Skip to content

Commit 5bde49e

Browse files
ambushworkambushwork
committed
RUM-11897: Add scripts to set/get Vault secrets
1 parent ee38a9a commit 5bde49e

File tree

4 files changed

+225
-0
lines changed

4 files changed

+225
-0
lines changed

‎ci/scripts/get-secret.sh‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/bin/zsh
2+
3+
#
4+
# Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0.
5+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
6+
# Copyright 2016-Present Datadog, Inc.
7+
#
8+
9+
source ./ci/scripts/vault_config.sh
10+
source ./ci/scripts/list-secrets.sh
11+
12+
# Usage:
13+
# get_secret <secret_name>
14+
#
15+
# Notes:
16+
# - For <secret_name> use constants defined in './ci/scripts/vault_config.sh'
17+
# - Requires `vault` to be installed
18+
get_secret() {
19+
local secret_name=$SECRET_NAME
20+
21+
export VAULT_ADDR=$DD_VAULT_ADDR
22+
if vault token lookup &>/dev/null; then
23+
echo "Reading '$secret_name' secret in local env. You are already authenticated with 'vault'." >&2
24+
else
25+
echo "Reading '$secret_name' secret in local env. You will now be authenticated with OIDC in your web browser." >&2
26+
vault login -method=oidc -no-print
27+
fi
28+
29+
local secret_value=$(vault kv get -field=value "$DD_ANDROID_SECRETS_PATH_PREFIX/$secret_name")
30+
31+
if [[ -z "$secret_value" ]]; then
32+
echo "Error" "Failed to retrieve the '$secret_name' secret or the secret is empty." >&2
33+
exit 1
34+
fi
35+
36+
echo $secret_value
37+
}
38+
39+
list_secrets
40+
select_secret
41+
get_secret "$@"

‎ci/scripts/list-secrets.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/zsh
2+
3+
#
4+
# Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0.
5+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
6+
# Copyright 2016-Present Datadog, Inc.
7+
#
8+
9+
source ./ci/scripts/vault_config.sh
10+
11+
list_secrets() {
12+
GREEN="\e[32m"
13+
RESET="\e[0m"
14+
15+
echo "Available secrets:"
16+
for key in ${(k)DD_ANDROID_SECRETS}; do
17+
IFS=" | " read -r name description <<< "${DD_ANDROID_SECRETS[$key]}"
18+
echo "$key) ${GREEN}$name${RESET} - $description"
19+
done | sort -n
20+
21+
echo ""
22+
echo "To add a new secret, first define it in 'tools/secrets/config.sh' and retry."
23+
}
24+
25+
26+
select_secret() {
27+
echo
28+
while true; do
29+
echo "Enter the number of the secret you want to continue:"
30+
read "secret_number"
31+
if [[ -n ${DD_ANDROID_SECRETS[$secret_number]} ]]; then
32+
IFS=" | " read -r SECRET_NAME SECRET_DESC <<< "${DD_ANDROID_SECRETS[$secret_number]}"
33+
break
34+
else
35+
echo_err "Invalid selection. Please enter a valid number."
36+
fi
37+
done
38+
}

‎ci/scripts/set-secret.sh‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#!/bin/zsh
2+
3+
#
4+
# Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0.
5+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
6+
# Copyright 2016-Present Datadog, Inc.
7+
#
8+
9+
# Usage:
10+
# $ ./ci/scripts/vault_config.sh
11+
#
12+
# Note:
13+
# - Requires `vault` to be installed
14+
15+
source ./ci/scripts/vault_config.sh
16+
source ./ci/scripts/list-secrets.sh
17+
18+
select_input_method() {
19+
echo
20+
echo "How would you like to provide the secret value?"
21+
echo "1) Enter manually"
22+
echo "2) Read from text file"
23+
while true; do
24+
echo "Enter your choice:"
25+
read "input_method"
26+
case $input_method in
27+
1)
28+
get_secret_value_from_input
29+
break
30+
;;
31+
2)
32+
get_secret_value_from_file
33+
break
34+
;;
35+
*)
36+
echo "Invalid choice."
37+
;;
38+
esac
39+
done
40+
}
41+
42+
get_secret_value_from_file() {
43+
echo "Enter the file path to read the value for '$SECRET_NAME':"
44+
read "SECRET_FILE"
45+
echo
46+
47+
SECRET_FILE=${SECRET_FILE/#\~/$HOME} # Expand ~ to home directory if present
48+
echo "Using '$SECRET_FILE'"
49+
50+
if [[ -f "$SECRET_FILE" ]]; then
51+
SECRET_VALUE=$(cat "$SECRET_FILE")
52+
else
53+
echo "Error: File '$SECRET_FILE' does not exist."
54+
exit 1
55+
fi
56+
}
57+
58+
get_secret_value_from_input() {
59+
echo "Enter the new value for '$SECRET_NAME':"
60+
read "SECRET_VALUE"
61+
echo
62+
}
63+
64+
set_secret_value() {
65+
echo "You will now be authenticated with OIDC in your web browser. Press ENTER to continue."
66+
read
67+
export VAULT_ADDR=$DD_VAULT_ADDR
68+
vault login -method=oidc -no-print
69+
vault kv put "$DD_ANDROID_SECRETS_PATH_PREFIX/$SECRET_NAME" value="$SECRET_VALUE"
70+
echo "Secret '$SECRET_NAME' set successfully."
71+
}
72+
73+
list_secrets
74+
select_secret
75+
select_input_method
76+
set_secret_value

