Skip to content

Commit 3bd67ce

Browse files
bonzofenixbonzofenix
authored
ci: replace credhub generate with local openssl rand (#1251)
* ci: replace credhub generate with local openssl rand Health passwords and broker passwords no longer written to CredHub. Generated locally with openssl rand at deploy time instead. CredHub usage is now read-only (interpolate only for infra secrets). * fix(ci): merge broker registration into mta-deploy.sh After removing credhub generate, SERVICE_BROKER_PASSWORD lives only in the process that runs build-extension-file.sh. Rather than passing it between processes via temp files, merge broker registration into mta-deploy.sh and extract the password from the generated extension file (where it's already baked in by envsubst). - mta-deploy.sh reads broker password from extension file via yq - Remove standalone register-broker.sh and deploy-register-cf target - Remove separate "Register autoscaler" workflow step (now part of deploy)
1 parent 09d491c commit 3bd67ce

5 files changed

Lines changed: 38 additions & 70 deletions

File tree

‎.github/workflows/acceptance_tests_reusable.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,6 @@ jobs:
6767
make --directory="${AUTOSCALER_DIR}" mta-build
6868
make --directory="${AUTOSCALER_DIR}" mta-deploy
6969
70-
- name: Register autoscaler
71-
shell: bash
72-
run: make --directory="${AUTOSCALER_DIR}" deploy-register-cf
73-
7470
acceptance_tests:
7571
name: Acceptance Tests - ${{ matrix.suite }}
7672
needs: [ deploy_autoscaler ]

‎Makefile‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -552,10 +552,6 @@ mta-acceptance-tests: ## Run MTA acceptance tests in parallel via CF tasks
552552
# 🚧 To-do: These targets don't exist here!
553553
.PHONY: deploy-autoscaler deploy-autoscaler-bosh
554554

555-
.PHONY: deploy-register-cf
556-
deploy-register-cf:
557-
DEBUG="${DEBUG}" ./scripts/register-broker.sh
558-
559555
.PHONY: deploy-cleanup
560556
deploy-cleanup:
561557
DEBUG="${DEBUG}" ./scripts/cleanup-autoscaler.sh

‎scripts/build-extension-file.sh‎

Lines changed: 11 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -33,29 +33,25 @@ export SYSTEM_DOMAIN="autoscaler.app-runtime-interfaces.ci.cloudfoundry.org"
3333
export CPU_LOWER_THRESHOLD="${CPU_LOWER_THRESHOLD:-"100"}"
3434

3535
generate_deployment_secrets() {
36-
local prefix="/bosh-autoscaler/${DEPLOYMENT_NAME}"
37-
credhub generate --no-overwrite -n "${prefix}/autoscaler_metricsforwarder_health_password" --length 16 -t password
38-
credhub generate --no-overwrite -n "${prefix}/autoscaler_metricsgateway_health_password" --length 16 -t password
39-
credhub generate --no-overwrite -n "${prefix}/autoscaler_operator_health_password" --length 16 -t password
40-
credhub generate --no-overwrite -n "${prefix}/autoscaler_eventgenerator_health_password" --length 16 -t password
41-
credhub generate --no-overwrite -n "${prefix}/autoscaler_scalingengine_health_password" --length 16 -t password
42-
credhub generate --no-overwrite -n "${prefix}/service_broker_password_blue" --length 16 -t password
43-
credhub generate --no-overwrite -n "${prefix}/service_broker_password" --length 16 -t password
44-
return
36+
METRICSFORWARDER_HEALTH_PASSWORD="$(openssl rand -base64 12)"
37+
METRICSGATEWAY_HEALTH_PASSWORD="$(openssl rand -base64 12)"
38+
OPERATOR_HEALTH_PASSWORD="$(openssl rand -base64 12)"
39+
EVENTGENERATOR_HEALTH_PASSWORD="$(openssl rand -base64 12)"
40+
SCALINGENGINE_HEALTH_PASSWORD="$(openssl rand -base64 12)"
41+
SERVICE_BROKER_PASSWORD_BLUE="$(openssl rand -base64 12)"
42+
SERVICE_BROKER_PASSWORD="$(openssl rand -base64 12)"
43+
export METRICSFORWARDER_HEALTH_PASSWORD METRICSGATEWAY_HEALTH_PASSWORD
44+
export OPERATOR_HEALTH_PASSWORD EVENTGENERATOR_HEALTH_PASSWORD
45+
export SCALINGENGINE_HEALTH_PASSWORD SERVICE_BROKER_PASSWORD_BLUE SERVICE_BROKER_PASSWORD
4546
}
4647

