From 45ea30da55e95a6a8dd143b9d6e888c467917d5e Mon Sep 17 00:00:00 2001 From: Benjamin Grandfond Date: Mon, 30 Aug 2021 00:43:17 +0200 Subject: [PATCH] Add secrets deployment for GCP Signed-off-by: Benjamin Grandfond --- docs/reference/README.md | 1 + .../env/google-secretmanager/.gitignore | 2 + .../env/google-secretmanager/values.yaml | 32 ++++++++ stdlib/gcp/secretmanager/secrets.cue | 76 +++++++++++++++++++ stdlib/gcp/secretmanager/tests/secrets.cue | 33 ++++++++ stdlib/universe.bats | 10 +++ 6 files changed, 154 insertions(+) create mode 100644 stdlib/.dagger/env/google-secretmanager/.gitignore create mode 100644 stdlib/.dagger/env/google-secretmanager/values.yaml create mode 100644 stdlib/gcp/secretmanager/secrets.cue create mode 100644 stdlib/gcp/secretmanager/tests/secrets.cue diff --git a/docs/reference/README.md b/docs/reference/README.md index 7d3223a2..63d74858 100644 --- a/docs/reference/README.md +++ b/docs/reference/README.md @@ -21,6 +21,7 @@ - [gcp/gcr](./gcp/gcr.md) - Google Container Registry - [gcp/gcs](./gcp/gcs.md) - Google Cloud Storage - [gcp/gke](./gcp/gke.md) - Google Kubernetes Engine +- [gcp/secretmanager](./gcp/secretmanager.md) - Google Cloud Secret Manager - [git](./git.md) - Git operations - [go](./go.md) - Go build operations - [io](./io.md) - IO operations diff --git a/stdlib/.dagger/env/google-secretmanager/.gitignore b/stdlib/.dagger/env/google-secretmanager/.gitignore new file mode 100644 index 00000000..01ec19b0 --- /dev/null +++ b/stdlib/.dagger/env/google-secretmanager/.gitignore @@ -0,0 +1,2 @@ +# dagger state +state/** diff --git a/stdlib/.dagger/env/google-secretmanager/values.yaml b/stdlib/.dagger/env/google-secretmanager/values.yaml new file mode 100644 index 00000000..687d4e4b --- /dev/null +++ b/stdlib/.dagger/env/google-secretmanager/values.yaml @@ -0,0 +1,32 @@ +plan: + package: ./gcp/secretmanager/tests +name: google-secretmanager +inputs: + TestConfig.gcpConfig.project: + text: dagger-ci-324421 + TestConfig.gcpConfig.region: + text: us-west2 + TestConfig.gcpConfig.serviceKey: + secret: ENC[AES256_GCM,data:/8H0KaL2vHzKcinRtBpwnheo49WiFjN0kTnQ3ur82LF/8/GLOyW91tDEketPBhUJ7boeLWZoh0uashHeiySJ6uBBq7fi6ChJUrIgpE16VAFPlTTcyTSRGF/nynoyBe0loksAO2j32m4sBqZwjXvYc01a+A1IM5z5VRVmDqSfIHSIrsE/1zq67enoCOin6uLTmggrRFIu60WhNqD98JB2LC+M6GbchoaZh+3UI7IbUXYPepCYXwDLq8Qpcr5YxRbNfDsQaQx+Om8oc+KgJ2W7acz5uok8/sJG1w4GXvDFrLOz0WXMNxujru2ZvUOuMApaxeOVl/ahX3gtevOVmgQKMKAKf/Mcn1d4YNQbKIan7eQ/w/Hgt