‎ci/scripts/vault_config.sh‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#!/bin/zsh
2+
3+
#
4+
# Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0.
5+
# This product includes software developed at Datadog (https://www.datadoghq.com/).
6+
# Copyright 2016-Present Datadog, Inc.
7+
#
8+
9+
DD_VAULT_ADDR=https://vault.us1.ddbuild.io
10+
DD_ANDROID_SECRETS_PATH_PREFIX='kv/aws/arn:aws:iam::486234852809:role/ci-dd-sdk-android/'
11+
12+
DD_ANDROID_SECRET__TEST_SECRET="test.secret"
13+
DD_ANDROID_SECRET__GRADLE_PROPERTIES="gradle.properties"
14+
DD_ANDROID_SECRET__SIGNING_GPG_PRIVATE_KEY="signing.gpg_private_key"
15+
DD_ANDROID_SECRET__SIGNING_GPG_PASSPHRASE="signing.gpg_passphrase"
16+
DD_ANDROID_SECRET__SIGNING_GPG_PUBLIC_KEY="signing.gpg_public_key"
17+
DD_ANDROID_SECRET__PUBLISHING_CENTRAL_USERNAME="publishing.central_username"
18+
DD_ANDROID_SECRET__PUBLISHING_CENTRAL_PWD="publishing.central_password"
19+
DD_ANDROID_SECRET__API_KEY="api_key"
20+
DD_ANDROID_SECRET__APP_KEY="app_key"
21+
DD_ANDROID_SECRET__CODECOV_TOKEN="codecov-token"
22+
DD_ANDROID_SECRET__KEYSTORE="keystore"
23+
DD_ANDROID_SECRET__KEYSTORE_PWD="keystore-password"
24+
DD_ANDROID_SECRET__E2E_CONFIG_JSON="e2e_config_json"
25+
DD_ANDROID_SECRET__E2E_API_KEY="e2e_api_key"
26+
DD_ANDROID_SECRET__E2E_APP_KEY="e2e_app_key"
27+
DD_ANDROID_SECRET__E2E_MOBILE_APP_ID="e2e_mobile_app_id"
28+
DD_ANDROID_SECRET__E2E_STAGING_CONFIG_JSON="e2e_staging_config_json"
29+
DD_ANDROID_SECRET__E2E_STAGING_API_KEY="e2e_staging_api_key"
30+
DD_ANDROID_SECRET__E2E_STAGING_APP_KEY="e2e_staging_app_key"
31+
DD_ANDROID_SECRET__E2E_STAGING_APP_ID="e2e_staging_mobile_app_id"
32+
DD_ANDROID_SECRET__WEBVIEW_CONFIG_JSON="webview_config_json"
33+
DD_ANDROID_SECRET__WEBVIEW_API_KEY="webview_api_key"
34+
DD_ANDROID_SECRET__WEBVIEW_APP_KEY="webview_app_key"
35+
DD_ANDROID_SECRET__WEBVIEW_MOBILE_APP_ID="webview_mobile_app_id"
36+
DD_ANDROID_SECRET__BENCHMARK_CONFIG_JSON="benchmark_config_json"
37+
DD_ANDROID_SECRET__BENCHMARK_API_KEY="benchmark_api_key"
38+
DD_ANDROID_SECRET__BENCHMARK_APP_KEY="benchmark_app_key"
39+
DD_ANDROID_SECRET__BENCHMARK_MOBILE_APP_ID="benchmark_mobile_app_id"
40+
41+
idx=0
42+
declare -A DD_ANDROID_SECRETS
43+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__TEST_SECRET | Test secret to verify functionality. Can be changed but not deleted."
44+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__GRADLE_PROPERTIES | Content of the gradle.properties file, providing options to speed up CI jobs."
45+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__SIGNING_GPG_PRIVATE_KEY | GPG private key for signing artifacts published to Sonatype Maven repository."
46+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__SIGNING_GPG_PASSPHRASE | GPG passphrase for signing artifacts published to Sonatype Maven repository."
47+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__SIGNING_GPG_PUBLIC_KEY | GPG public key for signing artifacts published to Sonatype Maven repository."
48+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__PUBLISHING_CENTRAL_USERNAME | Username for publishing artifacts to Sonatype Maven repository."
49+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__PUBLISHING_CENTRAL_PWD | Password for publishing artifacts to Sonatype Maven repository."
50+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__API_KEY | API key for sending CI App reports to org2."
51+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__APP_KEY | Application key for sending CI App reports to org2."
