Skip to content

Update secrets to match those in Vault #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
viccuad wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update secrets to match those in Vault #75

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions cap-ci/pipeline.yaml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,8 +63,8 @@ resources:
type: s3
source:
bucket: {{ $config.s3.bucket }}
access_key_id: ((aws-access-key))
secret_access_key: ((aws-secret-key))
access_key_id: ((aws-capbot-access-key))
secret_access_key: ((aws-capbot-secret-key))
regexp: {{ $config.s3.regexp }}
region_name: {{ $config.s3.region }}

Expand All @@ -73,8 +73,8 @@ resources:
type: s3
source:
bucket: {{ $config.s3minibroker.bucket }}
access_key_id: ((aws-cf-user-suse-rd.access-key))
secret_access_key: ((aws-cf-user-suse-rd.secret-key))
access_key_id: ((aws-access-key))
Copy link
Member

@prabalsharma prabalsharma Nov 20, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This won't work as this bucket is in suse-rd account and not our account. Unless, minibroker CI has moved the s3 bucket.

Copy link
Member Author

@viccuad viccuad Nov 25, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There seems to be a mismatch between secret names in concourse.suse.de and concourse.suse.dev. One way to fix it was to do the change here and swap aws-access-key and aws-capbot-access-key values in concourse.suse.dev.

With the latest developments, seems we need to change the secrets layout in Vault so the Concourse instances can seamlessly pull them.

Copy link
Member

@prabalsharma prabalsharma Nov 26, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think its confusing to name rd account creds as aws-access-key/secret-key. In black box we have a liberty to add comments but we don't have the same in k8s secrets.
I am okay with using aws-capbot-access-key/secret-key, but for rd account I guess we should stick to aws-cf-user-suse-rd.access-key/secret-key, for clarity.
Also, we have this issue right now with rd account https://jira.suse.com/browse/CAP-1655

Copy link
Member Author

@viccuad viccuad Nov 27, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, the name is confusing, aws-cf-user-suse-rd.access-key/secret-key is a better name. But migrating all the pipelines and reflying them to consume it is not trivial (sometimes one has problems when flying some pipelines).
This would get solved automatically with cloudfoundry-incubator/kubecf#1607 or cloudfoundry-incubator/kubecf#1608, but maybe we just need to fix it apart from those cards.

Copy link
Member Author

@viccuad viccuad Dec 3, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These 2 latest commits (yet to be merged) may inform on what the secrets need to be:
https://github.com/SUSE/cloudfoundry/pull/213/commits/9a24ef5dc9578159a642d5febd2d23209b86c885
https://github.com/SUSE/cloudfoundry/pull/213/commits/e12187619fe028a8d4822c8c60640c572797796b

secret_access_key: ((aws-secret-key))
regexp: {{ $config.s3minibroker.regexp }}
region_name: {{ $config.s3minibroker.region }}

Expand All @@ -90,8 +90,8 @@ resources:
type: s3
source:
bucket: kubecf-klog
access_key_id: ((aws-access-key))
secret_access_key: ((aws-secret-key))
access_key_id: ((aws-capbot-access-key))
secret_access_key: ((aws-capbot-secret-key))
regexp: klog-(.*)\.tar\.gz$
region_name: us-west-2
endpoint: null
Expand Down