Change CI to use Vault secrets (mozilla#108)

Xanewok · Sep 15, 2021 · 9c030e4 · 9c030e4
1 parent 42f0557
commit 9c030e4
Showing 1 changed file with 13 additions and 3 deletions.
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -128,11 +128,21 @@ build:
     GIT_STRATEGY:                  none
     DOCKERFILE:                    Dockerfile.vendor.cachepot-dist
     IMAGE_NAME:                    docker.io/paritytech/cachepot-dist
+    VAULT_SERVER_URL:              "https://vault.parity-mgmt-vault.parity.io"
+    VAULT_AUTH_PATH:               "gitlab-parity-io-jwt"
+    VAULT_AUTH_ROLE:               "cicd_gitlab_parity_cachepot"
+  secrets:
+    DOCKER_HUB_USER:
+      vault:                       cicd/gitlab/parity/DOCKER_HUB_USER@kv
+      file:                        false
+    DOCKER_HUB_PASS:
+      vault:                       cicd/gitlab/parity/DOCKER_HUB_PASS@kv
+      file:                        false
   before_script:
     - cd ./artifacts/cachepot/
     - VERSION=${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}
   script:
-    - test "$Docker_Hub_User_Parity" -a "$Docker_Hub_Pass_Parity" ||
+    - test "$DOCKER_HUB_USER" -a "$DOCKER_HUB_PASS" ||
         ( echo "no docker credentials provided"; exit 1 )
     - buildah bud
         --format=docker
@@ -141,8 +151,8 @@ build:
         --tag "$IMAGE_NAME:$VERSION"
         --tag "$IMAGE_NAME:latest"
         --file "$DOCKERFILE" .
-    - echo "$Docker_Hub_Pass_Parity" |
-        buildah login --username "$Docker_Hub_User_Parity" --password-stdin docker.io
+    - echo "$DOCKER_HUB_PASS" |
+        buildah login --username "$DOCKER_HUB_USER" --password-stdin docker.io
     - buildah info
     - buildah push --format=v2s2 "$IMAGE_NAME:$VERSION"
   after_script: