Skip to content

Commit

Permalink
feat(secrets): begin migration to secret manager from keystore (#587)
Browse files Browse the repository at this point in the history
  • Loading branch information
bcoe authored Jun 8, 2020
1 parent 9c2913e commit 1c92077
Show file tree
Hide file tree
Showing 4 changed files with 37 additions and 8 deletions.
32 changes: 32 additions & 0 deletions synthtool/gcp/templates/node_library/.kokoro/populate-secrets.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
#!/bin/bash
# Copyright 2020 Google LLC.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -eo pipefail

# Populates requested secrets set in SECRET_MANAGER_KEYS from service account:
# kokoro-trampoline@cloud-devrel-kokoro-resources.iam.gserviceaccount.com
SECRET_LOCATION="${KOKORO_GFILE_DIR}/secret_manager"
mkdir -p ${SECRET_LOCATION}
for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g")
do
docker run --entrypoint=gcloud \
--volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
gcr.io/google.com/cloudsdktool/cloud-sdk \
secrets versions access latest \
--credential-file-override=${KOKORO_GFILE_DIR}/kokoro-trampoline.service-account.json \
--project cloud-devrel-kokoro-resources \
--secret $key > \
"$SECRET_LOCATION/$key"
done
2 changes: 1 addition & 1 deletion synthtool/gcp/templates/node_library/.kokoro/publish.sh
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ python3 -m releasetool publish-reporter-script > /tmp/publisher-script; source /

cd $(dirname $0)/..

NPM_TOKEN=$(cat $KOKORO_KEYSTORE_DIR/73713_{{ publish_token }})
NPM_TOKEN=$(cat $KOKORO_GFILE_DIR/secret_manager/npm_publish_token
echo "//wombat-dressing-room.appspot.com/:_authToken=${NPM_TOKEN}" > ~/.npmrc
npm install
Expand Down
10 changes: 3 additions & 7 deletions synthtool/gcp/templates/node_library/.kokoro/release/publish.cfg
Original file line number Diff line number Diff line change
Expand Up @@ -47,13 +47,9 @@ before_action {
}
}

before_action {
fetch_keystore {
keystore_resource {
keystore_config_id: 73713
keyname: "{{ publish_token }}"
}
}
env_vars: {
key: "SECRET_MANAGER_KEYS"
value: "npm_publish_token"
}

# Download trampoline resources.
Expand Down
1 change: 1 addition & 0 deletions synthtool/gcp/templates/node_library/.kokoro/trampoline.sh
Original file line number Diff line number Diff line change
Expand Up @@ -24,4 +24,5 @@ function cleanup() {
}
trap cleanup EXIT

$(dirname $0)/populate-secrets.sh # Secret Manager secrets.
python3 "${KOKORO_GFILE_DIR}/trampoline_v1.py"

0 comments on commit 1c92077

Please sign in to comment.