8000 Remove secrets encoding (#1439) · nginx/kubernetes-ingress@8da56ff · GitHub
[go: up one dir, main page]
Skip to content

Commit 8da56ff

Browse files
lucacomelucacome
authored
Remove secrets encoding (#1439)
1 parent 8a0f654 commit 8da56ff

File tree

7 files changed

+42
-100
lines changed

7 files changed

+42
-100
lines changed

‎.github/workflows/release.yml‎

Lines changed: 21 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -154,24 +154,6 @@ jobs:
154154
with:
155155
path: ${{ github.workspace }}/nginx-ingress
156156
key: nginx-ingress-${{ github.run_id }}-${{ github.run_number }}
157-
- name: Fetch N+ Certificates
158-
env:
159-
CRT: ${{ secrets.NGINX_CRT }}
160-
KEY: ${{ secrets.NGINX_KEY }}
161-
run: |
162-
echo "${CRT}" | base64 --decode > nginx-repo.crt
163-
echo "${KEY}" | base64 --decode > nginx-repo.key
164-
if: matrix.type == 'plus'
165-
- name: Fetch N+ AppProtect Certificates
166-
env:
167-
CRT: ${{ secrets.NGINX_AP_CRT }}
168-
KEY: ${{ secrets.NGINX_AP_KEY }}
169-
RHEL_LICENSE: ${{ secrets.RHEL_LICENSE }}
170-
run: |
171-
echo "${CRT}" | base64 --decode > nginx-repo.crt
172-
echo "${KEY}" | base64 --decode > nginx-repo.key
173-
echo "${RHEL_LICENSE}" | base64 --decode > rhel_license
174-
if: matrix.type == 'plus-ap' || matrix.type == 'plus-ap-openshift'
175157
- name: Docker Buildx
176158
uses: docker/setup-buildx-action@v1
177159
with:
@@ -203,8 +185,8 @@ jobs:
203185
target: ${{ matrix.target }}
204186
tags: ${{ env.DOCKER_IMAGE }}:${{ needs.binary.outputs.version }}
205187
secrets: |
206-
nginx-repo.crt=${{ secrets.NGINX_CRT }}
207-
nginx-repo.key=${{ secrets.NGINX_KEY }}
188+
"nginx-repo.crt=${{ secrets.KIC_NGINX_CRT }}"
189+
"nginx-repo.key=${{ secrets.KIC_NGINX_KEY }}"
208190
if: matrix.type == 'plus'
209191
- name: Build AP Docker Image ${{ matrix.image }}
210192
uses: docker/build-push-action@v2
@@ -216,9 +198,9 @@ jobs:
216198
target: ${{ matrix.target }}
217199
tags: ${{ env.DOCKER_IMAGE }}:${{ needs.binary.outputs.version }}
218200
secrets: |
219-
nginx-repo.crt=${{ secrets.NGINX_AP_CRT }}
220-
nginx-repo.key=${{ secrets.NGINX_AP_KEY }}
221-
rhel_license=${{ secrets.RHEL_LICENSE }}
201+
"nginx-repo.crt=${{ secrets.KIC_NGINX_AP_CRT }}"
202+
"nginx-repo.key=${{ secrets.KIC_NGINX_AP_KEY }}"
203+
"rhel_license=${{ secrets.KIC_RHEL_LICENSE }}"
222204
if: matrix.type == 'plus-ap' || matrix.type == 'plus-ap-openshift'
223205

