-
Notifications
You must be signed in to change notification settings - Fork 11
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #233 from ovotech/add-circleci-contexts
Add circleci context location
- Loading branch information
Showing
10 changed files
with
627 additions
and
67 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| # CircleCI Contexts Example | ||
|
|
||
| ## Pre-requisites | ||
|
|
||
| In order to rotate a key that's stored in CircleCI contexts, you'll need: | ||
|
|
||
| 1. A GitHub machine user (**not a human user**) | ||
| with write access to the GitHub repository that the CircleCI project is linked | ||
| to. Note: the GitHub user must be part of a team that has access to the context, | ||
| see the CircleCI [docs](https://circleci.com/docs/2.0/contexts/) for more info. | ||
| 2. A CircleCI API key for the GitHub user, which can be generated by logging in | ||
| to [circleci.com](circleci.com) as the user, then creating a | ||
| [personal API token](https://circleci.com/account/api). | ||
| 3. A CircleCI context, which you can create by visiting | ||
| https://app.circleci.com/settings/organization/github/<org>/contexts. Once | ||
| created, grab the uuid from the url, you'll need it for your config later. | ||
| 4. An env var set on the context in CircleCI. | ||
| 5. Auth to actually perform the rotation operation with whichever cloud provider | ||
| you're using. This will require a service-account or user (with the | ||
| cloud-provider you're rotating with) that has the required set of permissions. | ||
| Then, auth will need to be given to `cloud-key-rotator` (usually in the form of | ||
| a .json file or env vars). | ||
|
|
||
| ## Configuration | ||
|
|
||
| ```json | ||
| "AccountKeyLocations": [ | ||
| { | ||
| "ServiceAccountName": "my_aws_machine_user", | ||
| "CircleCIContext": [ | ||
| { | ||
| "ContextID": "my-uuid-context-id" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "Credentials": { | ||
| "CircleCIAPIToken": "my_circle_ci_api_token" | ||
| } | ||
| ``` | ||
|
|
||
| When rotating AWS keys, there are some optional fields, | ||
| `keyIDEnvVar` and `keyEnvVar`, that represent the env var names in CircleCI, | ||
| defaulting to values `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` | ||
| respectively. | ||
|
|
||
| So, if you store your Key ID and Key values in env vars in CircleCI that're | ||
| named differently, you could set something like this instead: | ||
|
|
||
| ```json | ||
| "CircleCIContext": [{ | ||
| "ContextID": "my-uuid-context-id", | ||
| "KeyIDEnvVar": "AWS_KEY_ID", | ||
| "KeyEnvVar": "AWS_KEY" | ||
| }] | ||
| ``` | ||
|
|
||
| When rotating GCP keys, to override the default CircleCI env var name | ||
| (`GCLOUD_SERVICE_KEY`), you only need to override the `KeyEnvVar` value | ||
| (as only a single value, the key, is needed for GCP) | ||
|
|
||
| ```json | ||
| "CircleCI": [{ | ||
| "ContextID": "my-uuid-context-id", | ||
| "KeyEnvVar": "GCP_KEY" | ||
| }] | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.