Skip to content

Commit ef196f4

Browse files
pdabelf5pdabelf5
authored
Merge branch 'main' into chore/gcr-secrets
Signed-off-by: Paul Abel <128620221+pdabelf5@users.noreply.github.com>
2 parents 3b4cda7 + 4e5fb77 commit ef196f4

File tree

14 files changed

+296
-83
lines changed

14 files changed

+296
-83
lines changed

‎.github/actions/certify-openshift-image/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ inputs:
2020
required: false
2121
default: "amd64,arm64"
2222
submit:
23-
description: Submit results to Redhat PYAXIS
23+
description: Submit results to Redhat PYXIS
2424
required: false
2525
default: true
2626

‎.github/workflows/build-artifacts.yml‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -91,14 +91,6 @@ jobs:
9191
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
9292
GOPATH: ${{ inputs.go-path }}
9393
GOPROXY: ${{ inputs.go-proxy }}
94-
AWS_PRODUCT_CODE: ${{ secrets.AWS_PRODUCT_CODE }}
95-
AWS_PUB_KEY: ${{ secrets.AWS_PUB_KEY }}
96-
AWS_NAP_DOS_PRODUCT_CODE: ${{ secrets.AWS_NAP_DOS_PRODUCT_CODE }}
97-
AWS_NAP_DOS_PUB_KEY: ${{ secrets.AWS_NAP_DOS_PUB_KEY }}
98-
AWS_NAP_WAF_PRODUCT_CODE: ${{ secrets.AWS_NAP_WAF_PRODUCT_CODE }}
99-
AWS_NAP_WAF_PUB_KEY: ${{ secrets.AWS_NAP_WAF_PUB_KEY }}
100-
AWS_NAP_WAF_DOS_PRODUCT_CODE: ${{ secrets.AWS_NAP_WAF_DOS_PRODUCT_CODE }}
101-
AWS_NAP_WAF_DOS_PUB_KEY: ${{ secrets.AWS_NAP_WAF_DOS_PUB_KEY }}
10294
GORELEASER_CURRENT_TAG: "v${{ inputs.ic-version }}"
10395
if: ${{ inputs.force }}
10496

@@ -115,6 +107,10 @@ jobs:
115107
key: nginx-ingress-${{ inputs.go-md5 }}
116108
if: ${{ inputs.force }}
117109

110+
- name: Cleanup netrc
111+
run: rm -f $HOME/.netrc
112+
if: ${{ always() }}
113+
118114
# generate-assertion-doc:
119115
# if: ${{ github.event_name != 'pull_request' }}
120116
# name: Assertion Doc ${{ matrix.nic.arch }}
@@ -190,9 +186,9 @@ jobs:
190186
# with:
191187
# assertion-doc: ${{ steps.assertiondoc.outputs.assertion-document-path }}
192188

193-
- name: Cleanup netrc
194-
run: rm -f $HOME/.netrc
195-
if: ${{ always() }}
189+
#  - name: Cleanup netrc
190+
# run: rm -f $HOME/.netrc
191+
# if: ${{ always() }}
196192

197193
build-docker:
198194
name: Build Docker OSS

‎.github/workflows/build-base-images.yml‎

Lines changed: 46 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,18 @@ jobs:
157157
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
158158
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
159159
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
160+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
161+
echo "::add-mask::$PLUS_CREDS"
162+
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
163+
while read -r line; do
164+
echo "::add-mask::${line}"
165+
done <<< "${CERT}"
166+
echo $CERT > nginx-repo.crt
167+
IFS=@ KEY=$(echo $PLUS_CREDS | jq -r '.key')
168+
while read -r line; do
169+
echo "::add-mask::${line}"
170+
done <<< "${KEY}"
171+
echo $KEY > nginx-repo.key
160172
161173
- name: Docker Buildx
162174
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
@@ -207,9 +219,14 @@ jobs:
207219
build-args: |
208220
BUILD_OS=${{ matrix.image }}
209221
IC_VERSION=${{ needs.checks.outputs.ic_version }}
210-
secrets: |
211-
"nginx-repo.crt=${{ secrets.NGINX_CRT }}"
212-
"nginx-repo.key=${{ secrets.NGINX_KEY }}"
222+
secret-files: |
223+
nginx-repo.crt=nginx-repo.crt
224+
nginx-repo.key=nginx-repo.key
225+
226+
- name: Clean up secrets
227+
run: |
228+
rm -f nginx-repo.crt nginx-repo.key
229+
if: always()
213230