224206
smoke-tests:
@@ -344,22 +326,6 @@ jobs:
344326
with:
345327
path: ${{ github.workspace }}/nginx-ingress
346328
key: nginx-ingress-${{ github.run_id }}-${{ github.run_number }}
347-
- name: Fetch N+ Certificates
348-
env:
349-
CRT: ${{ secrets.NGINX_CRT }}
350-
KEY: ${{ secrets.NGINX_KEY }}
351-
run: |
352-
echo "${CRT}" | base64 --decode > nginx-repo.crt
353-
echo "${KEY}" | base64 --decode > nginx-repo.key
354-
if: matrix.type == 'plus'
355-
- name: Fetch N+ AppProtect Certificates
356-
env:
357-
CRT: ${{ secrets.NGINX_AP_CRT }}
358-
KEY: ${{ secrets.NGINX_AP_KEY }}
359-
run: |
360-
echo "${CRT}" | base64 --decode > nginx-repo.crt
361-
echo "${KEY}" | base64 --decode > nginx-repo.key
362-
if: matrix.type == 'plus-ap'
363329
- name: Docker Buildx
364330
uses: docker/setup-buildx-action@v1
365331
with:
@@ -393,8 +359,8 @@ jobs:
393359
tags: ${{ matrix.image }}:${{ matrix.tag }}
394360
load: true
395361
secrets: |
396-
nginx-repo.crt=${{ secrets.NGINX_CRT }}
397-
nginx-repo.key=${{ secrets.NGINX_KEY }}
362+
"nginx-repo.crt=${{ secrets.KIC_NGINX_CRT }}"
363+
"nginx-repo.key=${{ secrets.KIC_NGINX_KEY }}"
398364
if: matrix.type == 'plus'
399365
- name: Build AP Docker Image ${{ matrix.image }}
400366
uses: docker/build-push-action@v2
@@ -407,8 +373,8 @@ jobs:
407373
tags: ${{ matrix.image }}:${{ matrix.tag }}
408374
load: true
409375
secrets: |
410-
nginx-repo.crt=${{ secrets.NGINX_AP_CRT }}
411-
nginx-repo.key=${{ secrets.NGINX_AP_KEY }}
376+
"nginx-repo.crt=${{ secrets.KIC_NGINX_AP_CRT }}"
377+
"nginx-repo.key=${{ secrets.KIC_NGINX_AP_KEY }}"
412378
if: matrix.type == 'plus-ap'
413379
- name: Build Test-Runner Container
414380
uses: docker/build-push-action@v2
@@ -468,8 +434,8 @@ jobs:
468434
name: Helm Tests
469435
runs-on: ${{ matrix.os }}
470436
needs: [build, binary, unit-tests]
471-
if:
472-
github.event_name == 'push' && contains(github.ref, 'release') ||
437+
if:
438+
github.event_name == 'push' && contains(github.ref, 'release') ||
473439
github.event_name == 'schedule'
474440
env:
475441
NGINX_HTTP_PORT: 8080
@@ -498,14 +464,6 @@ jobs:
498464
with:
499465
path: ${{ github.workspace }}/nginx-ingress
500466
key: nginx-ingress-${{ github.run_id }}-${{ github.run_number }}
501-
- name: Fetch N+ Certificates
502-
env:
503-
CRT: ${{ secrets.NGINX_CRT }}
504-
KEY: ${{ secrets.NGINX_KEY }}
505-
run: |
506-
echo "${CRT}" | base64 --decode > nginx-repo.crt
507-
echo "${KEY}" | base64 --decode > nginx-repo.key
508-
if: matrix.type == 'plus'
509467
- name: Docker Buildx
510468
uses: docker/setup-buildx-action@v1
511469
with:
@@ -528,8 +486,8 @@ jobs:
528486
tags: ${{ matrix.image }}:${{ matrix.tag }}
529487
load: true
530488
secrets: |
531-
nginx-repo.crt=${{ secrets.NGINX_CRT }}
532-
nginx-repo.key=${{ secrets.NGINX_KEY }}
489+
"nginx-repo.crt=${{ secrets.KIC_NGINX_CRT }}"
490+
"nginx-repo.key=${{ secrets.KIC_NGINX_KEY }}"
533491
- name: Deploy Kubernetes
534492
id: k8s
535493
run: |
@@ -617,7 +575,7 @@ jobs:
617575
restore-keys: |
618576
${{ runner.os }}-buildx-
619577
- name: DockerHub Login
620-
uses: docker/login-action@v1
578+
uses: docker/login-action@v1
621579
with:
622580
username: ${{ secrets.DOCKER_USERNAME }}
623581
password: ${{ secrets.DOCKER_PASSWORD }}
@@ -696,8 +654,8 @@ jobs:
696654
tags: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/${{ matrix.tags }}
697655
push: true
698656
secrets: |
699-
nginx-repo.crt=${{ secrets.NGINX_CRT }}
700-
nginx-repo.key=${{ secrets.NGINX_KEY }}
657+
"nginx-repo.crt=${{ secrets.KIC_NGINX_CRT }}"
658+
"nginx-repo.key=${{ secrets.KIC_NGINX_KEY }}"
701659
if: matrix.image == 'nginx-plus-ingress'
702660
- name: Push Plus AP to GCR
703661
uses: docker/build-push-action@v2
@@ -710,19 +668,19 @@ jobs:
710668
tags: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/${{ matrix.tags }}
711669
push: true
712670
secrets: |
713-
nginx-repo.crt=${{ secrets.NGINX_AP_CRT }}
714-
nginx-repo.key=${{ secrets.NGINX_AP_KEY }}
715-
rhel_license=${{ secrets.RHEL_LICENSE }}
671+
"nginx-repo.crt=${{ secrets.KIC_NGINX_AP_CRT }}"
672+
"nginx-repo.key=${{ secrets.KIC_NGINX_AP_KEY }}"
673+
"rhel_license=${{ secrets.KIC_RHEL_LICENSE }}"
716674
if: matrix.image == 'nginx-plus-ingress-ap'
717-
675+
718676
release-plus-docker:
719677
name: Release Plus Images
720678
runs-on: ubuntu-18.04
721679
needs: [build, binary, unit-tests, publish-plus-docker]
722680
if: github.event_name == 'create' && contains(github.ref, 'refs/tags/')
723681
steps:
724682
- name: GCR Login
725-
uses: docker/login-action@v1
683+
uses: docker/login-action@v1
726684
with:
727685
registry: gcr.io
728686
username: _json_key