3W28DYLh6oI3k0A5a8q1oOwB//+Wl5lYOWMvqqjOW0y/Ms/JpHwFy6vfmK5t/1iiYzb6aPoY4ILz/ptcGCFsRuvhdX3NxnjL4O5niNjq6XD+GE7hLz1GsuzbPO5QLZ35bcl1PIjX+f/gNcxmX/TgYkyrAyjPpwp8EDVf4G/+2scwYYg0HjrrPzcS1NCRXL+vxDkt0EShaFY1Mx+n2pZBS7om5eUTVLp241l3qZqC0kUSXW18MT6JZ+gHoxsxm/jBaudBRtcvP5ynyTV5XO758UBAupZ/lPyzoBok9un1KLHJYHMG6fpzvduQBdhBnTrIfhOO9cK+FuJGgPUJtJfeuc/9zAsD+jTad5tdHlTIl0Wmx6T2RnC+ofcuvn0Vzr4Zzh5eYab+ybraiYD64pu6Aj1c74W8tAOxTnnHFho5eO8OlnnGa6UBcw/XJIK2jRktZLk1yawuXQh3vlHKyf1YhW0JxiruRx+jQXeRqFLDc0pwOF5oSJJih9ajZ0e8uRVuMO8LxwZ0XIkjQt94NiWKTDkDZ5qkD+2kcclcTjturnMaetb6cPeYlSmhGZ9FRqboYU9MSAKmNMZ6UhNIpL/z0rSKmFMDl2x5eCF4uM2WnHBsgqPFTKIF8i/mX7mbWCv4p+I1diY8AIF/+6+lHrC/ILjEw+rthxSzPKcKw4lzX2njJxFEn2JQhdaSP5a8QG6/q8vZhkvnsq3RcIWT3J9x16BS3vNC/2smDrpGt+3N2Ty8kcoG5CTgZpYxD1Q2GMHe5djjlcOuLcx5lb/Ns1zA9+cfysqqCxK057IJWdRexz1AB/pwsYoXqSp+tsQK0xsQtylhfYRgUhsgq6WX0AAlDt0N0IDZ9Xbh6KOTvDo+OeHVikKqKfZd9rLxIN62VySPAR8btdr4q+lzOEXGkCbcDrqc9EoW+jbxBKAdOdzHkEJ4L4jdui9FSP1TmMzzEbKEzTQpVh4THK7q36x2D9kvAsUYZUpplX/gw7C/5/XJomXyNRlw8AQUP3SoRYyDXYGCZTBNEXx9js/CPkjtNvVoXgeaUK7q9YnfeqsViH+dKRQkrmux+9q1kCywIvDyH64LOREYjd5nGzplpqhgNTyB7TYwbjQDN2Lp1IKRp/34oqJDj1mQMrjqgQrEnRkTIVgT9w5bxHf3py5a4iW6uHxWMuiEy/xPPQBeexR2tC0KSidBip/W8W7WAqCD/To8d755X8U+hcoF55bZ39C1vIjjRszyZJlHpLynXtCCcccBDUUaJVORuXghMgY1w1VHCs4VvaM2WLcdFrS57+i3+pmpd2mWzNWVgo/VxANLeKuQpISYkOjb4ULUNBiEcuhfKRY/IeRDj9+SMc/3iUKF/dkx7HgvLNgzxefJ8HuAsetawIxN2wVbmecskGnu4IHW0klULUCo64wUgJQEWs1EbWqtYtgUJPhb/NK0g4/LlcqVG0bkVByYgjnatQZkcI3Tm9sZ3i43BoiYFghVsY6M1bXv2T3/SdQq2ExCRHzJQLmKblp4QDuxawb0sT0FC2Pz5RkROwNDOEyb9iYpxnSg5PqEY+iiBjRElCBjnF1eRRB54ict8lVe9uBMdHFrwMzXVgT5CO4nzjPTyW/iw2uH+SHNkhphlraG2ybeB+iibupUQClubR4c/owZxMJnzdzqjVufAMDpf0jQ6S+rWtdfiGTZGAbHp6mpn7iofYa9PzO3++RqBLvWPwgbXYu4VjutJKdIcz3ksU01uvC89kXOwSutJ0u310ihhPM7oWvcBjEW1etoP3WkvUGxY7ZSjlxI/kWi6sW5UydqrUG5UCKiXorTSGGRo4lDbQKX/5v9yKbh/pztG8cKZxCDe1vu59XiH5IQKGaxhoLN39+UauJO2hdA5g0eSqmUSYa5X9wnVjPOnaMxBhUW3H06rW/V6Jq8T9EISLxEbs0wKTq2n6BYI/cZwtxWejAe5+NlmZTm8sCXgSdt7qM31ILowXi2+/kvw5wauzVS5w7/pYmIRvc/jfnVzqb0KlRJ5U1f36R+cWHCuUut+cOpjzb5DFYMbkGDe+T1lFvMDDf98Ls7pyfTOS0DVqlYnD77zSC9sRAHEm356uvEwkuiE4vE4+oRPj7t6FUXP2HX0FsFeHtykYnA67S4+ooJZPaO+QHEKvGAKKwFwSi51rBTv8kBu9kbw503YIkOmPMM8SJ8DiBl2MGO16KTI2zvs75FpdAyVanAJmIvV5nLpUpyxEdNnStc+bhSURMpP4Mee7PsZOmAiZ9tw+7LkwN0PnHJ3CbxKQesw6zmkQ4sAyGQwGSJbo3ej87W/8f2EurGuHyn+3UhsNhzYNT/8HQz1UdwROBd46hmG8TiQYsFzSydFaL9fN4P3yoJC1VXnofmgxYaM5cFodP9k6iX1zzOe5ZWTZP/lsTDyl6UnaqdSSzfSkQA28XVj9TtRp62GnRwNgl4UkdNVItjjaAzb160x1WDJfbrVjEu58unlG/DPqvIzrbnstLBe5iVvCNqhTZUQUOPeOWGC0AIO083yoRT58fsTW3Lc2FUeNISnmvAUCcN4YNu+z3GcexmUH7ne9mYbfxLRwiIVpo0zXLYYRSQ/42n38TTqSDBMsbfujylO8zaaEd9/Vyzl2PMT1u8H1QGL0KgRcjC+OkNtRNoZ64qJVS7GVmg8iHyTsKWuqZhJC69OqS5L1QY3hqd38GVRzgOuy7JILWieFMLkX7AIzX616SEsU=,iv:m+Qoz57df2gJCv7sNbTLnaRrtv0d8ykzoJqeiCBP3Vw=,tag:clDEYDs9bq4G/2yw5bqKRg==,type:str] + TestSecrets.secret.secrets.databasePassword: + secret: ENC[AES256_GCM,data:hQcppp1Pj5k=,iv:91IMRRCRytEQ8WRSGRQIcKVnPJ9rIyikhAe8sxNNSKo=,tag:qnzIAoeHe0cDAm7xJtVOuQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rjf5lcyh8g06d4l0ujty40jjqm075pd2hrz24wm3hgdw6zkawgdqep02wa + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBldUNYQTlPeG1tK2IwZ1RR + L2lQZlRoNDM4MXRaRWVwUFRZVUloaUJPM25RClczUkZYT3VYbHhFck1FK0Y4bnAr + Zi9oUWZEcVgzdGdtS1RWU3J1RytTbEUKLS0tIDQwd2dxSXJGMWtjdVJkY3VOOGgx + cE9kYkVxZU1IbDlMOVVjVFhRT0RtN0UK/xqmdQCPXmUFIzm1rW2EGNOjGR0fYjIR + GsbeEnNhIso1eW48/LeNVlmypyRm05qV6uI5pTn4ecVTeYl9jWzCnA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2021-09-05T14:40:55Z" + mac: ENC[AES256_GCM,data:ukt19jzNMVS7FlKqagUbPb5d82yRWKXzU6Nwrm/bj4Yr4Fix8YujPmEPna32+EyPNCTwY9Wgoxvy7/QF3EootTcTl6FFH2l6v4aVJDIh4iGQo6HpFH1lYyBtDiDNVvLMOxxfqpahoRBpY0fNFOloEh/+Fr77WFwO+E2ksciYEXE=,iv:3yKQAXtTcmjyWfS5JCIOjhxj4JcdhMZnyMBc/6Tvc2A=,tag:aJPd868CiZ6+hcwIkCLK4w==,type:str] + pgp: [] + encrypted_suffix: secret + version: 3.7.1 diff --git a/stdlib/gcp/secretmanager/secrets.cue b/stdlib/gcp/secretmanager/secrets.cue new file mode 100644 index 00000000..5c5b83e3 --- /dev/null +++ b/stdlib/gcp/secretmanager/secrets.cue @@ -0,0 +1,76 @@ +// Google Cloud Secret Manager +package secretmanager + +import ( + "alpha.dagger.io/dagger" + "alpha.dagger.io/dagger/op" + "alpha.dagger.io/gcp" + "alpha.dagger.io/os" +) + +#Secrets: { + // GCP Config + config: gcp.#Config + + // Map of secrets + secrets: [name=string]: dagger.#Secret + + // Deploy encrypted secrets + deployment: os.#Container & { + image: gcp.#GCloud & {"config": config} + shell: path: "/bin/bash" + always: true + + for name, s in secrets { + secret: "/tmp/secrets/\(name)": s + } + + command: #""" + # Loop on all files, including hidden files + shopt -s dotglob + echo "{}" > /tmp/output.json + for FILE in /tmp/secrets/*; do + BOOL=0 # Boolean + gcloud secrets describe "${FILE##*/}" 2>/dev/null > /dev/null + status=$? + + # If secret not found + if [[ ! "${status}" -eq 0 ]]; then + (\ + RES=$(gcloud secrets create "${FILE##*/}" --replication-policy automatic --data-file "${FILE}" --format='value(name)' | sed -n '1!p') \ + && cat <<< $(cat /tmp/output.json | jq ".