214231
build-plus-nap:
215232
name: Build Plus NAP base images
@@ -243,6 +260,23 @@ jobs:
243260
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
244261
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
245262
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
263+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
264+
echo "::add-mask::$PLUS_CREDS"
265+
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
266+
while read -r line; do
267+
echo "::add-mask::${line}"
268+
done <<< "${CERT}"
269+
echo $CERT > nginx-repo.crt
270+
IFS=@ KEY=$(echo $PLUS_CREDS | jq -r '.key')
271+
while read -r line; do
272+
echo "::add-mask::${line}"
273+
done <<< "${KEY}"
274+
echo $KEY > nginx-repo.key
275+
IFS=@ RHEL_CREDS=$(az keyvault secret show --name rhel-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
276+
while read -r line; do
277+
echo "::add-mask::${line}"
278+
done <<< "${RHEL_CREDS}"
279+
echo $RHEL_CREDS > rhel_license
246280
247281
- name: Docker Buildx
248282
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
@@ -296,7 +330,12 @@ jobs:
296330
BUILD_OS=${{ matrix.image }}
297331
IC_VERSION=${{ needs.checks.outputs.ic_version }}
298332
NAP_MODULES=${{ matrix.nap_modules }}
299-
secrets: |
300-
"nginx-repo.crt=${{ secrets.NGINX_AP_CRT }}"
301-
"nginx-repo.key=${{ secrets.NGINX_AP_KEY }}"
302-
${{ contains(matrix.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
333+
secret-files: |
334+
nginx-repo.crt=nginx-repo.crt
335+
nginx-repo.key=nginx-repo.key
336+
${{ contains(matrix.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
337+
338+
- name: Clean up secrets
339+
run: |
340+
rm -f nginx-repo.crt nginx-repo.key rhel_license
341+
if: always()

‎.github/workflows/build-plus.yml‎

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,23 @@ jobs:
8181
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
8282
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
8383
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
84+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
85+
echo "::add-mask::$PLUS_CREDS"
86+
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
87+
while read -r line; do
88+
echo "::add-mask::${line}"
89+
done <<< "${CERT}"
90+
echo $CERT > nginx-repo.crt
91+
IFS=@ KEY=$(echo $PLUS_CREDS | jq -r '.key')
92+
while read -r line; do
93+
echo "::add-mask::${line}"
94+
done <<< "${KEY}"
95+
echo $KEY > nginx-repo.key
96+
IFS=@ RHEL_CREDS=$(az keyvault secret show --name rhel-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
97+
while read -r line; do
98+
echo "::add-mask::${line}"
99+
done <<< "${RHEL_CREDS}"
100+
echo $RHEL_CREDS > rhel_license
84101
if: ${{ inputs.authenticated }}
85102

86103
- name: Authenticate to Google Cloud
@@ -174,10 +191,10 @@ jobs:
174191
BUILD_OS=${{ inputs.image }}
175192
IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
176193
${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
177-
secrets: |
178-
"nginx-repo.crt=${{ inputs.nap-modules != '' && secrets.NGINX_AP_CRT || secrets.NGINX_CRT }}"
179-
"nginx-repo.key=${{ inputs.nap-modules != '' && secrets.NGINX_AP_KEY || secrets.NGINX_KEY }}"
180-
${{ inputs.nap-modules != '' && contains(inputs.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
194+
secret-files: |
195+
nginx-repo.crt=nginx-repo.crt
196+
nginx-repo.key=nginx-repo.key
197+
${{ inputs.nap-modules != '' && contains(inputs.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
181198
if: ${{ inputs.authenticated && steps.images_exist.outputs.base_exists != 'true' }}
182199