‎Makefile‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ lint:
2222

2323
test:
2424
ifneq ($(BUILD_IN_CONTAINER),1)
25+
@go version || (code=$$?; printf "\033[0;31mError\033[0m: unable to build locally, try using the parameter BUILD_IN_CONTAINER=1\n"; exit $$code)
2526
GO111MODULE=on GOFLAGS='$(GOFLAGS)' go test ./...
2627
endif
2728

@@ -50,16 +51,16 @@ ifneq ($(BUILD_IN_CONTAINER),1)
5051
CGO_ENABLED=0 GO111MODULE=on GOFLAGS='$(GOFLAGS)' GOOS=linux go build -installsuffix cgo -ldflags "-w -X main.version=${VERSION} -X main.gitCommit=${GIT_COMMIT}" -o nginx-ingress github.com/nginxinc/kubernetes-ingress/cmd/nginx-ingress
5152
endif
5253

53-
prepare-license-secrets:
54-
ifneq (,$$(findstring PlusForOpenShift,$$(DOCKERFILE)))
55-
mkdir -p tempdir && base64 nginx-repo.crt > tempdir/nginx-repo.crt && base64 nginx-repo.key > tempdir/nginx-repo.key && base64 rhel_license > tempdir/rhel_license
56-
override DOCKER_BUILD_OPTIONS += --secret id=nginx-repo.crt,src=tempdir/nginx-repo.crt --secret id=nginx-repo.key,src=tempdir/nginx-repo.key --secret id=rhel_license,src=tempdir/rhel_license
57-
else ifneq (,$$(findstring Plus,$$(DOCKERFILE)))
58-
mkdir -p tempdir && base64 nginx-repo.crt > tempdir/nginx-repo.crt && base64 nginx-repo.key > tempdir/nginx-repo.key
59-
override DOCKER_BUILD_OPTIONS += --secret id=nginx-repo.crt,src=tempdir/nginx-repo.crt --secret id=nginx-repo.key,src=tempdir/nginx-repo.key
54+
prepare-options-secrets:
55+
ifneq (,$(findstring Plus,$(DOCKERFILE)))
56+
override DOCKER_BUILD_OPTIONS += --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key
57+
endif
58+
ifneq (,$(findstring PlusForOpenShift,$(DOCKERFILE)))
59+
override DOCKER_BUILD_OPTIONS += --secret id=rhel_license,src=rhel_license
6060
endif
6161