|.\"${FILE##*/}\"=\"$RES\"") > /tmp/output.json \ + ) || (echo "Error while creating secret ${FILE##*/}" >&2 && exit 1) + BOOL=1 + else + (\ + RES=$(gcloud secrets versions add "${FILE##*/}" --data-file "${FILE}" --format='value(name)' | sed -n '1!p') \ + && cat <<< $(cat /tmp/output.json | jq ".|.\"${FILE##*/}\"=\"$RES\"") > /tmp/output.json \ + ) || (echo "Error while updating secret ${FILE##*/}" >&2 && exit 1) + BOOL=1 + fi + if [ $BOOL -eq 0 ]; then + (\ + RES=$(gcloud secrets describe "${FILE##*/}" --format='value(name)') \ + && cat <<< $(cat /tmp/output.json | jq ".|.\"${FILE##*/}\"=\"$RES\"") > /tmp/output.json \ + ) || (echo "Error while retrieving secret ${FILE##*/}" >&2 && exit 1) + fi + done + """# + } + + // dynamic references + references: { + [string]: string + } + + references: #up: [ + op.#Load & { + from: deployment + }, + + op.#Export & { + source: "/tmp/output.json" + format: "json" + }, + ] +} diff --git a/stdlib/gcp/secretmanager/tests/secrets.cue b/stdlib/gcp/secretmanager/tests/secrets.cue new file mode 100644 index 00000000..c2e7ed12 --- /dev/null +++ b/stdlib/gcp/secretmanager/tests/secrets.cue @@ -0,0 +1,33 @@ +package secretmanager + +import ( + "alpha.dagger.io/dagger" + "alpha.dagger.io/gcp" + "alpha.dagger.io/gcp/secretmanager" + "alpha.dagger.io/os" +) + +TestConfig: gcpConfig: gcp.#Config + +TestSecrets: { + secret: secretmanager.#Secrets & { + config: TestConfig.gcpConfig + secrets: { + databasePassword: dagger.#Secret @dagger(input) + } + } + + if len(secret.references) > 0 { + cleanup: os.#Container & { + image: gcp.#GCloud & { + config: TestConfig.gcpConfig + } + shell: path: "/bin/bash" + always: true + + command: #""" + gcloud -q secrets delete databasePassword + """# + } + } +} diff --git a/stdlib/universe.bats b/stdlib/universe.bats index b0470e94..0bc69ce6 100644 --- a/stdlib/universe.bats +++ b/stdlib/universe.bats @@ -172,6 +172,16 @@ setup() { dagger -e google-gke up } +@test "google cloud: secretmanager" { + run dagger -e google-secretmanager up + assert_success + + # ensure the secret has been created + run dagger query -e google-secretmanager TestSecrets.secret.references.databasePassword -f text + assert_success + assert_output --regexp '^projects\/[0-9]+\/secrets\/databasePassword' +} + @test "google cloud: cloudrun" { dagger -e google-cloudrun up }