CI specific init script updates
Add a vault integration so that we don't need Jenkins to do that for
us
- This will make it easier to enable for windows too
Move everything to a single file so we can read other secrets in the
same way
-if (System.env.ELASTIC_ARTIFACTORY_USERNAME == null || System.env.ELASTIC_ARTIFACTORY_TOKEN == null) {
- throw new GradleException("Using init script without configuration")
-} else {
- logger.info("Using elastic artifactory repos")
- settingsEvaluated { settings ->
- settings.pluginManagement {
+import com.bettercloud.vault.VaultConfig;
+import com.bettercloud.vault.Vault;
+
+initscript {
repositories {
- maven {
- url "https://artifactory.elstc.co/artifactory/gradle-plugins"
+ mavenCentral()
+ }
+ dependencies {
+ classpath 'com.bettercloud:vault-java-driver:4.1.0'
+ }
+}
+
+['VAULT_ADDR', 'VAULT_ROLE_ID', 'VAULT_SECRET_ID'].each {
+ if (System.env."$it" == null) {
+ throw new GradleException("$it must be set!")
+
+ }
+}
+
+final String vaultToken = new Vault(
+ new VaultConfig()
+ .address(System.env.VAULT_ADDR)
+ .engineVersion(1)
+ .build()
+ )
+ .auth()
+ .loginByAppRole("approle", System.env.VAULT_ROLE_ID, System.env.VAULT_SECRET_ID)
+ .getAuthClientToken();
+
+final Vault vault = new Vault(
+ new VaultConfig()
+ .address(System.env.VAULT_ADDR)
+ .engineVersion(1)
+ .token(vaultToken)
+ .build()
+)
+
+final Map<String,String> artifactoryCredentials = vault.logical()
+ .read("secret/elasticsearch-ci/artifactory.elstc.co")
+ .getData();
+
+logger.info("Using elastic artifactory repos")
+Closure configCache = {
+ return {
+ name "artifactory-gradle-release"
+ url "https://artifactory.elstc.co/artifactory/gradle-release"
credentials {
- username System.env.ELASTIC_ARTIFACTORY_USERNAME
- password System.env.ELASTIC_ARTIFACTORY_TOKEN
+ username artifactoryCredentials.get("username")
+ password artifactoryCredentials.get("token")
}
}
- gradlePluginPortal()
+}
+settingsEvaluated { settings ->
+ settings.pluginManagement {
+ repositories {
+ maven configCache()
}
}
}
@@ -20,24 +61,30 @@ if (System.env.ELASTIC_ARTIFACTORY_USERNAME == null || System.env.ELASTIC_ARTIFA
allprojects {
buildscript {
repositories {
- maven {
- url "https://artifactory.elstc.co/artifactory/gradle-release/"
- credentials {
- username System.env.ELASTIC_ARTIFACTORY_USERNAME
- password System.env.ELASTIC_ARTIFACTORY_TOKEN
+ maven configCache()
}
}
+ repositories {
+ maven configCache()
}
}
- repositories {
- maven {
- url "https://artifactory.elstc.co/artifactory/gradle-release/"
- credentials {
- username System.env.ELASTIC_ARTIFACTORY_USERNAME
- password System.env.ELASTIC_ARTIFACTORY_TOKEN
}
+
+if (System.env.GRADLE_BUILD_CACHE_URL != null) {
+ final Map<String,String> buildCacheCredentials = vault.logical()
+ .read("secret/elasticsearch-ci/gradle-build-cache")
+ .getData();
+ gradle.settingsEvaluated { settings ->
+ settings.buildCache {
+ remote(HttpBuildCache) {
+ url = System.getenv('GRADLE_BUILD_CACHE_URL')
+ push = Boolean.valueOf(System.getenv('GRADLE_BUILD_CACHE_PUSH') ?: 'false')
+ credentials {
+ username = buildCacheCredentials.get("username")
+ password = buildCacheCredentials.get("password")
}
}
}
}
}
+
