38 lines
1.8 KiB
Bash
Executable File
38 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
ARTIFACTAPI_HOST=artifactapi.k8s.syd1.au.unkin.net
|
|
|
|
warn() { echo "artifactapi-login: $*, pushing unauthenticated" >&2; }
|
|
|
|
artifactapi_login() {
|
|
[ "${PLUGIN_DRY_RUN:-false}" != true ] || return 0
|
|
case "${PLUGIN_REGISTRY:-} ${PLUGIN_REPO:-}" in *"$ARTIFACTAPI_HOST"*) ;; *) return 0 ;; esac
|
|
case "${PLUGIN_REGISTRY:-}" in *"$ARTIFACTAPI_HOST"*) [ -z "${PLUGIN_USERNAME:-}${PLUGIN_PASSWORD:-}" ] || return 0 ;; esac
|
|
case "${PLUGIN_LOGINS:-}" in *"$ARTIFACTAPI_HOST"*) return 0 ;; esac
|
|
|
|
sa=${SA_TOKEN_FILE:-/var/run/secrets/kubernetes.io/serviceaccount/token}
|
|
[ -r "$sa" ] || { warn "no service account token at $sa"; return 0; }
|
|
vault=${PLUGIN_VAULT_ADDR:-${VAULT_ADDR:-https://vault.service.consul:8200}}
|
|
role=${PLUGIN_VAULT_ROLE:-woodpecker_artifactapi_writer}
|
|
oidc_role=${PLUGIN_VAULT_OIDC_ROLE:-artifactapi-writer}
|
|
|
|
client_token=$(SA_JWT=$(cat "$sa") jq -nc --arg role "$role" '{role:$role,jwt:env.SA_JWT}' |
|
|
curl -sfS --max-time 30 -X POST --data @- "$vault/v1/auth/k8s/au/syd1/login" |
|
|
jq -er .auth.client_token) || { warn "vault login as $role failed"; return 0; }
|
|
token=$(printf 'X-Vault-Token: %s\n' "$client_token" |
|
|
curl -sfS --max-time 30 -H @- "$vault/v1/identity/oidc/token/$oidc_role" |
|
|
jq -er .data.token) || { warn "reading identity/oidc/token/$oidc_role failed"; return 0; }
|
|
|
|
PLUGIN_LOGINS=$(printf '%s' "${PLUGIN_LOGINS:-[]}" |
|
|
OIDC_JWT=$token jq -c --arg r "$ARTIFACTAPI_HOST" '. + [{registry:$r,username:"woodpecker",password:env.OIDC_JWT}]') ||
|
|
{ warn "PLUGIN_LOGINS is not valid JSON"; return 0; }
|
|
export PLUGIN_LOGINS
|
|
echo "artifactapi-login: logged in to $ARTIFACTAPI_HOST via vault role $role" >&2
|
|
}
|
|
|
|
if [ -z "${ARTIFACTAPI_LOGIN_NOEXEC:-}" ]; then
|
|
artifactapi_login
|
|
exec /usr/local/bin/dockerd-entrypoint.sh plugin-docker-buildx "$@"
|
|
fi
|