Skip to content

Commit d777057

Browse files
author
Chris Every
authored
Merge pull request #233 from ovotech/add-circleci-contexts
Add circleci context location
2 parents b5e37fd + 7a55060 commit d777057

File tree

10 files changed

+627
-67
lines changed

10 files changed

+627
-67
lines changed

‎README.md

+9-6
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ ages, and rotating said keys once they pass a specific age threshold.
77
The tool can update keys held in the following locations:
88

99
* Atlas (mongoDB)
10-
* CircleCI
10+
* CircleCI env vars
11+
* CircleCI contexts
1112
* GCS
1213
* Git
1314
* GoCd
@@ -88,12 +89,14 @@ ultimately be updated with the new keys that are generated.
8889

8990
Currently, the following locations are supported:
9091

91-
* EnvVars in CircleCI
92+
* Atlas (mongoDB)
93+
* CircleCI env vars
94+
* CircleCI contexts
95+
* GCS
96+
* Git (files encrypted with [mantle](https://github.com/ovotech/mantle) which
97+
integrates with KMS))
9298
* GoCd
93-
* GCS
94-
* Secrets in GKE
95-
* Files (encrypted via [mantle](https://github.com/ovotech/mantle) which
96-
integrates with KMS) in Git
99+
* K8S (GKE only)
97100
* SSM (AWS Parameter Store)
98101

99102
## Rotation Process

‎examples/locations/circleci-contexts/README.md

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# CircleCI Contexts Example
2+
3+
## Pre-requisites
4+
5+
In order to rotate a key that's stored in CircleCI contexts, you'll need:
6+
7+
1. A GitHub machine user (**not a human user**)
8+
with write access to the GitHub repository that the CircleCI project is linked
9+
to. Note: the GitHub user must be part of a team that has access to the context,
10+
see the CircleCI [docs](https://circleci.com/docs/2.0/contexts/) for more info.
11+
2. A CircleCI API key for the GitHub user, which can be generated by logging in
12+
to [circleci.com](circleci.com) as the user, then creating a
13+
[personal API token](https://circleci.com/account/api).
14+
3. A CircleCI context, which you can create by visiting
15+
https://app.circleci.com/settings/organization/github/<org>/contexts. Once
16+
created, grab the uuid from the url, you'll need it for your config later.
17+
4. An env var set on the context in CircleCI.
18+
5. Auth to actually perform the rotation operation with whichever cloud provider
19+
you're using. This will require a service-account or user (with the
20+
cloud-provider you're rotating with) that has the required set of permissions.
21+
Then, auth will need to be given to `cloud-key-rotator` (usually in the form of
22+
a .json file or env vars).
23+
24+
## Configuration
25+
26+
```json
27+
"AccountKeyLocations": [
28+
{
29+
"ServiceAccountName": "my_aws_machine_user",
30+
"CircleCIContext": [
31+
{
32+
"ContextID": "my-uuid-context-id"
33+
}
34+
]
35+
}
36+
],
37+
"Credentials": {
38+
"CircleCIAPIToken": "my_circle_ci_api_token"
39+
}
40+
```
41+
42+
When rotating AWS keys, there are some optional fields,
43+
`keyIDEnvVar` and `keyEnvVar`, that represent the env var names in CircleCI,
44+
defaulting to values `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`
45+
respectively.
46+
47+
So, if you store your Key ID and Key values in env vars in CircleCI that're
48+
named differently, you could set something like this instead:
49+
50+
```json
51+
"CircleCIContext": [{
52+
"ContextID": "my-uuid-context-id",
53+
"KeyIDEnvVar": "AWS_KEY_ID",
54+
"KeyEnvVar": "AWS_KEY"
55+
}]
56+
```
57+
58+
When rotating GCP keys, to override the default CircleCI env var name
59+
(`GCLOUD_SERVICE_KEY`), you only need to override the `KeyEnvVar` value
60+
(as only a single value, the key, is needed for GCP)
61+
62+
```json
63+
"CircleCI": [{
64+
"ContextID": "my-uuid-context-id",
65+
"KeyEnvVar": "GCP_KEY"
66+
}]
67+
```

‎examples/locations/circleci/README.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,12 @@
44

55
In order to rotate a key that's stored in CircleCI env vars, you'll need:
66

7-
1. A GitHub user (preferably a dedicated machine-user, rather than a human user)
7+
1. A GitHub machine user (**not a human user**)
88
with write access to the GitHub repository that the CircleCI project is linked to.
99
2. A CircleCI API key for the GitHub user, which can be generated by logging in
1010
to [circleci.com](circleci.com) as the user, then creating a [personal API token](https://circleci.com/account/api).
11-
3. Auth to actually perform the rotation operation with whichever cloud provider
11+
3. An env var set on the project in CircleCI.
12+
4. Auth to actually perform the rotation operation with whichever cloud provider
1213
you're using. This will require a service-account or user (with the cloud-provider you're rotating with) that has the required set of permissions. Then, auth will
1314
need to be given to `cloud-key-rotator` (usually in the form of a .json file or
1415
env vars).