62-
container: test verify-codegen update-crds binary certificate-and-key prepare-license-secrets
62+
container: test verify-codegen update-crds binary certificate-and-key prepare-options-secrets
63+
@docker -v || (code=$$?; printf "\033[0;31mError\033[0m: there was a problem with Docker\n"; exit $$code)
6364
ifeq ($(BUILD_IN_CONTAINER),1)
6465
docker build $(DOCKER_BUILD_OPTIONS) --build-arg IC_VERSION=$(VERSION)-$(GIT_COMMIT) --build-arg GIT_COMMIT=$(GIT_COMMIT) --build-arg VERSION=$(VERSION) --build-arg GOLANG_CONTAINER=$(GOLANG_CONTAINER) --target container -f $(DOCKERFILEPATH)/$(DOCKERFILE) -t $(PREFIX):$(TAG) .
6566
else
@@ -75,4 +76,3 @@ endif
7576

7677
clean:
7778
rm -f nginx-ingress
78-
rm -rf tempdir

‎build/DockerfileForPlus‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,9 @@ ARG IC_VERSION
1111

1212
# Download certificate and key from the customer portal (https://cs.nginx.com)
1313
# and install NGINX Plus
14-
RUN --mount=type=secret,id=nginx-repo.crt \
15-
--mount=type=secret,id=nginx-repo.key \
14+
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
15+
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
1616
set -x \
17-
&& mkdir -p /etc/ssl/nginx && base64 --decode /run/secrets/nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt \
18-
&& base64 --decode /run/secrets/nginx-repo.key > /etc/ssl/nginx/nginx-repo.key \
1917
&& apt-get update \
2018
&& apt-get install --no-install-recommends --no-install-suggests -y apt-transport-https ca-certificates gnupg1 libcap2-bin \
2119
&& \
@@ -42,7 +40,6 @@ RUN --mount=type=secret,id=nginx-repo.crt \
4240
'cap_net_bind_service=+ep' /usr/sbin/nginx-debug \
4341
&& apt-get remove --purge --auto-remove -y gnupg1 \
4442
&& rm -rf /var/lib/apt/lists/* \
45-
&& rm -rf /etc/ssl/nginx \
4643
&& rm /etc/apt/apt.conf.d/90nginx /etc/apt/sources.list.d/nginx-plus.list
4744

4845

‎build/DockerfileWithOpentracingForPlus‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,9 @@ ARG IC_VERSION
2121

2222
# Download certificate and key from the customer portal (https://cs.nginx.com)
2323
# and install NGINX Plus
24-
RUN --mount=type=secret,id=nginx-repo.crt \
25-
--mount=type=secret,id=nginx-repo.key \
24+
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
25+
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
2626
set -x \
27-
&& mkdir -p /etc/ssl/nginx && base64 --decode /run/secrets/nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt \
28-
&& base64 --decode /run/secrets/nginx-repo.key > /etc/ssl/nginx/nginx-repo.key \
2927
&& apt-get update \
3028
&& apt-get install --no-install-recommends --no-install-suggests -y apt-transport-https ca-certificates gnupg1 libcap2-bin \
3129
&& \
@@ -55,7 +53,6 @@ RUN --mount=type=secret,id=nginx-repo.crt \
5553
'cap_net_bind_service=+ep' /usr/sbin/nginx-debug \
5654
&& apt-get remove --purge --auto-remove -y gnupg1 \
5755
&& rm -rf /var/lib/apt/lists/* \
58-
&& rm -rf /etc/ssl/nginx \
5956
&& rm /etc/apt/apt.conf.d/90nginx /etc/apt/sources.list.d/nginx-plus.list
6057

6158

‎build/appprotect/DockerfileWithAppProtectForPlus‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,9 @@ ARG IC_VERSION
1818

