IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-11 05:34:53 -05:00
Code Issues Packages Projects Releases Wiki Activity

CI: Use GCP keys in vault and not drone secrets (#72023)

Browse Source
This commit is contained in:
Kevin Minehart
2023-07-21 08:53:57 -05:00
committed by GitHub
parent f3235ba959
commit 16e2808b43
4 changed files with 63 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/drone/events/release.star
+7 -2
View File
@@ -51,7 +51,12 @@ load(
"scripts/drone/pipelines/test_backend.star",
"test_backend",
)
load("scripts/drone/vault.star", "from_secret", "prerelease_bucket")
load(
"scripts/drone/vault.star",
"from_secret",
"gcp_upload_artifacts_key",
"prerelease_bucket",
)
load(
"scripts/drone/utils/images.star",
"images",
@@ -87,7 +92,7 @@ def store_npm_packages_step():
"build-frontend-packages",
],
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_upload_artifacts_key),
"PRERELEASE_BUCKET": from_secret(prerelease_bucket),
},
"commands": ["./bin/build artifacts npm store --tag ${DRONE_TAG}"],
scripts/drone/steps/lib.star
+12 -9
View File
@@ -5,6 +5,9 @@ This module is a library of Drone steps and other pipeline components.
load(
"scripts/drone/vault.star",
"from_secret",
"gcp_grafanauploads",
"gcp_grafanauploads_base64",
"gcp_upload_artifacts_key",
"prerelease_bucket",
)
load(
@@ -330,7 +333,7 @@ def store_storybook_step(ver_mode, trigger = None):
] +
end_to_end_tests_deps(),
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_grafanauploads),
"PRERELEASE_BUCKET": from_secret(prerelease_bucket),
},
"commands": commands,
@@ -369,7 +372,7 @@ def e2e_tests_artifacts():
],
},
"environment": {
"GCP_GRAFANA_UPLOAD_ARTIFACTS_KEY": from_secret("gcp_upload_artifacts_key"),
"GCP_GRAFANA_UPLOAD_ARTIFACTS_KEY": from_secret(gcp_upload_artifacts_key),
"E2E_TEST_ARTIFACTS_BUCKET": "releng-pipeline-artifacts-dev",
"GITHUB_TOKEN": from_secret("github_token"),
},
@@ -407,7 +410,7 @@ def upload_cdn_step(ver_mode, trigger = None):
"grafana-server",
],
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_grafanauploads),
"PRERELEASE_BUCKET": from_secret(prerelease_bucket),
},
"commands": [
@@ -954,7 +957,7 @@ def build_docker_images_step(archs = None, ubuntu = False, publish = False):
cmd += " -archs {}".format(",".join(archs))
environment = {
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_grafanauploads),
}
return {
@@ -974,7 +977,7 @@ def fetch_images_step():
"name": "fetch-images",
"image": images["cloudsdk_image"],
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_grafanauploads),
"DOCKER_USER": from_secret("docker_username"),
"DOCKER_PASSWORD": from_secret("docker_password"),
},
@@ -1001,7 +1004,7 @@ def publish_images_step(ver_mode, docker_repo, trigger = None):
docker_repo = "grafana/{}".format(docker_repo)
environment = {
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_grafanauploads),
"DOCKER_USER": from_secret("docker_username"),
"DOCKER_PASSWORD": from_secret("docker_password"),
"GITHUB_APP_ID": from_secret("delivery-bot-app-id"),
@@ -1177,7 +1180,7 @@ def upload_packages_step(ver_mode, trigger = None):
"image": images["publish_image"],
"depends_on": end_to_end_tests_deps(),
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_grafanauploads_base64),
"PRERELEASE_BUCKET": from_secret("prerelease_bucket"),
},
"commands": [
@@ -1219,7 +1222,7 @@ def publish_grafanacom_step(ver_mode):
],
"environment": {
"GRAFANA_COM_API_KEY": from_secret("grafana_api_key"),
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_grafanauploads),
},
"commands": [
cmd,
@@ -1368,7 +1371,7 @@ def get_windows_steps(ver_mode, bucket = "%PRERELEASE_BUCKET%", edition = "oss")
"windows-init",
],
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"GCP_KEY": from_secret(gcp_grafanauploads_base64),
"PRERELEASE_BUCKET": from_secret(prerelease_bucket),
"GITHUB_TOKEN": from_secret("github_token"),
},
scripts/drone/vault.star
+4
View File
@@ -5,6 +5,8 @@ pull_secret = "dockerconfigjson"
drone_token = "drone_token"
prerelease_bucket = "prerelease_bucket"
gcp_upload_artifacts_key = "gcp_upload_artifacts_key"
gcp_grafanauploads = "gcp_grafanauploads"
gcp_grafanauploads_base64 = "gcp_grafanauploads_base64"
gcp_download_build_container_assets_key = "gcp_download_build_container_assets_key"
azure_sp_app_id = "azure_sp_app_id"
azure_sp_app_pw = "azure_sp_app_pw"
@@ -30,6 +32,8 @@ def vault_secret(name, path, key):
def secrets():
return [
vault_secret(gcp_grafanauploads, "infra/data/ci/grafana-release-eng/grafanauploads", "credentials.json"),
vault_secret(gcp_grafanauploads_base64, "infra/data/ci/grafana-release-eng/grafanauploads", "credentials_base64"),
vault_secret("grafana_api_key", "infra/data/ci/drone-plugins", "grafana_api_key"),
vault_secret(pull_secret, "secret/data/common/gcr", ".dockerconfigjson"),
vault_secret("github_token", "infra/data/ci/github/grafanabot", "pat"),