Skip to content

Commit 9d6ede6

Browse files
twoGiantstwoGiants
committed
refactor: distinguish secrets from vars in CI
Rename configuration fields to separate GitHub secrets (sensitive) from variables (non-sensitive): - Registry URL/user changed from secrets to variables - Add separate registryUrlVar for `func deploy --registry=URL` - Renamed selfHostedRunner to useSelfHostedRunner for consistency Update workflow generation to use ${{ vars.* }} for variables and ${{ secrets.* }} for secrets. Issue SRVOCF-744 Signed-off-by: Stanislav Jakuschevskij <sjakusch@redhat.com>
1 parent 1cac233 commit 9d6ede6

File tree

5 files changed

+75
-57
lines changed

5 files changed

+75
-57
lines changed

‎cmd/ci/config.go‎

Lines changed: 35 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,14 @@ type CIConfig struct {
1212
githubWorkflowDir,
1313
githubWorkflowFilename,
1414
workflowName,
15-
kubeconfigSecretKey,
16-
registryUrlSecretKey,
17-
registryUserSecretKey,
18-
registryPassSecretKey string
15+
kubeconfigSecret,
16+
registryLoginUrlVar,
17+
registryUserVar,
18+
registryPassSecret,
19+
registryUrlVar string
1920
useRegistryLogin,
2021
useRemoteBuild,
21-
selfHostedRunner,
22+
useSelfHostedRunner,
2223
debug bool
2324
}
2425

@@ -42,28 +43,32 @@ func (cc *CIConfig) UseRemoteBuild() bool {
4243
return cc.useRemoteBuild
4344
}
4445

45-
func (cc *CIConfig) SelfHostedRunner() bool {
46-
return cc.selfHostedRunner
46+
func (cc *CIConfig) UseSelfHostedRunner() bool {
47+
return cc.useSelfHostedRunner
4748
}
4849

4950
func (cc *CIConfig) UseDebug() bool {
5051
return cc.debug
5152
}
5253

53-
func (cc *CIConfig) KubeconfigSecretKey() string {
54-
return cc.kubeconfigSecretKey
54+
func (cc *CIConfig) KubeconfigSecret() string {
55+
return cc.kubeconfigSecret
5556
}
5657

57-
func (cc *CIConfig) RegistryUrlSecretKey() string {
58-
return cc.registryUrlSecretKey
58+
func (cc *CIConfig) RegistryLoginUrlVar() string {
59+
return cc.registryLoginUrlVar
5960
}
6061

61-
func (cc *CIConfig) RegistryUserSecretKey() string {
62-
return cc.registryUserSecretKey
62+
func (cc *CIConfig) RegistryUserVar() string {
63+
return cc.registryUserVar
6364
}
6465

65-
func (cc *CIConfig) RegistryPassSecretKey() string {
66-
return cc.registryPassSecretKey
66+
func (cc *CIConfig) RegistryPassSecret() string {
67+
return cc.registryPassSecret
68+
}
69+
70+
func (cc *CIConfig) RegistryUrlVar() string {
71+
return cc.registryUrlVar
6772
}
6873

6974
type ciConfigBuilder struct {
@@ -77,13 +82,14 @@ func NewCIConfigBuilder() *ciConfigBuilder {
7782
githubWorkflowDir: ".github/workflows",
7883
githubWorkflowFilename: "remote-build-and-deploy.yaml",
7984
workflowName: "Remote Build and Deploy",
80-
kubeconfigSecretKey: "KUBECONFIG",
81-
registryUrlSecretKey: "REGISTRY_URL",
82-
registryUserSecretKey: "REGISTRY_USERNAME",
83-
registryPassSecretKey: "REGISTRY_PASSWORD",
85+
kubeconfigSecret: "KUBECONFIG",
86+
registryLoginUrlVar: "REGISTRY_LOGIN_URL",
87+
registryUserVar: "REGISTRY_USERNAME",
88+
registryPassSecret: "REGISTRY_PASSWORD",
89+
registryUrlVar: "REGISTRY_URL",
8490
useRegistryLogin: true,
8591
useRemoteBuild: false,
86-
selfHostedRunner: false,
92+
useSelfHostedRunner: false,
8793
debug: false,
8894
},
8995
}
@@ -94,23 +100,23 @@ func (b *ciConfigBuilder) WithWorkflowName(name string) *ciConfigBuilder {
94100
return b
95101
}
96102

97-
func (b *ciConfigBuilder) WithKubeconfigKey(key string) *ciConfigBuilder {
98-
b.result.kubeconfigSecretKey = key
103+
func (b *ciConfigBuilder) WithKubeconfigSecret(v string) *ciConfigBuilder {
104+
b.result.kubeconfigSecret = v
99105
return b
100106
}
101107

102-
func (b *ciConfigBuilder) WithRegistryUrlKey(key string) *ciConfigBuilder {
103-
b.result.registryUrlSecretKey = key
108+
func (b *ciConfigBuilder) WithRegistryLoginUrlVar(v string) *ciConfigBuilder {
109+
b.result.registryLoginUrlVar = v
104110
return b
105111
}
106112