‎go.mod

+30-5
Original file line numberDiff line numberDiff line change
@@ -3,31 +3,56 @@ module github.com/ovotech/cloud-key-rotator
33
go 1.12
44

55
require (
6+
cloud.google.com/go v0.61.0 // indirect
7+
cloud.google.com/go/bigquery v1.10.0 // indirect
8+
cloud.google.com/go/pubsub v1.3.1 // indirect
69
cloud.google.com/go/storage v1.10.0
10+
github.com/CircleCI-Public/circleci-cli v0.1.8764
711
github.com/Sectorbob/mlab-ns2 v0.0.0-20171030222938-d3aa0c295a8a
812
github.com/aws/aws-lambda-go v1.17.0
9-
github.com/aws/aws-sdk-go v1.32.13
13+
github.com/aws/aws-sdk-go v1.33.13
1014
github.com/beamly/go-gocd v0.0.0-20190719193049-383d56afbf92
15+
github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
16+
github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354 // indirect
17+
github.com/envoyproxy/go-control-plane v0.9.6 // indirect
18+
github.com/envoyproxy/protoc-gen-validate v0.4.0 // indirect
19+
github.com/google/go-cmp v0.5.1 // indirect
20+
github.com/google/gofuzz v1.1.0 // indirect
1121
github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d // indirect
22+
github.com/iancoleman/strcase v0.0.0-20191112232945-16388991a334 // indirect
23+
github.com/ianlancetaylor/demangle v0.0.0-20200715173712-053cf528c12f // indirect
1224
github.com/jszwedko/go-circleci v0.3.0
25+
github.com/lyft/protoc-gen-star v0.4.15 // indirect
1326
github.com/mongodb/go-client-mongodb-atlas v0.3.0
1427
github.com/ovotech/cloud-key-client v0.0.0-20191119224032-d4d5f5354584
15-
github.com/ovotech/mantle v0.0.0-20190313113039-b525d8003135
28+
github.com/ovotech/mantle v0.0.0-20200728120419-bc55cf6d1d7a
29+
github.com/pkg/sftp v1.11.0 // indirect
30+
github.com/prometheus/client_model v0.2.0 // indirect
31+
github.com/spf13/afero v1.3.2 // indirect
1632
github.com/spf13/cobra v0.0.7
1733
github.com/spf13/viper v1.7.0
34+
github.com/stretchr/objx v0.3.0 // indirect
35+
github.com/stretchr/testify v1.6.1 // indirect
36+
github.com/yuin/goldmark v1.2.0 // indirect
1837
go.uber.org/zap v1.15.0
19-
golang.org/x/crypto v0.0.0-20191119213627-4f8c1d86b1ba
38+
golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899
39+
golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6 // indirect
2040
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
21-
google.golang.org/api v0.28.0
22-
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
41+
golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1 // indirect
42+
golang.org/x/tools v0.0.0-20200727233628-55644ead90ce // indirect
43+
google.golang.org/api v0.29.0
44+
google.golang.org/genproto v0.0.0-20200728010541-3dc8dca74b7b // indirect
45+
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
2346
gopkg.in/inf.v0 v0.9.0 // indirect
2447
gopkg.in/ini.v1 v1.57.0
2548
gopkg.in/src-d/go-git.v4 v4.13.1
2649
gopkg.in/yaml.v2 v2.2.7 // indirect
50+
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776 // indirect
2751
k8s.io/api v0.0.0-20190313235455-40a48860b5ab
2852
k8s.io/apimachinery v0.0.0-20190313205120-d7deff9243b1
2953
k8s.io/client-go v11.0.0+incompatible
3054
k8s.io/klog v0.0.0-20190306015804-8e90cee79f82 // indirect
3155
k8s.io/utils v0.0.0-20190308190857-21c4ce38f2a7 // indirect
56+
rsc.io/sampler v1.99.99 // indirect
3257
sigs.k8s.io/yaml v1.1.0 // indirect
3358
)

0 commit comments

Comments
 (0)