Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci(release): use new set of credentials for GPG and Maven Central #222

Merged
merged 6 commits into from
Jan 16, 2024
Merged

ci(release): use new set of credentials for GPG and Maven Central #222

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
5a5fbf2
ci(release): use new set of credentials for GPG and Maven Central
v1v Jan 15, 2024
640c696
docs
v1v Jan 15, 2024
27778b4
Update .buildkite/hooks/pre-command
v1v Jan 15, 2024
b240dd0
use vault kv get
v1v Jan 16, 2024
052c853
use vault kv get
v1v Jan 16, 2024
ce879eb
use the right vault secret path
v1v Jan 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .buildkite/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# Buildkite
This README overviews the Buildkite pipelines that automate the build and publishing processes.

## Release pipeline

The Buildkite pipeline for the ECS Logging Java is responsible for the releases.

### Pipeline Configuration

To view the pipeline and its configuration, click [here](https://buildkite.com/elastic/ecs-logging-java-release) or
go to the definition in the `elastic/ci` repository.

### Credentials

The release team provides the credentials required to publish the artifacts in Maven Central and sign them
with the GPG.

If further details are needed, please go to [pre-command](hooks/pre-command).

## Snapshot pipeline

The Buildkite pipeline for the APM Agent Java is responsible for the snapshots.

### Pipeline Configuration

To view the pipeline and its configuration, click [here](https://buildkite.com/elastic/ecs-logging-java-snapshot) or
go to the definition in the `elastic/ci` repository.
33 changes: 10 additions & 23 deletions .buildkite/hooks/pre-command
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,21 +8,6 @@

set -eo pipefail

echo "--- Prepare vault context :vault:"
VAULT_ROLE_ID_SECRET=$(vault read -field=role-id secret/ci/elastic-ecs-logging-java/internal-ci-approle)
export VAULT_ROLE_ID_SECRET

VAULT_SECRET_ID_SECRET=$(vault read -field=secret-id secret/ci/elastic-ecs-logging-java/internal-ci-approle)
export VAULT_SECRET_ID_SECRET

VAULT_ADDR=$(vault read -field=vault-url secret/ci/elastic-ecs-logging-java/internal-ci-approle)
export VAULT_ADDR

# Delete the vault specific accessing the ci vault
PREVIOUS_VAULT_TOKEN=$VAULT_TOKEN
export PREVIOUS_VAULT_TOKEN
unset VAULT_TOKEN

echo "--- Prepare a secure temp :closed_lock_with_key:"
# Prepare a secure temp folder not shared between other jobs to store the key ring
export TMP_WORKSPACE=/tmp/secured
Expand All @@ -34,20 +19,22 @@ mkdir -p $GNUPGHOME
chmod -R 700 $TMP_WORKSPACE

echo "--- Prepare keys context :key:"
VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID_SECRET" secret_id="$VAULT_SECRET_ID_SECRET")
export VAULT_TOKEN

# Nexus credentials
SERVER_USERNAME=$(vault read -field username secret/release/nexus)
NEXUS_SECRET=kv/ci-shared/release-eng/team-release-secrets/ecs-logging/maven_central
SERVER_USERNAME=$(vault read -field username $NEXUS_SECRET)
v1v marked this conversation as resolved.
Show resolved Hide resolved
export SERVER_USERNAME
SERVER_PASSWORD=$(vault read -field password secret/release/nexus)
SERVER_PASSWORD=$(vault read -field password $NEXUS_SECRET)
v1v marked this conversation as resolved.
Show resolved Hide resolved
export SERVER_PASSWORD

# Signing keys
vault read -field=key secret/release/signing >$KEY_FILE
KEYPASS_SECRET=$(vault read -field=passphrase secret/release/signing)
GPG_SECRET=kv/data/ci-shared/release-eng/team-release-secrets/ecs-logging/gpg
v1v marked this conversation as resolved.
Show resolved Hide resolved
vault read -field="keyring" $GPG_SECRET | base64 -d > $KEY_FILE
v1v marked this conversation as resolved.
Show resolved Hide resolved
## NOTE: passphase is the name of the field.
v1v marked this conversation as resolved.
Show resolved Hide resolved
KEYPASS_SECRET=$(vault read -field="passphase" $GPG_SECRET)
v1v marked this conversation as resolved.
Show resolved Hide resolved
export KEYPASS_SECRET
export KEY_ID_SECRET=D88E42B4
KEY_ID=$(vault kv get --field="key_id" $GPG_SECRET)
v1v marked this conversation as resolved.
Show resolved Hide resolved
KEY_ID_SECRET=${KEY_ID: -8}
export KEY_ID_SECRET

# Import the key into the keyring
echo "$KEYPASS_SECRET" | gpg --batch --import "$KEY_FILE"
Expand Down
Loading