Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Remove secure repo and fetch secrets from AWS #1673

Merged
merged 1 commit into from
Oct 27, 2023
Merged

chore: Remove secure repo and fetch secrets from AWS #1673

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion devops/jobs/UserRetirementArchiver.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,8 +74,8 @@ class UserRetirementArchiver {

wrappers {
credentialsBinding {
file('AWS_CONFIG_FILE','tools-edx-jenkins-aws-credentials')
string('ROLE_ARN', extraVars.get('ENVIRONMENT_DEPLOYMENT') + '-retirement-archive-upload-role')
string('SECRET_ARN', extraVars.get('ENVIRONMENT_DEPLOYMENT') + '-retirement-archive-secret-role')
}
}

Expand Down
20 changes: 19 additions & 1 deletion devops/resources/user-retirement-archiver.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,23 @@ env
set -ex

cd $WORKSPACE/configuration
pip install -r util/jenkins/requirements.txt

. util/jenkins/assume-role.sh

# hide the sensitive information in the logs
set +x

CONFIG_YAML=$(aws secretsmanager get-secret-value --secret-id "${SECRET_ARN}" --region "us-east-1" --output json | jq -r '.SecretString' | yq -y .)

# Create a temporary file to store the YAML
TEMP_CONFIG_YAML=$(mktemp $WORKSPACE/tempfile.XXXXXXXXXX.yml)

# Write the YAML data to the temporary file
echo "$CONFIG_YAML" > "$TEMP_CONFIG_YAML"

set -x

assume-role ${ROLE_ARN}

# prepare tubular
Expand All @@ -26,9 +41,12 @@ fi

# Call the script to read the retirement statuses from the LMS, send them to S3, and delete them from the LMS.
python scripts/retirement_archive_and_cleanup.py \
--config_file=$WORKSPACE/user-retirement-secure/${ENVIRONMENT_DEPLOYMENT}.yml \
--config_file=$TEMP_CONFIG_YAML \
--cool_off_days=$COOL_OFF_DAYS \
--batch_size=$BATCH_SIZE \
--start_date=$START_DATE \
--end_date=$END_DATE \
--dry_run=$DRY_RUN

# Remove the temporary file after processing
rm -f "$TEMP_CONFIG_YAML"
17 changes: 0 additions & 17 deletions src/main/groovy/org/edx/jenkins/dsl/UserRetirementConstants.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,23 +59,6 @@ class UserRetirementConstants {

public static def common_multiscm = { extraVars ->
return {
git {
remote {
url('[email protected]:edx-ops/user-retirement-secure.git')
if (extraVars.containsKey('SECURE_GIT_CREDENTIALS')) {
credentials(extraVars.get('SECURE_GIT_CREDENTIALS'))
}
}
branch('$USER_RETIREMENT_SECURE_BRANCH')
extensions {
relativeTargetDirectory('user-retirement-secure')
cloneOptions {
shallow()
timeout(10)
}
cleanBeforeCheckout()
}
}
git {
remote {
url('https://github.com/edx/tubular.git')
Expand Down
Loading