From a3c15320fb42988ae9a66a158962864076f70a20 Mon Sep 17 00:00:00 2001 From: Alex Szabo Date: Tue, 14 May 2024 13:28:01 +0200 Subject: [PATCH 1/2] fix: get legacy-vault credentials from new vault on new infra --- .buildkite/scripts/common/vault_fns.sh | 20 +++++++++++++++++++ .buildkite/scripts/steps/artifacts/publish.sh | 4 ++-- .../scripts/steps/cloud/build_and_deploy.sh | 17 ++++++---------- .buildkite/scripts/steps/serverless/deploy.sh | 19 +++++++----------- 4 files changed, 35 insertions(+), 25 deletions(-) diff --git a/.buildkite/scripts/common/vault_fns.sh b/.buildkite/scripts/common/vault_fns.sh index a7b92a4b05d6d..022a22541d6bf 100644 --- a/.buildkite/scripts/common/vault_fns.sh +++ b/.buildkite/scripts/common/vault_fns.sh @@ -65,3 +65,23 @@ vault_kv_set() { vault kv put "$VAULT_KV_PREFIX/$kv_path" "${fields[@]}" } + +function get_vault_role_id() { + if [[ "$IS_LEGACY_VAULT_ADDR" == "true" ]]; then + VAULT_ROLE_ID="$(retry 5 15 gcloud secrets versions access latest --secret=kibana-buildkite-vault-role-id)" + else + VAULT_ROLE_ID="$(vault_get kibana-buildkite-vault-credentials role-id)" + fi + + echo "$VAULT_ROLE_ID" +} + +function get_vault_secret_id() { + if [[ "$IS_LEGACY_VAULT_ADDR" == "true" ]]; then + VAULT_SECRET_ID="$(retry 5 15 gcloud secrets versions access latest --secret=kibana-buildkite-vault-secret-id)" + else + VAULT_SECRET_ID="$(vault_get kibana-buildkite-vault-credentials secret-id)" + fi + + echo "$VAULT_SECRET_ID" +} diff --git a/.buildkite/scripts/steps/artifacts/publish.sh b/.buildkite/scripts/steps/artifacts/publish.sh index 8aba9e941e3c0..40ea04fc33fea 100644 --- a/.buildkite/scripts/steps/artifacts/publish.sh +++ b/.buildkite/scripts/steps/artifacts/publish.sh @@ -53,8 +53,8 @@ docker pull docker.elastic.co/infra/release-manager:latest echo "--- Publish artifacts" if [[ "$BUILDKITE_BRANCH" == "$KIBANA_BASE_BRANCH" ]]; then - export VAULT_ROLE_ID="$(retry 5 15 gcloud secrets versions access latest --secret=kibana-buildkite-vault-role-id)" - export VAULT_SECRET_ID="$(retry 5 15 gcloud secrets versions access latest --secret=kibana-buildkite-vault-secret-id)" + export VAULT_ROLE_ID="$(get_vault_role_id)" + export VAULT_SECRET_ID="$(get_vault_secret_id)" export VAULT_ADDR="https://secrets.elastic.co:8200" download_artifact beats_manifest.json /tmp --build "${KIBANA_BUILD_ID:-$BUILDKITE_BUILD_ID}" diff --git a/.buildkite/scripts/steps/cloud/build_and_deploy.sh b/.buildkite/scripts/steps/cloud/build_and_deploy.sh index 8b269e2438977..7c270a2279fba 100755 --- a/.buildkite/scripts/steps/cloud/build_and_deploy.sh +++ b/.buildkite/scripts/steps/cloud/build_and_deploy.sh @@ -80,16 +80,18 @@ if [ -z "${CLOUD_DEPLOYMENT_ID}" ] || [ "${CLOUD_DEPLOYMENT_ID}" = 'null' ]; the CLOUD_DEPLOYMENT_STATUS_MESSAGES=$(jq --slurp '[.[]|select(.resources == null)]' "$ECCTL_LOGS") echo "Writing to vault..." - VAULT_ROLE_ID="$(retry 5 15 gcloud secrets versions access latest --secret=kibana-buildkite-vault-role-id)" - VAULT_SECRET_ID="$(retry 5 15 gcloud secrets versions access latest --secret=kibana-buildkite-vault-secret-id)" - VAULT_TOKEN=$(retry 5 30 vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID") - retry 5 30 vault login -no-print "$VAULT_TOKEN" # TODO: remove after https://github.com/elastic/kibana-operations/issues/15 is done if [[ "$IS_LEGACY_VAULT_ADDR" == "true" ]]; then + VAULT_ROLE_ID="$(get_vault_role_id)" + VAULT_SECRET_ID="$(get_vault_secret_id)" + VAULT_TOKEN=$(retry 5 30 vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID") + retry 5 30 vault login -no-print "$VAULT_TOKEN" vault_set "cloud-deploy/$CLOUD_DEPLOYMENT_NAME" username="$CLOUD_DEPLOYMENT_USERNAME" password="$CLOUD_DEPLOYMENT_PASSWORD" + VAULT_READ_COMMAND="vault read $VAULT_PATH_PREFIX/cloud-deploy/$CLOUD_DEPLOYMENT_NAME" else vault_kv_set "cloud-deploy/$CLOUD_DEPLOYMENT_NAME" username="$CLOUD_DEPLOYMENT_USERNAME" password="$CLOUD_DEPLOYMENT_PASSWORD" + VAULT_READ_COMMAND="vault kv get $VAULT_KV_PREFIX/cloud-deploy/$CLOUD_DEPLOYMENT_NAME" fi echo "Enabling Stack Monitoring..." @@ -125,13 +127,6 @@ fi CLOUD_DEPLOYMENT_KIBANA_URL=$(ecctl deployment show "$CLOUD_DEPLOYMENT_ID" | jq -r '.resources.kibana[0].info.metadata.aliased_url') CLOUD_DEPLOYMENT_ELASTICSEARCH_URL=$(ecctl deployment show "$CLOUD_DEPLOYMENT_ID" | jq -r '.resources.elasticsearch[0].info.metadata.aliased_url') -# TODO: remove after https://github.com/elastic/kibana-operations/issues/15 is done -if [[ "$IS_LEGACY_VAULT_ADDR" == "true" ]]; then - VAULT_READ_COMMAND="vault read $VAULT_PATH_PREFIX/cloud-deploy/$CLOUD_DEPLOYMENT_NAME" -else - VAULT_READ_COMMAND="vault kv get $VAULT_KV_PREFIX/cloud-deploy/$CLOUD_DEPLOYMENT_NAME" -fi - cat << EOF | buildkite-agent annotate --style "info" --context cloud ### Cloud Deployment diff --git a/.buildkite/scripts/steps/serverless/deploy.sh b/.buildkite/scripts/steps/serverless/deploy.sh index 11191e803509c..c5407ce900c83 100644 --- a/.buildkite/scripts/steps/serverless/deploy.sh +++ b/.buildkite/scripts/steps/serverless/deploy.sh @@ -89,16 +89,18 @@ deploy() { PROJECT_PASSWORD=$(jq -r --slurp '.[2].password' $DEPLOY_LOGS) echo "Write to vault..." - VAULT_ROLE_ID="$(retry 5 15 gcloud secrets versions access latest --secret=kibana-buildkite-vault-role-id)" - VAULT_SECRET_ID="$(retry 5 15 gcloud secrets versions access latest --secret=kibana-buildkite-vault-secret-id)" - VAULT_TOKEN=$(retry 5 30 vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID") - retry 5 30 vault login -no-print "$VAULT_TOKEN" # TODO: remove after https://github.com/elastic/kibana-operations/issues/15 is done if [[ "$IS_LEGACY_VAULT_ADDR" == "true" ]]; then + VAULT_ROLE_ID="$(get_vault_role_id)" + VAULT_SECRET_ID="$(get_vault_secret_id)" + VAULT_TOKEN=$(retry 5 30 vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID") + retry 5 30 vault login -no-print "$VAULT_TOKEN" vault_set "cloud-deploy/$VAULT_KEY_NAME" username="$PROJECT_USERNAME" password="$PROJECT_PASSWORD" id="$PROJECT_ID" + VAULT_READ_COMMAND="vault read $VAULT_PATH_PREFIX/cloud-deploy/$VAULT_KEY_NAME" else vault_kv_set "cloud-deploy/$VAULT_KEY_NAME" username="$PROJECT_USERNAME" password="$PROJECT_PASSWORD" id="$PROJECT_ID" + VAULT_READ_COMMAND="vault kv get $VAULT_KV_PREFIX/cloud-deploy/$VAULT_KEY_NAME" fi else @@ -114,13 +116,6 @@ deploy() { PROJECT_KIBANA_LOGIN_URL="${PROJECT_KIBANA_URL}/login" PROJECT_ELASTICSEARCH_URL=$(jq -r --slurp '.[1].endpoints.elasticsearch' $DEPLOY_LOGS) - # TODO: remove after https://github.com/elastic/kibana-operations/issues/15 is done - if [[ "$IS_LEGACY_VAULT_ADDR" == "true" ]]; then - VAULT_READ_COMMAND="vault read $VAULT_PATH_PREFIX/cloud-deploy/$VAULT_KEY_NAME" - else - VAULT_READ_COMMAND="vault kv get $VAULT_KV_PREFIX/cloud-deploy/$VAULT_KEY_NAME" - fi - cat << EOF | buildkite-agent annotate --style "info" --context "project-$PROJECT_TYPE" ### $PROJECT_TYPE_LABEL Deployment @@ -142,7 +137,7 @@ create_github_issue_oblt_test_environments() { echo "--- Create GitHub issue for deploying in the oblt test env" -GITHUB_ISSUE=$(mktemp --suffix ".md") +GITHUB_ISSUE=$(mktemp --suffix ".md") cat < "$GITHUB_ISSUE" ### Kibana image From