
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
124124

125+
- name: Azure login
126+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
127+
with:
128+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
129+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
130+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
131+
132+
- name: Setup secrets
133+
id: secrets
134+
run: |
135+
echo "Setting secrets for job"
136+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
137+
echo "::add-mask::$PLUS_CREDS"
138+
echo $PLUS_CREDS | jq -r '.crt' > nginx-repo.crt
139+
echo $PLUS_CREDS | jq -r '.key' > nginx-repo.key
140+
125141
- name: Docker Buildx
126142
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
127143

@@ -171,9 +187,14 @@ jobs:
171187
build-args: |
172188
BUILD_OS=${{ matrix.image }}
173189
IC_VERSION=${{ needs.checks.outputs.ic_version }}
174-
secrets: |
175-
"nginx-repo.crt=${{ secrets.NGINX_CRT }}"
176-
"nginx-repo.key=${{ secrets.NGINX_KEY }}"
190+
secret-files: |
191+
nginx-repo.crt=nginx-repo.crt
192+
nginx-repo.key=nginx-repo.key
193+
194+
- name: Clean up secrets
195+
run: |
196+
rm -f nginx-repo.crt nginx-repo.key
197+
if: always()
177198

178199
build-plus-nap:
179200
name: Build Plus NAP base images
@@ -190,6 +211,23 @@ jobs:
190211
- name: Checkout Repository
191212
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
192213

214+
- name: Azure login
215+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
216+
with:
217+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
218+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
219+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
220+
221+
- name: Setup secrets
222+
id: secrets
223+
run: |
224+
echo "Setting secrets for job"
225+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
226+
echo "::add-mask::$PLUS_CREDS"
227+
echo $PLUS_CREDS | jq -r '.crt' > nginx-repo.crt
228+
echo $PLUS_CREDS | jq -r '.key' > nginx-repo.key
229+
az keyvault secret show --name rhel-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv > rhel_license
230+
193231
- name: Docker Buildx
194232
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
195233

@@ -242,7 +280,12 @@ jobs:
242280
BUILD_OS=${{ matrix.image }}
243281
IC_VERSION=${{ needs.checks.outputs.ic_version }}
244282
NAP_MODULES=${{ matrix.nap_modules }}
245-
secrets: |
246-
"nginx-repo.crt=${{ secrets.NGINX_AP_CRT }}"
247-
"nginx-repo.key=${{ secrets.NGINX_AP_KEY }}"
248-
${{ contains(matrix.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
283+
secret-files: |
284+
nginx-repo.crt=nginx-repo.crt
285+
nginx-repo.key=nginx-repo.key
286+
${{ contains(matrix.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
287+
288+
- name: Clean up secrets
289+
run: |
290+
rm -f nginx-repo.crt nginx-repo.key rhel_license
291+
if: always()

‎.github/workflows/build-plus.yml‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,25 @@ jobs:
6363
ref: ${{ inputs.branch }}
6464
fetch-depth: 0
6565

66+
- name: Azure login
67+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
68+
with:
69+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
70+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
71+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
72+
if: ${{ inputs.authenticated }}
73+
74+
- name: Setup secrets
75+
id: secrets
76+
run: |
77+
echo "Setting secrets for job"
78+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
79+
echo "::add-mask::$PLUS_CREDS"
80+
echo $PLUS_CREDS | jq -r '.crt' > nginx-repo.crt
81+
echo $PLUS_CREDS | jq -r '.key' > nginx-repo.key
82+
az keyvault secret show --name rhel-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv > rhel_license
83+
if: ${{ inputs.authenticated }}
84+
6685
- name: Authenticate to Google Cloud
6786
id: auth
6887
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
@@ -154,10 +173,10 @@ jobs:
154173
BUILD_OS=${{ inputs.image }}
155174
IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
156175
${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
157-
secrets: |
158-
"nginx-repo.crt=${{ inputs.nap-modules != '' && secrets.NGINX_AP_CRT || secrets.NGINX_CRT }}"
159-
"nginx-repo.key=${{ inputs.nap-modules != '' && secrets.NGINX_AP_KEY || secrets.NGINX_KEY }}"
160-
${{ inputs.nap-modules != '' && contains(inputs.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
176+
secret-files: |
177+
nginx-repo.crt=nginx-repo.crt
178+
nginx-repo.key=nginx-repo.key
179+
${{ inputs.nap-modules != '' && contains(inputs.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
161180
if: ${{ inputs.authenticated && steps.images_exist.outputs.base_exists != 'true' }}
162181

163182
- name: Debug values
@@ -199,10 +218,10 @@ jobs:
199218
IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
200219
${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
201220
${{ (contains(inputs.target, 'aws') && inputs.nap-modules != '') && format('NAP_MODULES_AWS={0}', steps.nap_modules.outputs.modules) || '' }}
202-
secrets: |
203-
"nginx-repo.crt=${{ inputs.nap-modules != '' && secrets.NGINX_AP_CRT || secrets.NGINX_CRT }}"
204-
"nginx-repo.key=${{ inputs.nap-modules != '' && secrets.NGINX_AP_KEY || secrets.NGINX_KEY }}"
205-
${{ contains(inputs.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
221+
secret-files: |
222+
nginx-repo.crt=nginx-repo.crt
223+
nginx-repo.key=nginx-repo.key
224+
${{ contains(inputs.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
206225
if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}
207226

208227
- name: Make directory for security scan results
@@ -222,3 +241,8 @@ jobs:
222241
github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
223242
summary: true
224243
if: ${{ inputs.authenticated && steps.build-push.conclusion == 'success' }}
244+
245+
- name: Clean up secrets
246+
run: |
247+
rm -f nginx-repo.crt nginx-repo.key rhel_license
248+
if: always()

‎.github/workflows/build-single-image.yml‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -79,17 +79,23 @@ jobs:
7979
username: oauth2accesstoken
8080
password: ${{ steps.auth.outputs.access_token }}
8181

82-
- name: Setup plus credentials
82+
- name: Azure login
83+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
84+
with:
85+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
86+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
87+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
88+
if: ${{ contains(inputs.target, 'plus') }}
89+
90+
- name: Setup secrets
91+
id: secrets
8392
run: |
84-
printf '%s\n' "${CERT}" > nginx-repo.crt
85-
printf '%s\n' "${KEY}" > nginx-repo.key
86-
if [[ "${{ inputs.target }}" =~ ubi ]]; then
87-
printf '%s\n' "${RHEL}" > rhel_license
88-
fi
89-
env:
90-
CERT: ${{ secrets.NGINX_CRT }}
91-
KEY: ${{ secrets.NGINX_KEY }}
92-
RHEL: ${{ secrets.RHEL_LICENSE }}
93+
echo "Setting secrets for job"
94+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
95+
echo "::add-mask::$PLUS_CREDS"
96+
echo $PLUS_CREDS | jq -r '.crt' > nginx-repo.crt
97+
echo $PLUS_CREDS | jq -r '.key' > nginx-repo.key
98+
az keyvault secret show --name rhel-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv > rhel_license
9399
if: ${{ contains(inputs.target, 'plus') }}
94100

95101
- name: Fetch Cached Binary Artifacts
@@ -134,3 +140,8 @@ jobs:
134140
REGISTRY: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev
135141
PREFIX: ${{ inputs.prefix }}
136142
TAG: ${{ inputs.tag }}
143+
144+
- name: Clean up secrets
145+
run: |
146+
rm -f nginx-repo.crt nginx-repo.key rhel_license
147+
if: always()

‎.github/workflows/ci.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -473,6 +473,8 @@ jobs:
473473
PLUS_JWT=$(echo $PLUS_CREDS | jq -r '.jwt')
474474
echo "::add-mask::$PLUS_JWT"
475475
echo "PLUS_JWT=$PLUS_JWT" >> $GITHUB_OUTPUT
476+
echo $PLUS_CREDS | jq -r '.crt' > nginx-repo.crt
477+
echo $PLUS_CREDS | jq -r '.key' > nginx-repo.key
476478
if: ${{ needs.checks.outputs.forked_workflow != 'true' }}
477479

478480
- name: Authenticate to Google Cloud
@@ -529,9 +531,9 @@ jobs:
529531
build-args: |
530532
BUILD_OS=${{ matrix.base-os }}
531533
IC_VERSION=CI
532-
secrets: |
533-
${{ matrix.type == 'plus' && format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) || '' }}
534-
${{ matrix.type == 'plus' && format('"nginx-repo.key={0}"', secrets.NGINX_KEY) || '' }}
534+
secret-files: |
535+
${{ matrix.type == 'plus' && 'nginx-repo.crt=nginx-repo.crt' || '' }}
536+
${{ matrix.type == 'plus' && 'nginx-repo.key=nginx-repo.key' || '' }}
535537
if: ${{ needs.checks.outputs.forked_workflow == 'true' && needs.checks.outputs.docs_only == 'false' }}
536538

537539
- name: Deploy Kubernetes
@@ -590,6 +592,11 @@ jobs:
590592
done
591593
if: ${{ steps.stable_exists.outputs.exists != 'true' && needs.checks.outputs.docs_only == 'false' }}
592594

595+
- name: Clean up secrets
596+
run: |
597+
rm -f nginx-repo.crt nginx-repo.key
598+
if: always()
599+
593600
setup-matrix:
594601
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
595602
name: Setup Matrix for Smoke Tests

‎.github/workflows/setup-smoke.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,9 @@ jobs:
7878
PLUS_JWT=$(echo $PLUS_CREDS | jq -r '.jwt')
7979
echo "::add-mask::$PLUS_JWT"
8080
echo "PLUS_JWT=$PLUS_JWT" >> $GITHUB_OUTPUT
81+
echo $PLUS_CREDS | jq -r '.crt' > nginx-repo.crt
82+
echo $PLUS_CREDS | jq -r '.key' > nginx-repo.key
83+
az keyvault secret show --name rhel-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv > rhel_license
8184
if: ${{ inputs.authenticated }}
8285

8386
- name: Authenticate to Google Cloud
@@ -163,10 +166,10 @@ jobs:
163166
IC_VERSION=CI
164167
${{ contains(inputs.image, 'nap') && format('NAP_MODULES={0}', steps.nap_modules.outputs.modules) || '' }}
165168
${{ contains(inputs.marker, 'appprotect') && 'DEBIAN_VERSION=buster-slim' || '' }}
166-
secrets: |
167-
${{ contains(inputs.image, 'nap') && format('"nginx-repo.crt={0}"', secrets.NGINX_AP_CRT) || format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) }}
168-
${{ contains(inputs.image, 'nap') && format('"nginx-repo.key={0}"', secrets.NGINX_AP_KEY) || format('"nginx-repo.key={0}"', secrets.NGINX_KEY) }}
169-
${{ contains(inputs.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
169+
secret-files: |
170+
nginx-repo.crt=nginx-repo.crt
171+
nginx-repo.key=nginx-repo.key
172+
${{ contains(inputs.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
170173
if: ${{ !inputs.authenticated }}
171174

172175
- name: Generate WAF v5 tgz from JSON
@@ -195,3 +198,8 @@ jobs:
195198
name: ${{ steps.smoke-tests.outputs.test-results-name }}
196199
path: ${{ steps.smoke-tests.outputs.test-results-path }}
197200
if: ${{ !cancelled() && steps.stable_exists.outputs.exists != 'true' }}
201+
202+
- name: Clean up secrets
203+
run: |
204+
rm -f nginx-repo.crt nginx-repo.key rhel_license
205+
if: always()

0 commit comments

Comments
 (0)