mirror of
https://github.com/hashicorp/vault-action.git
synced 2025-11-06 23:06:54 +00:00
chore: Update docker compose command (#567)
This commit is contained in:
Dave Sewell
GitHub
parent
33b70ff01a
commit
c46b8b8822
3 changed files with 314 additions and 311 deletions
27
.github/workflows/build.yml
vendored
27
.github/workflows/build.yml
vendored
|
|
@ -10,7 +10,7 @@ jobs:
|
|||
|
||||
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: "20.9.0"
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
|
||||
|
|
@ -35,12 +35,12 @@ jobs:
|
|||
steps:
|
||||
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
|
||||
|
||||
- name: Run docker-compose
|
||||
run: docker-compose up -d vault
|
||||
- name: Run docker compose
|
||||
run: docker compose up -d vault
|
||||
|
||||
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: "20.9.0"
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
|
||||
|
|
@ -69,14 +69,14 @@ jobs:
|
|||
steps:
|
||||
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
|
||||
|
||||
- name: Run docker-compose
|
||||
run: docker-compose up -d vault-enterprise
|
||||
- name: Run docker compose
|
||||
run: docker compose up -d vault-enterprise
|
||||
env:
|
||||
VAULT_LICENSE_CI: ${{ secrets.VAULT_LICENSE_CI }}
|
||||
|
||||
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: "20.9.0"
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
|
||||
|
|
@ -105,12 +105,12 @@ jobs:
|
|||
steps:
|
||||
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
|
||||
|
||||
- name: Run docker-compose
|
||||
run: docker-compose up -d vault
|
||||
- name: Run docker compose
|
||||
run: docker compose up -d vault
|
||||
|
||||
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: "20.9.0"
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
|
||||
|
|
@ -195,19 +195,18 @@ jobs:
|
|||
env:
|
||||
OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
|
||||
|
||||
|
||||
e2e-tls:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
|
||||
|
||||
- name: Run docker-compose
|
||||
run: docker-compose up -d vault-tls
|
||||
- name: Run docker compose
|
||||
run: docker compose up -d vault-tls
|
||||
|
||||
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
|
||||
with:
|
||||
node-version: '20.9.0'
|
||||
node-version: "20.9.0"
|
||||
|
||||
- name: Setup NPM Cache
|
||||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
|
||||
|
|
|
|||
2
Makefile
2
Makefile
|
|
@ -1,3 +1,3 @@
|
|||
.PHONY: local-test
|
||||
local-test:
|
||||
docker compose down; docker-compose up -d vault && act workflow_dispatch -j local-test -W .github/workflows/local-test.yaml
|
||||
docker compose down; docker compose up -d vault && act workflow_dispatch -j local-test -W .github/workflows/local-test.yaml
|
||||
|
|
|
|||
30
README.md
30
README.md
|
|
@ -65,27 +65,32 @@ jobs:
|
|||
```
|
||||
|
||||
Retrieved secrets are available as environment variables or outputs for subsequent steps:
|
||||
|
||||
```yaml
|
||||
#...
|
||||
- name: Step following 'Import Secrets'
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
ACCESS_KEY_ID = "${{ env.AWS_ACCESS_KEY_ID }}"
|
||||
SECRET_ACCESS_KEY = "${{ steps.import-secrets.outputs.AWS_SECRET_ACCESS_KEY }}"
|
||||
# ...
|
||||
|
||||
# ...
|
||||
```
|
||||
|
||||
If your project needs a format other than env vars and step outputs, you can use additional steps to transform them into the desired format.
|
||||
For example, a common pattern is to save all the secrets in a JSON file:
|
||||
|
||||
```yaml
|
||||
#...
|
||||
- name: Step following 'Import Secrets'
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
touch secrets.json
|
||||
echo '${{ toJson(steps.import-secrets.outputs) }}' >> secrets.json
|
||||
# ...
|
||||
|
||||
# ...
|
||||
```
|
||||
|
||||
Which with our example would yield a file containing:
|
||||
|
||||
```json
|
||||
{
|
||||
"ACCESS_KEY_ID": "MY_KEY_ID",
|
||||
|
|
@ -96,7 +101,6 @@ Which with our example would yield a file containing:
|
|||
|
||||
Note that all secrets are masked so programs need to read the file themselves otherwise all values will be replaced with a `***` placeholder.