4748
load_secrets() {
4849
local secrets_file="$1"
4950
# Map YAML keys → shell variable names, emitting `export VAR=value` lines
5051
local exports
5152
exports="$(yq '
52-
"export EVENTGENERATOR_HEALTH_PASSWORD=" + (.eventgenerator_health_password | @sh),
5353
"export EVENTGENERATOR_LOG_CACHE_UAA_CLIENT_ID=" + (.eventgenerator_log_cache_uaa_client_id | @sh),
5454
"export EVENTGENERATOR_LOG_CACHE_UAA_CLIENT_SECRET=" + (.eventgenerator_log_cache_uaa_client_secret | @sh),
55-
"export METRICSFORWARDER_HEALTH_PASSWORD=" + (.metricsforwarder_health_password | @sh),
56-
"export METRICSGATEWAY_HEALTH_PASSWORD=" + (.metricsgateway_health_password | @sh),
57-
"export SCALINGENGINE_HEALTH_PASSWORD=" + (.scalingengine_health_password | @sh),
58-
"export OPERATOR_HEALTH_PASSWORD=" + (.operator_health_password | @sh),
5955
"export CF_ADMIN_PASSWORD=" + (.cf_admin_password | @sh),
6056
"export POSTGRES_IP=" + (.postgres_ip | @sh),
6157
"export DATABASE_DB_USERNAME=" + (.database_username | @sh),
@@ -65,9 +61,7 @@ load_secrets() {
6561
"export DATABASE_DB_CLIENT_KEY=" + (.database_client_key | @sh),
6662
"export SYSLOG_CLIENT_CA=" + (.syslog_client_ca | @sh),
6763
"export SYSLOG_CLIENT_CERT=" + (.syslog_client_cert | @sh),
68-
"export SYSLOG_CLIENT_KEY=" + (.syslog_client_key | @sh),
69-
"export SERVICE_BROKER_PASSWORD_BLUE=" + (.service_broker_password_blue | @sh),
70-
"export SERVICE_BROKER_PASSWORD=" + (.service_broker_password | @sh)
64+
"export SYSLOG_CLIENT_KEY=" + (.syslog_client_key | @sh)
7165
' "${secrets_file}")"
7266
eval "${exports}"
7367
return
@@ -94,14 +88,6 @@ database_server_ca: ((/bosh-autoscaler/postgres/postgres_server.ca))
9488
database_client_cert: ((/bosh-autoscaler/postgres/postgres_server.certificate))
9589
database_client_key: ((/bosh-autoscaler/postgres/postgres_server.private_key))
9690
97-
metricsforwarder_health_password: ((/bosh-autoscaler/${DEPLOYMENT_NAME}/autoscaler_metricsforwarder_health_password))
98-
metricsgateway_health_password: ((/bosh-autoscaler/${DEPLOYMENT_NAME}/autoscaler_metricsgateway_health_password))
99-
operator_health_password: ((/bosh-autoscaler/${DEPLOYMENT_NAME}/autoscaler_operator_health_password))
100-
eventgenerator_health_password: ((/bosh-autoscaler/${DEPLOYMENT_NAME}/autoscaler_eventgenerator_health_password))
101-
scalingengine_health_password: ((/bosh-autoscaler/${DEPLOYMENT_NAME}/autoscaler_scalingengine_health_password))
102-
service_broker_password_blue: ((/bosh-autoscaler/${DEPLOYMENT_NAME}/service_broker_password_blue))
103-
service_broker_password: ((/bosh-autoscaler/${DEPLOYMENT_NAME}/service_broker_password))
104-
10591
cf_admin_password: ((/bosh-autoscaler/cf/cf_admin_password))
10692
EOF
10793

‎scripts/mta-deploy.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,30 @@ pushd "${autoscaler_dir}" > /dev/null
4141
cf deploy "${DEST}/${MTAR_FILENAME}" --version-rule ALL -f --delete-services -e "${EXTENSION_FILE}" -m "${MODULES}"
4242

4343
popd > /dev/null
44+
45+
# --- Register service broker ---
46+
# Extract broker password from the generated extension file (baked in by build-extension-file.sh)
47+
SERVICE_BROKER_PASSWORD="$(yq '.resources[] | select(.name == "apiserver-config") | .parameters.config."apiserver-config".broker_credentials[0].broker_password' "${EXTENSION_FILE}")"
48+
49+
cf_login
50+
51+
set +e
52+
existing_service_broker="$(cf curl v3/service_brokers | jq --raw-output \
53+
--arg service_broker_name "${deployment_name:-}" \
54+
'.resources[] | select(.name == $service_broker_name) | .name')"
55+
set -e
56+
57+
if [[ -n "${existing_service_broker}" ]]; then
58+
echo "Service Broker ${existing_service_broker} already exists"
59+
echo " - cleaning up pr"
60+
pushd "${autoscaler_dir}/acceptance" > /dev/null
61+
./cleanup.sh
62+
popd > /dev/null
63+
echo ' - deleting broker'
64+
cf delete-service-broker -f "${existing_service_broker}"
65+
fi
66+
67+
echo "Creating service broker ${deployment_name:-} at 'https://${service_broker_name:-}.${system_domain:-}'"
68+
cf create-service-broker "${deployment_name:-}" autoscaler-broker-user "${SERVICE_BROKER_PASSWORD}" "https://${service_broker_name:-}.${system_domain:-}"
69+
70+
cf logout

‎scripts/register-broker.sh‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

0 commit comments

Comments
 (0)