1919
# Download certificate and key from the customer portal (https://cs.nginx.com)
2020
# and install NGINX Plus
21-
RUN --mount=type=secret,id=nginx-repo.crt \
22-
--mount=type=secret,id=nginx-repo.key \
21+
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
22+
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
2323
set -x \
24-
&& mkdir -p /etc/ssl/nginx && base64 --decode /run/secrets/nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt \
25-
&& base64 --decode /run/secrets/nginx-repo.key > /etc/ssl/nginx/nginx-repo.key \
2624
&& apt-get update \
2725
&& apt-get install --no-install-recommends --no-install-suggests -y apt-transport-https ca-certificates gnupg1 libcap2-bin wget \
2826
&& \
@@ -62,7 +60,6 @@ RUN --mount=type=secret,id=nginx-repo.crt \
6260
'cap_net_bind_service=+ep' /usr/sbin/nginx-debug \
6361
&& apt-get remove --purge --auto-remove -y gnupg1 wget\
6462
&& rm -rf /var/lib/apt/lists/* \
65-
&& rm -rf /etc/ssl/nginx \
6663
&& rm /etc/apt/apt.conf.d/90nginx /etc/apt/sources.list.d/nginx-plus.list \
6764
&& rm /etc/apt/apt.conf.d/90app-protect-sigs /etc/apt/sources.list.d/app-protect-sigs.list
6865

‎build/appprotect/DockerfileWithAppProtectForPlusForOpenShift‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,10 @@ ARG IC_VERSION
2121

2222
# Download certificate and key from the customer portal (https://cs.nginx.com)
2323
# and install NGINX Plus
24-
RUN --mount=type=secret,id=nginx-repo.crt \
25-
--mount=type=secret,id=nginx-repo.key \
26-
--mount=type=secret,id=rhel_license \
24+
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
25+
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
26+
--mount=type=secret,id=rhel_license,dst=/tmp/rhel_license,mode=0644 \
2727
set -x \
28-
&& mkdir -p /etc/ssl/nginx && base64 --decode /run/secrets/nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt \
29-
&& base64 --decode /run/secrets/nginx-repo.key > /etc/ssl/nginx/nginx-repo.key \
30-
&& base64 --decode /run/secrets/rhel_license > /tmp/rhel_license \
3128
&& groupadd --system --gid 101 nginx \
3229
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
3330
&& source /tmp/rhel_license \
@@ -63,7 +60,6 @@ RUN --mount=type=secret,id=nginx-repo.crt \
6360
&& setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx \
6461
'cap_net_bind_service=+ep' /usr/sbin/nginx-debug \
6562
&& yum remove -y wget \
66-
&& rm -rf /etc/ssl/nginx \
6763
&& rm /etc/yum.repos.d/nginx-plus-7.repo \
6864
&& rm nginx_signing.key /tmp/rhel_license
6965

@@ -105,7 +101,7 @@ RUN printf "MODULE = ALL;\nLOG_LEVEL = TS_CRIT;\nFILE = 2;\n" > /etc/app_protect
105101
; do sed -i "/\[$v/a log_level=fatal" "/etc/app_protect/tools/asm_logging.conf" \
106102
; done
107103

108-
COPY --chown=nginx:0 build/appprotect/log-default.json /etc/nginx
104+
COPY --chown=nginx:0 build/appprotect/log-default.json /etc/nginx
109105

110106
EXPOSE 80 443
111107

‎build/openshift/DockerfileForPlus‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,9 @@ ARG IC_VERSION
1515

1616
# Download certificate and key from the customer portal (https://cs.nginx.com)
1717
# and install NGINX Plus
18-
RUN --mount=type=secret,id=nginx-repo.crt \
19-
--mount=type=secret,id=nginx-repo.key \
18+
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
19+
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
2020
set -x \
21-
&& mkdir -p /etc/ssl/nginx && base64 --decode /run/secrets/nginx-repo.crt > /etc/ssl/nginx/nginx-repo.crt \
22-
&& base64 --decode /run/secrets/nginx-repo.key > /etc/ssl/nginx/nginx-repo.key \
2321
&& groupadd --system --gid 101 nginx \
2422
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
2523
&& yum install -y wget \
@@ -47,7 +45,6 @@ RUN --mount=type=secret,id=nginx-repo.crt \
4745
&& setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx \
4846
'cap_net_bind_service=+ep' /usr/sbin/nginx-debug \
4947
&& yum remove -y wget \
50-
&& rm -rf /etc/ssl/nginx \
5148
&& rm /etc/yum.repos.d/nginx-plus-8.repo \
5249
&& rm nginx_signing.key
5350

0 commit comments

Comments
 (0)
0