Skip to content

Commit

Permalink
ci(java): switch to secret manager from keystore (#625)
Browse files Browse the repository at this point in the history
* ci(java): switch to secret manager from keystore, use java-docs-samples user for samples tests

* fix: we don't need to supply a service account
  • Loading branch information
chingor13 authored Jun 15, 2020
1 parent a0ee80e commit d1addcd
Show file tree
Hide file tree
Showing 5 changed files with 57 additions and 20 deletions.
2 changes: 1 addition & 1 deletion synthtool/gcp/templates/java_library/.kokoro/build.sh
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ retry_with_backoff 3 10 \

# if GOOGLE_APPLICATION_CREDIENTIALS is specified as a relative path prepend Kokoro root directory onto it
if [[ ! -z "${GOOGLE_APPLICATION_CREDENTIALS}" && "${GOOGLE_APPLICATION_CREDENTIALS}" != /* ]]; then
export GOOGLE_APPLICATION_CREDENTIALS=$(realpath ${KOKORO_ROOT}/src/${GOOGLE_APPLICATION_CREDENTIALS})
export GOOGLE_APPLICATION_CREDENTIALS=$(realpath ${KOKORO_GFILE_DIR}/${GOOGLE_APPLICATION_CREDENTIALS})
fi

RETURN_CODE=0
Expand Down
16 changes: 6 additions & 10 deletions synthtool/gcp/templates/java_library/.kokoro/nightly/samples.cfg
Original file line number Diff line number Diff line change
Expand Up @@ -24,19 +24,15 @@ env_vars: {

env_vars: {
key: "GOOGLE_APPLICATION_CREDENTIALS"
value: "keystore/73713_java_it_service_account"
value: "secret_manager/java-docs-samples-service-account"
}

env_vars: {
 key: "SECRET_MANAGER_KEYS"
 value: "java-docs-samples-service-account"
}

env_vars: {
key: "ENABLE_BUILD_COP"
value: "true"
}

before_action {
fetch_keystore {
keystore_resource {
keystore_config_id: 73713
keyname: "java_it_service_account"
}
}
}
43 changes: 43 additions & 0 deletions synthtool/gcp/templates/java_library/.kokoro/populate-secrets.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
#!/bin/bash
# Copyright 2020 Google LLC.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -eo pipefail

function now { date +"%Y-%m-%d %H:%M:%S" | tr -d '\n' ;}
function msg { println "$*" >&2 ;}
function println { printf '%s\n' "$(now) $*" ;}


# Populates requested secrets set in SECRET_MANAGER_KEYS from service account:
# kokoro-trampoline@cloud-devrel-kokoro-resources.iam.gserviceaccount.com
SECRET_LOCATION="${KOKORO_GFILE_DIR}/secret_manager"
msg "Creating folder on disk for secrets: ${SECRET_LOCATION}"
mkdir -p ${SECRET_LOCATION}
for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g")
do
msg "Retrieving secret ${key}"
docker run --entrypoint=gcloud \
--volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
gcr.io/google.com/cloudsdktool/cloud-sdk \
secrets versions access latest \
--project cloud-devrel-kokoro-resources \
--secret ${key} > \
"${SECRET_LOCATION}/${key}"
if [[ $? == 0 ]]; then
msg "Secret written to ${SECRET_LOCATION}/${key}"
else
msg "Error retrieving secret ${key}"
fi
done
Original file line number Diff line number Diff line change
Expand Up @@ -24,14 +24,10 @@ env_vars: {

env_vars: {
key: "GOOGLE_APPLICATION_CREDENTIALS"
value: "keystore/73713_java_it_service_account"
value: "secret_manager/java-docs-samples-service-account"
}

before_action {
fetch_keystore {
keystore_resource {
keystore_config_id: 73713
keyname: "java_it_service_account"
}
}
}
env_vars: {
 key: "SECRET_MANAGER_KEYS"
 value: "java-docs-samples-service-account"
}
2 changes: 2 additions & 0 deletions synthtool/gcp/templates/java_library/.kokoro/trampoline.sh
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,6 @@ function cleanup() {
echo "cleanup";
}
trap cleanup EXIT

$(dirname $0)/populate-secrets.sh # Secret Manager secrets.
python3 "${KOKORO_GFILE_DIR}/trampoline_v1.py"

0 comments on commit d1addcd

Please sign in to comment.