Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use GITHUB_ENV for OIDC_TOKEN #63

Merged
merged 7 commits into from
Sep 19, 2024
Merged

Use GITHUB_ENV for OIDC_TOKEN #63

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d416b4e
use GITHUB_ENV for OIDC_TOKEN
sebastian-luna-valero Sep 19, 2024
ac11f6d
remove empty env: line
sebastian-luna-valero Sep 19, 2024
b5f6266
./mytoken instead of mytoken
sebastian-luna-valero Sep 19, 2024
aae229b
add MYTOKEN to env
sebastian-luna-valero Sep 19, 2024
686feef
solving SHELL_SHFMT issue
sebastian-luna-valero Sep 19, 2024
6397277
shellcheck disable=SC2153
sebastian-luna-valero Sep 19, 2024
fabfbba
solving SHELL_SHFMT issue
sebastian-luna-valero Sep 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions .github/workflows/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ jobs:
with:
python-version: 3.x
- name: Install environment
env:
MYTOKEN: ${{ secrets.MYTOKEN }}
run: |
curl -L https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 > jq
chmod +x jq
Expand All @@ -36,9 +38,11 @@ jobs:
> ~/.mytoken/config.yaml
# add PWD to the PATH
echo "$PWD" >> "$GITHUB_PATH"
# add OIDC access token to ENV
OIDC_TOKEN=$(./mytoken AT --MT-env MYTOKEN)
echo "::add-mask::$OIDC_TOKEN"
echo "OIDC_TOKEN=$OIDC_TOKEN" >> "$GITHUB_ENV"
- name: Configure providers access
env:
MYTOKEN: ${{ secrets.MYTOKEN }}
run: |
cd deployment
./site-config.sh
Expand Down Expand Up @@ -113,8 +117,6 @@ jobs:
- name: Configure with ansible
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
uses: dawidd6/action-ansible-playbook@v2
env:
MYTOKEN: ${{ secrets.MYTOKEN }}
with:
playbook: playbook.yaml
directory: ./deployment
Expand All @@ -124,7 +126,7 @@ jobs:
${{ steps.public_ip.outputs.stdout }}
requirements: galaxy-requirements.yaml
options: |
--extra-vars ACCESS_TOKEN="$(mytoken AT --MT-env MYTOKEN)"
--extra-vars ACCESS_TOKEN=${{ env.OIDC_TOKEN }}
--extra-vars git_ref=${{ github.sha }}
--ssh-common-args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
-u egi
44 changes: 22 additions & 22 deletions deployment/site-config.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,18 +6,18 @@ set -e
# Reads from config.yaml the clouds to use

dump_config() {
# dumps a piece of yaml ready to be included in the
# clouds.yaml Openstack client config
cloud_name="$1"
site="$2"
vo="$3"
oidc_token="$4"
token="$(fedcloud openstack token issue \
--oidc-access-token "$oidc_token" \
--site "$site" --vo "$vo" -j \
| jq -r '.[0].Result.id')"
eval "$(fedcloud site show-project-id --site "$site" --vo "$vo")"
cat << EOF
# dumps a piece of yaml ready to be included in the
# clouds.yaml Openstack client config
cloud_name="$1"
site="$2"
vo="$3"
oidc_token="$4"
token="$(fedcloud openstack token issue \
--oidc-access-token "$oidc_token" \
--site "$site" --vo "$vo" -j |
jq -r '.[0].Result.id')"
eval "$(fedcloud site show-project-id --site "$site" --vo "$vo")"
cat <<EOF
$cloud_name:
auth_type: token
auth:
Expand All @@ -27,21 +27,21 @@ dump_config() {
EOF
}

OIDC_TOKEN=$(mytoken AT --MT-env MYTOKEN)

echo "::add-mask::$OIDC_TOKEN"
# using OIDC_TOKEN generated in .github/workflows/deploy.yaml

rm -f clouds.yaml
echo "clouds:" > tmp-clouds.yaml
echo "clouds:" >tmp-clouds.yaml

# shellcheck disable=SC2153
dump_config backend \
"$(yq -r .clouds.backend.site config.yaml)" \
"$(yq -r .clouds.backend.vo config.yaml)" \
"$OIDC_TOKEN" >> tmp-clouds.yaml
"$(yq -r .clouds.backend.site config.yaml)" \
"$(yq -r .clouds.backend.vo config.yaml)" \
"$OIDC_TOKEN" >>tmp-clouds.yaml

dump_config deploy \
"$(yq -r .clouds.deploy.site config.yaml)" \
"$(yq -r .clouds.deploy.vo config.yaml)" \
"$OIDC_TOKEN" >> tmp-clouds.yaml
"$(yq -r .clouds.deploy.site config.yaml)" \
"$(yq -r .clouds.deploy.vo config.yaml)" \
"$OIDC_TOKEN" >>tmp-clouds.yaml

mv tmp-clouds.yaml clouds.yaml
mkdir -p ~/.config/openstack