107-
func (b *ciConfigBuilder) WithRegistryUserKey(key string) *ciConfigBuilder {
108-
b.result.registryUserSecretKey = key
113+
func (b *ciConfigBuilder) WithRegistryUserVar(v string) *ciConfigBuilder {
114+
b.result.registryUserVar = v
109115
return b
110116
}
111117

112-
func (b *ciConfigBuilder) WithRegistryPassKey(key string) *ciConfigBuilder {
113-
b.result.registryPassSecretKey = key
118+
func (b *ciConfigBuilder) WithRegistryPassSecret(v string) *ciConfigBuilder {
119+
b.result.registryPassSecret = v
114120
return b
115121
}
116122

@@ -125,7 +131,7 @@ func (b *ciConfigBuilder) WithRemoteBuild() *ciConfigBuilder {
125131
}
126132

127133
func (b *ciConfigBuilder) WithSelfHosted() *ciConfigBuilder {
128-
b.result.selfHostedRunner = true
134+
b.result.useSelfHostedRunner = true
129135
return b
130136
}
131137

‎cmd/ci/workflow.go‎

Lines changed: 20 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -95,17 +95,18 @@ func (s *Step) withActionConfig(key, value string) *Step {
9595

9696
func NewGithubWorkflow(
9797
name,
98-
kubeconfigSecretKey,
99-
registryUrlSecretKey,
100-
registryUserSecretKey,
101-
registryPassSecretKey string,
98+
kubeconfigSecret,
99+
registryLoginUrlVar,
100+
registryUserEnvVar,
101+
registryPassSecret,
102+
registryUrlVar string,
102103
useRegistryLogin,
103104
useRemoteBuild,
104-
selfHosted,
105+
useSelfHosted,
105106
useDebug bool,
106107
) *GithubWorkflow {
107108
runsOn := "ubuntu-latest"
108-
if selfHosted {
109+
if useSelfHosted {
109110
runsOn = "self-hosted"
110111
}
111112

@@ -119,15 +120,15 @@ func NewGithubWorkflow(
119120
setupK8Context := newStep("Setup Kubernetes context").
120121
withUses("azure/k8s-set-context@v4").
121122
withActionConfig("method", "kubeconfig").
122-
withActionConfig("kubeconfig", newSecret(kubeconfigSecretKey))
123+
withActionConfig("kubeconfig", newSecret(kubeconfigSecret))
123124
steps = append(steps, *setupK8Context)
124125

125126
if useRegistryLogin {
126127
loginToContainerRegistry := newStep("Login to container registry").
127128
withUses("docker/login-action@v3").
128-
withActionConfig("registry", newSecret(registryUrlSecretKey)).
129-
withActionConfig("username", newSecret(registryUserSecretKey)).
130-
withActionConfig("password", newSecret(registryPassSecretKey))
129+
withActionConfig("registry", newVariable(registryLoginUrlVar)).
130+
withActionConfig("username", newVariable(registryUserEnvVar)).
131+
withActionConfig("password", newSecret(registryPassSecret))
131132
steps = append(steps, *loginToContainerRegistry)
132133
}
133134

@@ -154,8 +155,12 @@ func NewGithubWorkflow(
154155
runFuncDeploy += " --remote"
155156
name = "Remote Build and Deploy"
156157
}
158+
registryUrl := newVariable(registryUrlVar)
159+
if useRegistryLogin {
160+
registryUrl = newVariable(registryLoginUrlVar) + "/" + newVariable(registryUserEnvVar)
161+
}
157162
deployFunc := newStep("Deploy function").
158-
withRun(runFuncDeploy + " --registry=" + newSecret(registryUrlSecretKey) + " -v")
163+
withRun(runFuncDeploy + " --registry=" + registryUrl + " -v")
159164
steps = append(steps, *deployFunc)
160165

161166
return &GithubWorkflow{
@@ -226,3 +231,7 @@ func (gw *GithubWorkflow) toYaml() ([]byte, error) {
226231
func newSecret(key string) string {
227232
return fmt.Sprintf("${{ secrets.%s }}", key)
228233
}
234+
235+
func newVariable(key string) string {
236+
return fmt.Sprintf("${{ vars.%s }}", key)
237+
}

‎cmd/ci/workflow_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,10 @@ func TestGithubWorkflow_PersistAndLoad(t *testing.T) {
1212
gw := ci.NewGithubWorkflow(
1313
"gw-test",
1414
"KUBECONFIG",
15-
"REGISTRY_URL",
15+
"REGISTRY_LOGIN_URL",
1616
"REGISTRY_USERNAME",
1717
"REGISTRY_PASSWORD",
18+
"REGISTRY_URL",
1819
false,
1920
false,
2021
false,

‎cmd/config_ci.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -74,13 +74,14 @@ func runConfigCIGithub(
7474

7575
githubWorkflow := ci.NewGithubWorkflow(
7676
ciConfig.WorkflowName(),
77-
ciConfig.KubeconfigSecretKey(),
78-
ciConfig.RegistryUrlSecretKey(),
79-
ciConfig.RegistryUserSecretKey(),
80-
ciConfig.RegistryPassSecretKey(),
77+
ciConfig.KubeconfigSecret(),
78+
ciConfig.RegistryLoginUrlVar(),
79+
ciConfig.RegistryUserVar(),
80+
ciConfig.RegistryPassSecret(),
81+
cfg.RegistryUrlVar(),
8182
cfg.UseRegistryLogin(),
8283
cfg.UseRemoteBuild(),
83-
cfg.SelfHostedRunner(),
84+
cfg.UseSelfHostedRunner(),
8485
cfg.UseDebug(),
8586
)
8687
if err := githubWorkflow.Persist(ciConfig.FnGithubWorkflowFilepath(f.Root)); err != nil {

‎cmd/config_ci_test.go‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,10 @@ func TestNewConfigCICmd_WorkflowYAMLHasCustomValues(t *testing.T) {
8080
// GIVEN
8181
ciConfig := ci.NewCIConfigBuilder().
8282
WithWorkflowName("Custom Remote Build and Deploy").
83-
WithKubeconfigKey("DEV_CLUSTER_KUBECONFIG").
84-
WithRegistryUrlKey("DEV_REGISTRY_URL").
85-
WithRegistryUserKey("DEV_REGISTRY_USER").
86-
WithRegistryPassKey("DEV_REGISTRY_PASS").
83+
WithKubeconfigSecret("DEV_CLUSTER_KUBECONFIG").
84+
WithRegistryLoginUrlVar("DEV_REGISTRY_URL").
85+
WithRegistryUserVar("DEV_REGISTRY_USER").
86+
WithRegistryPassSecret("DEV_REGISTRY_PASS").
8787
Build()
8888
options := opts{
8989
withFuncInTempDir: true,
@@ -99,10 +99,10 @@ func TestNewConfigCICmd_WorkflowYAMLHasCustomValues(t *testing.T) {
9999
assertWorkflowFileExists(t, result)
100100
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.WorkflowName()))
101101
assert.Assert(t, yamlContains(result.gwYamlString, "self-hosted"))
102-
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.KubeconfigSecretKey()))
103-
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.RegistryUrlSecretKey()))
104-
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.RegistryUserSecretKey()))
105-
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.RegistryPassSecretKey()))
102+
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.KubeconfigSecret()))
103+
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.RegistryLoginUrlVar()))
104+
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.RegistryUserVar()))
105+
assert.Assert(t, yamlContains(result.gwYamlString, ciConfig.RegistryPassSecret()))
106106
}
107107

108108
func TestNewConfigCICmd_WorkflowHasNoRegistryLogin(t *testing.T) {
@@ -120,6 +120,7 @@ func TestNewConfigCICmd_WorkflowHasNoRegistryLogin(t *testing.T) {
120120
assertWorkflowFileExists(t, result)
121121
assert.Assert(t, !strings.Contains(result.gwYamlString, "docker/login-action@v3"))
122122
assert.Assert(t, !strings.Contains(result.gwYamlString, "Login to container registry"))
123+
assert.Assert(t, yamlContains(result.gwYamlString, "--registry=${{ vars.REGISTRY_URL }}"))
123124
}
124125

125126
func TestNewConfigCICmd_RemoteBuildAndDeployWorkflow(t *testing.T) {
@@ -264,8 +265,8 @@ func assertWorkflowFileContent(t *testing.T, actualGw string) {
264265

265266
assert.Assert(t, yamlContains(actualGw, "Login to container registry"))
266267
assert.Assert(t, yamlContains(actualGw, "docker/login-action@v3"))
267-
assert.Assert(t, yamlContains(actualGw, "registry: ${{ secrets.REGISTRY_URL }}"))
268-
assert.Assert(t, yamlContains(actualGw, "username: ${{ secrets.REGISTRY_USERNAME }}"))
268+
assert.Assert(t, yamlContains(actualGw, "registry: ${{ vars.REGISTRY_LOGIN_URL }}"))
269+
assert.Assert(t, yamlContains(actualGw, "username: ${{ vars.REGISTRY_USERNAME }}"))
269270
assert.Assert(t, yamlContains(actualGw, "password: ${{ secrets.REGISTRY_PASSWORD }}"))
270271

271272
assert.Assert(t, yamlContains(actualGw, "Install func cli"))
@@ -274,7 +275,7 @@ func assertWorkflowFileContent(t *testing.T, actualGw string) {
274275
assert.Assert(t, yamlContains(actualGw, "name: func"))
275276

276277
assert.Assert(t, yamlContains(actualGw, "Deploy function"))
277-
assert.Assert(t, yamlContains(actualGw, "func deploy --registry=${{ secrets.REGISTRY_URL }} -v"))
278+
assert.Assert(t, yamlContains(actualGw, "func deploy --registry=${{ vars.REGISTRY_LOGIN_URL }}/${{ vars.REGISTRY_USERNAME }} -v"))
278279
}
279280

280281
func yamlContains(yaml, substr string) cmp.Comparison {

0 commit comments

Comments
 (0)