183200
- name: Debug values
@@ -219,10 +236,10 @@ jobs:
219236
IC_VERSION=${{ inputs.ic-version && inputs.ic-version || steps.meta.outputs.version }}
220237
${{ inputs.nap-modules != '' && format('NAP_MODULES={0}', steps.nap_modules.outputs.name) || '' }}
221238
${{ (contains(inputs.target, 'aws') && inputs.nap-modules != '') && format('NAP_MODULES_AWS={0}', steps.nap_modules.outputs.modules) || '' }}
222-
secrets: |
223-
"nginx-repo.crt=${{ inputs.nap-modules != '' && secrets.NGINX_AP_CRT || secrets.NGINX_CRT }}"
224-
"nginx-repo.key=${{ inputs.nap-modules != '' && secrets.NGINX_AP_KEY || secrets.NGINX_KEY }}"
225-
${{ contains(inputs.image, 'ubi') && format('"rhel_license={0}"', secrets.RHEL_LICENSE) || '' }}
239+
secret-files: |
240+
nginx-repo.crt=nginx-repo.crt
241+
nginx-repo.key=nginx-repo.key
242+
${{ contains(inputs.image, 'ubi') && 'rhel_license=rhel_license' || '' }}
226243
if: ${{ steps.images_exist.outputs.base_exists != 'true' || steps.images_exist.outputs.target_exists != 'true' }}
227244

228245
- name: Make directory for security scan results
@@ -242,3 +259,8 @@ jobs:
242259
github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
243260
summary: true
244261
if: ${{ inputs.authenticated && steps.build-push.conclusion == 'success' }}
262+
263+
- name: Clean up secrets
264+
run: |
265+
rm -f nginx-repo.crt nginx-repo.key rhel_license
266+
if: always()

‎.github/workflows/build-single-image.yml‎

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -97,17 +97,35 @@ jobs:
9797
username: oauth2accesstoken
9898
password: ${{ steps.auth.outputs.access_token }}
9999

100-
- name: Setup plus credentials
100+
- name: Azure login
101+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
102+
with:
103+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
104+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
105+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
106+
if: ${{ contains(inputs.target, 'plus') }}
107+
108+
- name: Setup secrets
109+
id: secrets
101110
run: |
102-
printf '%s\n' "${CERT}" > nginx-repo.crt
103-
printf '%s\n' "${KEY}" > nginx-repo.key
104-
if [[ "${{ inputs.target }}" =~ ubi ]]; then
105-
printf '%s\n' "${RHEL}" > rhel_license
106-
fi
107-
env:
108-
CERT: ${{ secrets.NGINX_CRT }}
109-
KEY: ${{ secrets.NGINX_KEY }}
110-
RHEL: ${{ secrets.RHEL_LICENSE }}
111+
echo "Setting secrets for job"
112+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
113+
echo "::add-mask::$PLUS_CREDS"
114+
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
115+
while read -r line; do
116+
echo "::add-mask::${line}"
117+
done <<< "${CERT}"
118+
echo $CERT > nginx-repo.crt
119+
IFS=@ KEY=$(echo $PLUS_CREDS | jq -r '.key')
120+
while read -r line; do
121+
echo "::add-mask::${line}"
122+
done <<< "${KEY}"
123+
echo $KEY > nginx-repo.key
124+
IFS=@ RHEL_CREDS=$(az keyvault secret show --name rhel-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
125+
while read -r line; do
126+
echo "::add-mask::${line}"
127+
done <<< "${RHEL_CREDS}"
128+
echo $RHEL_CREDS > rhel_license
111129
if: ${{ contains(inputs.target, 'plus') }}
112130

113131
- name: Fetch Cached Binary Artifacts
@@ -125,14 +143,6 @@ jobs:
125143
env:
126144
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
127145
GOPATH: ${{ steps.vars.outputs.go_path }}
128-
AWS_PRODUCT_CODE: ${{ secrets.AWS_PRODUCT_CODE }}
129-
AWS_PUB_KEY: ${{ secrets.AWS_PUB_KEY }}
130-
AWS_NAP_DOS_PRODUCT_CODE: ${{ secrets.AWS_NAP_DOS_PRODUCT_CODE }}
131-
AWS_NAP_DOS_PUB_KEY: ${{ secrets.AWS_NAP_DOS_PUB_KEY }}
132-
AWS_NAP_WAF_PRODUCT_CODE: ${{ secrets.AWS_NAP_WAF_PRODUCT_CODE }}
133-
AWS_NAP_WAF_PUB_KEY: ${{ secrets.AWS_NAP_WAF_PUB_KEY }}
134-
AWS_NAP_WAF_DOS_PRODUCT_CODE: ${{ secrets.AWS_NAP_WAF_DOS_PRODUCT_CODE }}
135-
AWS_NAP_WAF_DOS_PUB_KEY: ${{ secrets.AWS_NAP_WAF_DOS_PUB_KEY }}
136146
GORELEASER_CURRENT_TAG: "v${{ steps.vars.outputs.ic_version }}"
137147
if: ${{ steps.binary-cache.outputs.binary_cache_hit != 'true' }}
138148

@@ -160,3 +170,8 @@ jobs:
160170
REGISTRY: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev
161171
PREFIX: ${{ inputs.prefix }}
162172
TAG: ${{ inputs.tag }}
173+
174+
- name: Clean up secrets
175+
run: |
176+
rm -f nginx-repo.crt nginx-repo.key rhel_license
177+
if: always()

‎.github/workflows/certify-ubi-image.yml‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,37 @@ jobs:
3434
certify-ubi-images:
3535
name: Certify OpenShift UBI images
3636
runs-on: ubuntu-24.04
37+
permissions:
38+
contents: read
39+
id-token: write
3740
steps:
3841
- name: Checkout
3942
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
4043

44+
- name: Azure login
45+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
46+
with:
47+
client-id: ${{ secrets.AZURE_VAULT_CLIENT_ID }}
48+
tenant-id: ${{ secrets.AZURE_VAULT_TENANT_ID }}
49+
subscription-id: ${{ secrets.AZURE_VAULT_SUBSCRIPTION_ID }}
50+
51+
- name: Setup secrets
52+
id: secrets
53+
run: |
54+
echo "Setting secrets for job"
55+
PYXIS_TOKEN=$(az keyvault secret show --name nic-pyxis-token --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
56+
echo "::add-mask::$PYXIS_TOKEN"
57+
echo "PYXIS_TOKEN=$PYXIS_TOKEN" >> $GITHUB_OUTPUT
58+
PYXIS_CERTIFICATION_PROJECT_ID=$(az keyvault secret show --name nic-pyxis-certification-pid --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
59+
echo "::add-mask::$PYXIS_CERTIFICATION_PROJECT_ID"
60+
echo "PYXIS_CERTIFICATION_PROJECT_ID=$PYXIS_CERTIFICATION_PROJECT_ID" >> $GITHUB_OUTPUT
61+
4162
- name: Certify UBI OSS images in quay
4263
uses: ./.github/actions/certify-openshift-image
4364
with:
4465
image: ${{ inputs.image }}
45-
project_id: ${{ secrets.CERTIFICATION_PROJECT_ID }}
46-
pyxis_token: ${{ secrets.PYXIS_API_TOKEN }}
66+
project_id: ${{ steps.secrets.outputs.PYXIS_CERTIFICATION_PROJECT_ID }}
67+
pyxis_token: ${{ steps.secrets.outputs.PYXIS_TOKEN }}
4768
preflight_version: ${{ inputs.preflight_version }}
4869
submit: ${{ inputs.submit || true }}
4970
platforms: ${{ inputs.platforms }}

‎.github/workflows/ci.yml‎

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,21 @@ jobs:
514514
GCR_SERVICE_ACCOUNT=$(az keyvault secret show --name kic-pipeline-gcr-sa --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
515515
echo "::add-mask::$GCR_SERVICE_ACCOUNT"
516516
echo "GCR_SERVICE_ACCOUNT=$GCR_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT
517+
PLUS_CREDS=$(az keyvault secret show --name plus-creds --vault-name ${{ secrets.NIC_KEYVAULT_NAME }} --query value -o tsv)
518+
echo "::add-mask::$PLUS_CREDS"
519+
PLUS_JWT=$(echo $PLUS_CREDS | jq -r '.jwt')
520+
echo "::add-mask::$PLUS_JWT"
521+
echo "PLUS_JWT=$PLUS_JWT" >> $GITHUB_OUTPUT
522+
IFS=@ CERT=$(echo $PLUS_CREDS | jq -r '.crt')
523+
while read -r line; do
524+
echo "::add-mask::${line}"
525+
done <<< "${CERT}"
526+
echo $CERT > nginx-repo.crt
527+
IFS=@ KEY=$(echo $PLUS_CREDS | jq -r '.key')
528+
while read -r line; do
529+
echo "::add-mask::${line}"
530+
done <<< "${KEY}"
531+
echo $KEY > nginx-repo.key
517532
if: ${{ needs.checks.outputs.forked_workflow != 'true' }}
518533

519534
- name: Authenticate to Google Cloud
@@ -570,9 +585,9 @@ jobs:
570585
build-args: |
571586
BUILD_OS=${{ matrix.base-os }}
572587
IC_VERSION=CI
573-
secrets: |
574-
${{ matrix.type == 'plus' && format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) || '' }}
575-
${{ matrix.type == 'plus' && format('"nginx-repo.key={0}"', secrets.NGINX_KEY) || '' }}
588+
secret-files: |
589+
${{ matrix.type == 'plus' && 'nginx-repo.crt=nginx-repo.crt' || '' }}
590+
${{ matrix.type == 'plus' && 'nginx-repo.key=nginx-repo.key' || '' }}
576591
if: ${{ needs.checks.outputs.forked_workflow == 'true' && needs.checks.outputs.docs_only == 'false' }}
577592

578593
- name: Deploy Kubernetes
@@ -585,7 +600,7 @@ jobs:
585600
if: ${{ steps.stable_exists.outputs.exists != 'true' && needs.checks.outputs.docs_only == 'false' }}
586601

587602
- name: Create Plus Secret
588-
run: kubectl create secret generic license-token --from-literal=license.jwt="${{ secrets.PLUS_JWT }}" --type="nginx.com/license"
603+
run: kubectl create secret generic license-token --from-literal=license.jwt="${{ steps.secrets.outputs.PLUS_JWT }}" --type="nginx.com/license"
589604
if: ${{ matrix.type == 'plus' && steps.stable_exists.outputs.exists != 'true' && needs.checks.outputs.docs_only == 'false' }}
590605

591606
- name: Install Chart
@@ -631,6 +646,11 @@ jobs:
631646
done
632647
if: ${{ steps.stable_exists.outputs.exists != 'true' && needs.checks.outputs.docs_only == 'false' }}
633648

649+
- name: Clean up secrets
650+
run: |
651+
rm -f nginx-repo.crt nginx-repo.key
652+
if: always()
653+
634654
setup-matrix:
635655
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
636656
name: Setup Matrix for Smoke Tests

0 commit comments

Comments
 (0)