|
||||
|
||||
|
||||
## Authentication Methods
|
||||
|
||||
Consider using a [Vault authentication method](https://www.vaultproject.io/docs/auth) such as the JWT auth method with
|
||||
|
|
@ -110,7 +114,7 @@ and Vault using the
|
|||
Each GitHub Actions workflow receives an auto-generated OIDC token with claims
|
||||
to establish the identity of the workflow.
|
||||
|
||||
__Vault Configuration__
|
||||
**Vault Configuration**
|
||||
|
||||
<details>
|
||||
<summary>Click to toggle instructions for configuring Vault.</summary>
|
||||
|
|
@ -121,7 +125,6 @@ Pass the following parameters to your auth method configuration:
|
|||
- `oidc_discovery_url`: `https://token.actions.githubusercontent.com`
|
||||
- `bound_issuer`: `https://token.actions.githubusercontent.com`
|
||||
|
||||
|
||||
Configure a [Vault role](https://www.vaultproject.io/api/auth/jwt#create-role) for the auth method.
|
||||
|
||||
- `role_type`: `jwt`
|
||||
|
|
@ -141,7 +144,7 @@ Configure a [Vault role](https://www.vaultproject.io/api/auth/jwt#create-role) f
|
|||
|
||||
- `bound_claims`: JSON object. Maps one or more claim names to corresponding wildcard values.
|
||||
```json
|
||||
{"sub": "repo:<orgName>/*"}
|
||||
{ "sub": "repo:<orgName>/*" }
|
||||
```
|
||||
|
||||
- For exact matches, use `bound_subject`.
|
||||
|
|
@ -155,7 +158,7 @@ Configure a [Vault role](https://www.vaultproject.io/api/auth/jwt#create-role) f
|
|||
|
||||
</details>
|
||||
|
||||
__GitHub Actions Workflow__
|
||||
**GitHub Actions Workflow**
|
||||
|
||||
In the GitHub Actions workflow, the workflow needs permissions to read contents
|
||||
and write the ID token.
|
||||
|
|
@ -379,7 +382,6 @@ steps:
|
|||
# Import config...
|
||||
- name: Sensitive Operation
|
||||
run: "my-cli --token '${{ steps.secrets.outputs.NPM_TOKEN }}'"
|
||||
|
||||
```
|
||||
|
||||
### Multiple Secrets
|
||||
|
|
@ -392,7 +394,8 @@ with:
|
|||
secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
|
||||
secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY
|
||||
```
|
||||
You can specify a wildcard * for the key name to get all keys in the path. If you provide an output name with the wildcard, the name will be prepended to the key name:
|
||||
|
||||
You can specify a wildcard \* for the key name to get all keys in the path. If you provide an output name with the wildcard, the name will be prepended to the key name:
|
||||
|
||||
```yaml
|
||||
with:
|
||||
|
|
@ -726,9 +729,10 @@ To make it simpler to consume certain secrets as env vars, if no Env/Output Var
|
|||
## Contributing
|
||||
|
||||
If you wish to contribute to this project, the following dependencies are recommended for local development:
|
||||
|
||||
- [npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) to install dependencies, build project and run tests
|
||||
- [docker](https://docs.docker.com/get-docker/) to run the pre-configured vault containers for acceptance tests
|
||||
- [docker-compose](https://docs.docker.com/compose/) to spin up the pre-configured vault containers for acceptance tests
|
||||
- [docker compose](https://docs.docker.com/compose/) to spin up the pre-configured vault containers for acceptance tests
|
||||
- [act](https://github.com/nektos/act) to run the vault-action locally
|
||||
|
||||
### Build
|
||||
|
|
@ -745,7 +749,7 @@ The Github Action needs access to a working Vault instance to function.
|
|||
Multiple docker configurations are available via the docker-compose.yml file to run containers compatible with the various acceptance test suites.
|
||||
|
||||
```sh
|
||||
$ docker-compose up -d vault # Choose one of: vault, vault-enterprise, vault-tls depending on which tests you would like to run
|
||||
$ docker compose up -d vault # Choose one of: vault, vault-enterprise, vault-tls depending on which tests you would like to run
|
||||
```
|
||||
|
||||
Instead of using one of the dockerized instance, you can also use your own local or remote Vault instance by exporting these environment variables:
|
||||
|
|
|
|||
Loading…
Reference in a new issue