52+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__CODECOV_TOKEN | CodeCov token for unit test jobs."
53+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__KEYSTORE | Android signing keystore for building all APKs for synthetics."
54+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__KEYSTORE_PWD | Android signing password for building all APKs for synthetics."
55+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__E2E_CONFIG_JSON | config.json for uploading an end-to-end APK to the Mobile Integration org (529432, https://mobile-integration.datadoghq.com/)."
56+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__E2E_API_KEY | API key for uploading an end-to-end APK to the Mobile Integration org (529432, https://mobile-integration.datadoghq.com/)."
57+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__E2E_APP_KEY | App key for uploading an end-to-end APK to the Mobile Integration org (529432, https://mobile-integration.datadoghq.com/)."
58+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__E2E_MOBILE_APP_ID | Application ID for uploading an end-to-end APK to the Mobile Integration org (529432, https://mobile-integration.datadoghq.com/)."
59+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__E2E_STAGING_CONFIG_JSON | config.json for uploading an end-to-end APK to the Staging org."
60+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__E2E_STAGING_API_KEY | API key for uploading an end-to-end APK to synthetics on the Staging org."
61+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__E2E_STAGING_APP_KEY | App key for uploading an end-to-end APK to synthetics on the Staging org."
62+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__E2E_STAGING_APP_ID | Application ID for uploading an end-to-end APK to synthetics on the Staging org."
63+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__WEBVIEW_CONFIG_JSON | config.json for uploading an end-to-end APK (for webview integration) to the RUM Synthetics Playground org (478292, https://rum-synthetics.datadoghq.com/)."
64+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__WEBVIEW_API_KEY | API key for uploading an end-to-end APK (for webview integration) to the RUM Synthetics Playground org (478292, https://rum-synthetics.datadoghq.com/)."
65+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__WEBVIEW_APP_KEY | App key for uploading an end-to-end APK (for webview integration) to the RUM Synthetics Playground org (478292, https://rum-synthetics.datadoghq.com/)."
66+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__WEBVIEW_MOBILE_APP_ID | Application ID for uploading an end-to-end APK (for webview integration) to the RUM Synthetics Playground org (478292, https://rum-synthetics.datadoghq.com/)."
67+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__BENCHMARK_CONFIG_JSON | config.json for uploading a benchmark APK to the Mobile Integration org (529432, https://mobile-integration.datadoghq.com/)."
68+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__BENCHMARK_API_KEY | API key for uploading a benchmark APK to the Mobile Integration org (529432, https://mobile-integration.datadoghq.com/)."
69+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__BENCHMARK_APP_KEY | App key for uploading a benchmark APK to the Mobile Integration org (529432, https://mobile-integration.datadoghq.com/)."
70+
DD_ANDROID_SECRETS[$((idx++))]="$DD_ANDROID_SECRET__BENCHMARK_MOBILE_APP_ID | Application ID for uploading a benchmark APK to the Mobile Integration org (529432, https://mobile-integration.datadoghq.com/)."

0 commit comments

Comments
 (0)