bd089086cd36257b9143c6d9e6d8bbe80d920d69 Mon Sep 17 00:00:00 2001 From: Alex Szabo Date: Tue, 14 May 2024 18:28:25 +0200 Subject: [PATCH 2/2] undo VAULT_READ_COMMAND co-location, it's incorrectly placed in an if branch, and fails on redeploys --- .buildkite/scripts/steps/cloud/build_and_deploy.sh | 9 +++++++-- .buildkite/scripts/steps/serverless/deploy.sh | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.buildkite/scripts/steps/cloud/build_and_deploy.sh b/.buildkite/scripts/steps/cloud/build_and_deploy.sh index 7c270a2279fba..7e7c91f717c84 100755 --- a/.buildkite/scripts/steps/cloud/build_and_deploy.sh +++ b/.buildkite/scripts/steps/cloud/build_and_deploy.sh @@ -88,10 +88,8 @@ if [ -z "${CLOUD_DEPLOYMENT_ID}" ] || [ "${CLOUD_DEPLOYMENT_ID}" = 'null' ]; the VAULT_TOKEN=$(retry 5 30 vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID") retry 5 30 vault login -no-print "$VAULT_TOKEN" vault_set "cloud-deploy/$CLOUD_DEPLOYMENT_NAME" username="$CLOUD_DEPLOYMENT_USERNAME" password="$CLOUD_DEPLOYMENT_PASSWORD" - VAULT_READ_COMMAND="vault read $VAULT_PATH_PREFIX/cloud-deploy/$CLOUD_DEPLOYMENT_NAME" else vault_kv_set "cloud-deploy/$CLOUD_DEPLOYMENT_NAME" username="$CLOUD_DEPLOYMENT_USERNAME" password="$CLOUD_DEPLOYMENT_PASSWORD" - VAULT_READ_COMMAND="vault kv get $VAULT_KV_PREFIX/cloud-deploy/$CLOUD_DEPLOYMENT_NAME" fi echo "Enabling Stack Monitoring..." @@ -124,6 +122,13 @@ else ecctl deployment update "$CLOUD_DEPLOYMENT_ID" --track --output json --file /tmp/deploy.json > "$ECCTL_LOGS" fi +# TODO: remove after https://github.com/elastic/kibana-operations/issues/15 is done +if [[ "$IS_LEGACY_VAULT_ADDR" == "true" ]]; then + VAULT_READ_COMMAND="vault read $VAULT_PATH_PREFIX/cloud-deploy/$CLOUD_DEPLOYMENT_NAME" +else + VAULT_READ_COMMAND="vault kv get $VAULT_KV_PREFIX/cloud-deploy/$CLOUD_DEPLOYMENT_NAME" +fi + CLOUD_DEPLOYMENT_KIBANA_URL=$(ecctl deployment show "$CLOUD_DEPLOYMENT_ID" | jq -r '.resources.kibana[0].info.metadata.aliased_url') CLOUD_DEPLOYMENT_ELASTICSEARCH_URL=$(ecctl deployment show "$CLOUD_DEPLOYMENT_ID" | jq -r '.resources.elasticsearch[0].info.metadata.aliased_url') diff --git a/.buildkite/scripts/steps/serverless/deploy.sh b/.buildkite/scripts/steps/serverless/deploy.sh index c5407ce900c83..ad9c661540ffb 100644 --- a/.buildkite/scripts/steps/serverless/deploy.sh +++ b/.buildkite/scripts/steps/serverless/deploy.sh @@ -97,10 +97,8 @@ deploy() { VAULT_TOKEN=$(retry 5 30 vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID" secret_id="$VAULT_SECRET_ID") retry 5 30 vault login -no-print "$VAULT_TOKEN" vault_set "cloud-deploy/$VAULT_KEY_NAME" username="$PROJECT_USERNAME" password="$PROJECT_PASSWORD" id="$PROJECT_ID" - VAULT_READ_COMMAND="vault read $VAULT_PATH_PREFIX/cloud-deploy/$VAULT_KEY_NAME" else vault_kv_set "cloud-deploy/$VAULT_KEY_NAME" username="$PROJECT_USERNAME" password="$PROJECT_PASSWORD" id="$PROJECT_ID" - VAULT_READ_COMMAND="vault kv get $VAULT_KV_PREFIX/cloud-deploy/$VAULT_KEY_NAME" fi else @@ -116,6 +114,13 @@ deploy() { PROJECT_KIBANA_LOGIN_URL="${PROJECT_KIBANA_URL}/login" PROJECT_ELASTICSEARCH_URL=$(jq -r --slurp '.[1].endpoints.elasticsearch' $DEPLOY_LOGS) + # TODO: remove after https://github.com/elastic/kibana-operations/issues/15 is done + if [[ "$IS_LEGACY_VAULT_ADDR" == "true" ]]; then + VAULT_READ_COMMAND="vault read $VAULT_PATH_PREFIX/cloud-deploy/$VAULT_KEY_NAME" + else + VAULT_READ_COMMAND="vault kv get $VAULT_KV_PREFIX/cloud-deploy/$VAULT_KEY_NAME" + fi + cat << EOF | buildkite-agent annotate --style "info" --context "project-$PROJECT_TYPE" ### $PROJECT_TYPE_LABEL Deployment