mirror of
https://github.com/grafana/grafana.git
synced 2024-12-01 13:09:22 -06:00
8379a5338c
* Add verify-starlark build action that returns an error for starlark files with lint Relies on `buildifier` tool. Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Add verify_starlark_step to PR pipeline Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Manually fetch buildifier in curl_image until a new build_image is created Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Format with buildifier Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Remove all unused variables retaining one unused function Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Use snake_case for variable Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Replace deprecated dictionary concatenation with .update() method Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Start adding docstrings for all modules and functions Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Prefer os.WriteFile as ioutil.WriteFile has been deprecated since go 1.16 Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Attempt to document the behavior of the init_enterprise_step Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document test_backend pipeline Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document enterprise_downstream_step Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document the pipeline utility function Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document publish_images_step Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document publish_images_steps Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document enterprise2_pipelines function Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Add tags table for Starlark files. Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document test_frontend Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document windows function Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Add docstrings to verifystarlark functions Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Refactor error handling to be more clear and document complex behavior Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Split errors into execution errors and verification errors Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document all other library functions Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Add local variables to TAGS Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Add blank line between all Args and Returns sections Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Fix new linting errors Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Lint new Starlark files Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Correct buildifier binary mv Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Document the need to set nofile ulimit to at least 2048 Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Update build-container to include buildifier Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Ensure buildifier binary is executable Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Fix valid content test Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Simply return execution error Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Only check files rather than fixing them Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Use updated build-container with executable buildifier Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Test that context cancellation stops execution Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Simplify error handling Return execution errors that short circuit WalkDir rather than separately tracking that error. Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Remove fetching of buildifier binary now that it is in the build-container Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Use build image in verify-starlark step Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Use semver tag The image is the same but uses a semver tag to make it clearer that this is a forward upgrade from the old version. Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * Use node 18 image with buildifier Signed-off-by: Jack Baldry <jack.baldry@grafana.com> --------- Signed-off-by: Jack Baldry <jack.baldry@grafana.com>
98 lines
3.0 KiB
Plaintext
98 lines
3.0 KiB
Plaintext
"""
|
|
This module returns functions for generating Drone secrets fetched from Vault.
|
|
"""
|
|
pull_secret = "dockerconfigjson"
|
|
drone_token = "drone_token"
|
|
prerelease_bucket = "prerelease_bucket"
|
|
gcp_upload_artifacts_key = "gcp_upload_artifacts_key"
|
|
azure_sp_app_id = "azure_sp_app_id"
|
|
azure_sp_app_pw = "azure_sp_app_pw"
|
|
azure_tenant = "azure_tenant"
|
|
|
|
def from_secret(secret):
|
|
return {"from_secret": secret}
|
|
|
|
def vault_secret(name, path, key):
|
|
return {
|
|
"kind": "secret",
|
|
"name": name,
|
|
"get": {
|
|
"path": path,
|
|
"name": key,
|
|
},
|
|
}
|
|
|
|
def secrets():
|
|
return [
|
|
vault_secret(pull_secret, "secret/data/common/gcr", ".dockerconfigjson"),
|
|
vault_secret("github_token", "infra/data/ci/github/grafanabot", "pat"),
|
|
vault_secret(drone_token, "infra/data/ci/drone", "machine-user-token"),
|
|
vault_secret(prerelease_bucket, "infra/data/ci/grafana/prerelease", "bucket"),
|
|
vault_secret(
|
|
gcp_upload_artifacts_key,
|
|
"infra/data/ci/grafana/releng/artifacts-uploader-service-account",
|
|
"credentials.json",
|
|
),
|
|
vault_secret(
|
|
azure_sp_app_id,
|
|
"infra/data/ci/datasources/cpp-azure-resourcemanager-credentials",
|
|
"application_id",
|
|
),
|
|
vault_secret(
|
|
azure_sp_app_pw,
|
|
"infra/data/ci/datasources/cpp-azure-resourcemanager-credentials",
|
|
"application_secret",
|
|
),
|
|
vault_secret(
|
|
azure_tenant,
|
|
"infra/data/ci/datasources/cpp-azure-resourcemanager-credentials",
|
|
"tenant_id",
|
|
),
|
|
# Package publishing
|
|
vault_secret(
|
|
"packages_gpg_public_key",
|
|
"infra/data/ci/packages-publish/gpg",
|
|
"public-key-b64",
|
|
),
|
|
vault_secret(
|
|
"packages_gpg_private_key",
|
|
"infra/data/ci/packages-publish/gpg",
|
|
"private-key-b64",
|
|
),
|
|
vault_secret(
|
|
"packages_gpg_passphrase",
|
|
"infra/data/ci/packages-publish/gpg",
|
|
"passphrase",
|
|
),
|
|
vault_secret(
|
|
"packages_service_account",
|
|
"infra/data/ci/packages-publish/service-account",
|
|
"credentials.json",
|
|
),
|
|
vault_secret(
|
|
"packages_access_key_id",
|
|
"infra/data/ci/packages-publish/bucket-credentials",
|
|
"AccessID",
|
|
),
|
|
vault_secret(
|
|
"packages_secret_access_key",
|
|
"infra/data/ci/packages-publish/bucket-credentials",
|
|
"Secret",
|
|
),
|
|
vault_secret(
|
|
"aws_region",
|
|
"secret/data/common/aws-marketplace",
|
|
"aws_region",
|
|
),
|
|
vault_secret(
|
|
"aws_access_key_id",
|
|
"secret/data/common/aws-marketplace",
|
|
"aws_access_key_id",
|
|
),
|
|
vault_secret(
|
|
"aws_secret_access_key",
|
|
"secret/data/common/aws-marketplace",
|
|
"aws_secret_access_key",
|
|
),
|
|
]
|