mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-11-26 16:20:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: do not use Groovy string interpolation for credentials

Browse Source 
Jenkins warns in the output of CI jobs about the following:

    Warning: A secret was passed to "sh" using Groovy String interpolation, which is insecure.
        Affected argument(s) used the following variable(s): [CREDS_PASSWD, CREDS_USER]
        See https://jenkins.io/redirect/groovy-string-interpolation for details.

Variable with 'single quotes' and without the {curly brackets} are
expecred to not be affected. There is some indirection in the strings
passed to the `sh` function, so this approach might not fix it?

Signed-off-by: Niels de Vos <ndevos@redhat.com>
This commit is contained in:
Niels de Vos 2021-07-14 15:24:01 +02:00 committed by mergify[bot]
parent b4fcd2b585
commit aca3745e24
6 changed files with 28 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
ci-job-validation.groovy
View File

@ -8,9 +8,27 @@ def git_since = 'ci/centos'
def base = ''
def doc_change = 0
// private, internal container image repository
def cached_image = 'registry-ceph-csi.apps.ocp.ci.centos.org/ceph-csi'
def ci_registry = 'registry-ceph-csi.apps.ocp.ci.centos.org'
def cached_image = 'ceph-csi'
def use_pulled_image = 'USE_PULLED_IMAGE=yes'
def ssh(cmd) {
sh "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@${CICO_NODE} '${cmd}'"
}
def podman_login(registry, username, passwd) {
ssh "podman login --authfile=~/.podman-auth.json --username=${username} --password='${passwd}' ${registry}"
}
// podman_pull pulls image from the source (CI internal) registry, and tags it
// as unqualified image name and into the destination registry. This prevents
// pulling from the destination registry.
//
// Images need to be pre-pushed into the source registry, though.
def podman_pull(source, destination, image) {
ssh "podman pull --authfile=~/.podman-auth.json ${source}/${image} && podman tag ${source}/${image} ${image} ${destination}/${image}"
}
node('cico-workspace') {
stage('checkout ci repository') {
if (params.ghprbPullId != null) {
@ -67,7 +85,7 @@ node('cico-workspace') {
base = "--base=${ghprbTargetBranch}"
}
sh 'scp -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no ./prepare.sh root@${CICO_NODE}:'
sh "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@${CICO_NODE} ./prepare.sh --workdir=/opt/build/go/src/github.com/ceph/ceph-csi --gitrepo=${ci_git_repo} --ref=${ref} ${base}"
ssh "./prepare.sh --workdir=/opt/build/go/src/github.com/ceph/ceph-csi --gitrepo=${ci_git_repo} --ref=${ref} ${base}"
}
// - check if the PR modifies the container image files
@ -84,11 +102,12 @@ node('cico-workspace') {
}
withCredentials([usernamePassword(credentialsId: 'container-registry-auth', usernameVariable: 'CREDS_USER', passwordVariable: 'CREDS_PASSWD')]) {
sh "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@${CICO_NODE} 'podman pull --creds=${CREDS_USER}:${CREDS_PASSWD} ${cached_image}:test'"
podman_login(ci_registry, '$CREDS_USER', '$CREDS_PASSWD')
}
podman_pull(ci_registry, ci_registry, "${cached_image}:test")
}
stage('test') {
sh "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@${CICO_NODE} 'cd /opt/build/go/src/github.com/ceph/ceph-csi && make ENV_CSI_IMAGE_NAME=${cached_image} ${use_pulled_image}'"
ssh "cd /opt/build/go/src/github.com/ceph/ceph-csi && make ENV_CSI_IMAGE_NAME=${cached_image} ${use_pulled_image}"
}
}

2
containerized-tests.groovy
View File

@ -102,7 +102,7 @@ node('cico-workspace') {
returnStatus: true)
withCredentials([usernamePassword(credentialsId: 'container-registry-auth', usernameVariable: 'CREDS_USER', passwordVariable: 'CREDS_PASSWD')]) {
podman_login(ci_registry, "${CREDS_USER}", "${CREDS_PASSWD}")
podman_login(ci_registry, '$CREDS_USER', '$CREDS_PASSWD')
}
parallel test: {

2
k8s-e2e-external-storage.groovy
View File

@ -120,7 +120,7 @@ node('cico-workspace') {
def d_io_regex = ~"^docker.io/"
withCredentials([usernamePassword(credentialsId: 'container-registry-auth', usernameVariable: 'CREDS_USER', passwordVariable: 'CREDS_PASSWD')]) {
podman_login(ci_registry, "${CREDS_USER}", "${CREDS_PASSWD}")
podman_login(ci_registry, '$CREDS_USER', '$CREDS_PASSWD')
}
// base_image is like ceph/ceph:v15 or docker.io/ceph/ceph:v15, strip "docker.io/"

2
mini-e2e-helm.groovy
View File

@ -122,7 +122,7 @@ node('cico-workspace') {
def d_io_regex = ~"^docker.io/"
withCredentials([usernamePassword(credentialsId: 'container-registry-auth', usernameVariable: 'CREDS_USER', passwordVariable: 'CREDS_PASSWD')]) {
podman_login(ci_registry, "${CREDS_USER}", "${CREDS_PASSWD}")
podman_login(ci_registry, '$CREDS_USER', '$CREDS_PASSWD')
}
// base_image is like ceph/ceph:v15 or docker.io/ceph/ceph:v15, strip "docker.io/"

2
mini-e2e.groovy
View File

@ -119,7 +119,7 @@ node('cico-workspace') {
def d_io_regex = ~"^docker.io/"
withCredentials([usernamePassword(credentialsId: 'container-registry-auth', usernameVariable: 'CREDS_USER', passwordVariable: 'CREDS_PASSWD')]) {
podman_login(ci_registry, "${CREDS_USER}", "${CREDS_PASSWD}")
podman_login(ci_registry, '$CREDS_USER', '$CREDS_PASSWD')
}
// base_image is like ceph/ceph:v15 or docker.io/ceph/ceph:v15, strip "docker.io/"

2
upgrade-tests.groovy
View File

@ -119,7 +119,7 @@ node('cico-workspace') {
def d_io_regex = ~"^docker.io/"
withCredentials([usernamePassword(credentialsId: 'container-registry-auth', usernameVariable: 'CREDS_USER', passwordVariable: 'CREDS_PASSWD')]) {
podman_login(ci_registry, "${CREDS_USER}", "${CREDS_PASSWD}")
podman_login(ci_registry, '$CREDS_USER', '$CREDS_PASSWD')
}
// base_image is like ceph/ceph:v15 or docker.io/ceph/ceph:v15, strip "docker.io/"