From d1addcdf80aa9ddef8c932c89c919024bbad7af3 Mon Sep 17 00:00:00 2001 From: Jeff Ching Date: Mon, 15 Jun 2020 11:45:21 -0700 Subject: [PATCH] ci(java): switch to secret manager from keystore (#625) * ci(java): switch to secret manager from keystore, use java-docs-samples user for samples tests * fix: we don't need to supply a service account --- .../templates/java_library/.kokoro/build.sh | 2 +- .../java_library/.kokoro/nightly/samples.cfg | 16 +++---- .../java_library/.kokoro/populate-secrets.sh | 43 +++++++++++++++++++ .../.kokoro/presubmit/samples.cfg | 14 +++--- .../java_library/.kokoro/trampoline.sh | 2 + 5 files changed, 57 insertions(+), 20 deletions(-) create mode 100755 synthtool/gcp/templates/java_library/.kokoro/populate-secrets.sh diff --git a/synthtool/gcp/templates/java_library/.kokoro/build.sh b/synthtool/gcp/templates/java_library/.kokoro/build.sh index baeb40abc..d74ecb10c 100755 --- a/synthtool/gcp/templates/java_library/.kokoro/build.sh +++ b/synthtool/gcp/templates/java_library/.kokoro/build.sh @@ -39,7 +39,7 @@ retry_with_backoff 3 10 \ # if GOOGLE_APPLICATION_CREDIENTIALS is specified as a relative path prepend Kokoro root directory onto it if [[ ! -z "${GOOGLE_APPLICATION_CREDENTIALS}" && "${GOOGLE_APPLICATION_CREDENTIALS}" != /* ]]; then - export GOOGLE_APPLICATION_CREDENTIALS=$(realpath ${KOKORO_ROOT}/src/${GOOGLE_APPLICATION_CREDENTIALS}) + export GOOGLE_APPLICATION_CREDENTIALS=$(realpath ${KOKORO_GFILE_DIR}/${GOOGLE_APPLICATION_CREDENTIALS}) fi RETURN_CODE=0 diff --git a/synthtool/gcp/templates/java_library/.kokoro/nightly/samples.cfg b/synthtool/gcp/templates/java_library/.kokoro/nightly/samples.cfg index 20aabd55d..03434c9e0 100644 --- a/synthtool/gcp/templates/java_library/.kokoro/nightly/samples.cfg +++ b/synthtool/gcp/templates/java_library/.kokoro/nightly/samples.cfg @@ -24,19 +24,15 @@ env_vars: { env_vars: { key: "GOOGLE_APPLICATION_CREDENTIALS" - value: "keystore/73713_java_it_service_account" + value: "secret_manager/java-docs-samples-service-account" } +env_vars: { + key: "SECRET_MANAGER_KEYS" + value: "java-docs-samples-service-account" +} + env_vars: { key: "ENABLE_BUILD_COP" value: "true" } - -before_action { - fetch_keystore { - keystore_resource { - keystore_config_id: 73713 - keyname: "java_it_service_account" - } - } -} diff --git a/synthtool/gcp/templates/java_library/.kokoro/populate-secrets.sh b/synthtool/gcp/templates/java_library/.kokoro/populate-secrets.sh new file mode 100755 index 000000000..f52514257 --- /dev/null +++ b/synthtool/gcp/templates/java_library/.kokoro/populate-secrets.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# Copyright 2020 Google LLC. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -eo pipefail + +function now { date +"%Y-%m-%d %H:%M:%S" | tr -d '\n' ;} +function msg { println "$*" >&2 ;} +function println { printf '%s\n' "$(now) $*" ;} + + +# Populates requested secrets set in SECRET_MANAGER_KEYS from service account: +# kokoro-trampoline@cloud-devrel-kokoro-resources.iam.gserviceaccount.com +SECRET_LOCATION="${KOKORO_GFILE_DIR}/secret_manager" +msg "Creating folder on disk for secrets: ${SECRET_LOCATION}" +mkdir -p ${SECRET_LOCATION} +for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g") +do + msg "Retrieving secret ${key}" + docker run --entrypoint=gcloud \ + --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \ + gcr.io/google.com/cloudsdktool/cloud-sdk \ + secrets versions access latest \ + --project cloud-devrel-kokoro-resources \ + --secret ${key} > \ + "${SECRET_LOCATION}/${key}" + if [[ $? == 0 ]]; then + msg "Secret written to ${SECRET_LOCATION}/${key}" + else + msg "Error retrieving secret ${key}" + fi +done diff --git a/synthtool/gcp/templates/java_library/.kokoro/presubmit/samples.cfg b/synthtool/gcp/templates/java_library/.kokoro/presubmit/samples.cfg index 1171aead0..f502ddf1d 100644 --- a/synthtool/gcp/templates/java_library/.kokoro/presubmit/samples.cfg +++ b/synthtool/gcp/templates/java_library/.kokoro/presubmit/samples.cfg @@ -24,14 +24,10 @@ env_vars: { env_vars: { key: "GOOGLE_APPLICATION_CREDENTIALS" - value: "keystore/73713_java_it_service_account" + value: "secret_manager/java-docs-samples-service-account" } -before_action { - fetch_keystore { - keystore_resource { - keystore_config_id: 73713 - keyname: "java_it_service_account" - } - } -} +env_vars: { + key: "SECRET_MANAGER_KEYS" + value: "java-docs-samples-service-account" +} \ No newline at end of file diff --git a/synthtool/gcp/templates/java_library/.kokoro/trampoline.sh b/synthtool/gcp/templates/java_library/.kokoro/trampoline.sh index ba17ce014..9da0f8398 100644 --- a/synthtool/gcp/templates/java_library/.kokoro/trampoline.sh +++ b/synthtool/gcp/templates/java_library/.kokoro/trampoline.sh @@ -21,4 +21,6 @@ function cleanup() { echo "cleanup"; } trap cleanup EXIT + +$(dirname $0)/populate-secrets.sh # Secret Manager secrets. python3 "${KOKORO_GFILE_DIR}/trampoline_v1.py"