- Notifications
You must be signed in to change notification settings - Fork917
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Add support for gcp access token#1578
Open
marensofier wants to merge21 commits intogetsops:mainChoose a base branch
base:main
Could not load branches
Branch not found:{{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline, and old review comments may become outdated.
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
devstein requested changesAug 18, 2024
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
@marensofier Thank you for your contribution! This has been a frequently requested feature.
I left a few comments, but can you also please add test coverage?
Related to#1358 |
christoffer-eide commentedAug 19, 2024
Regarding the name of the env var, I would consider naming it Also, which of the two should take precedence? In Pulumi it's |
d2142e2 to10b1384Compare…nt variable CLOUDSDK_AUTH_ACCESS_TOKENSigned-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Co-authored-by: Devin Stein <devstein@alumni.upenn.edu>Signed-off-by: Maren Sofie <marensofieringsby@gmail.com>Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
…r gcp kms are used. Also renamed variables and added description.Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 27.1.0+incompatible to 27.1.1+incompatible.- [Release notes](https://github.com/docker/docker/releases)- [Commits](moby/moby@v27.1.0...v27.1.1)---updated-dependencies:- dependency-name: github.com/docker/docker dependency-type: indirect...Signed-off-by: dependabot[bot] <support@github.com>Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Bumps the ci group with 3 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [github/codeql-action](https://github.com/github/codeql-action) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).Updates `actions/upload-artifact` from 4.3.5 to 4.3.6- [Release notes](https://github.com/actions/upload-artifact/releases)- [Commits](actions/upload-artifact@89ef406...834a144)Updates `github/codeql-action` from 3.25.15 to 3.26.0- [Release notes](https://github.com/github/codeql-action/releases)- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)- [Commits](github/codeql-action@afb54ba...eb055d7)Updates `sigstore/cosign-installer` from 3.5.0 to 3.6.0- [Release notes](https://github.com/sigstore/cosign-installer/releases)- [Commits](sigstore/cosign-installer@59acb62...4959ce0)---updated-dependencies:- dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci- dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci- dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci...Signed-off-by: dependabot[bot] <support@github.com>Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Making explicit that only files named `.sops.yaml` will be auto-discovered. And alternative names (like `.sops.yml`) need to be used with the `--config` flag.Signed-off-by: Carlos Zubieta <1976312+ErraticMaker@users.noreply.github.com>Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Co-authored-by: Felix Fontein <felix@fontein.de>Signed-off-by: Carlos Zubieta <1976312+ErraticMaker@users.noreply.github.com>Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Bumps the ci group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [anchore/sbom-action](https://github.com/anchore/sbom-action).Updates `github/codeql-action` from 3.26.0 to 3.26.2- [Release notes](https://github.com/github/codeql-action/releases)- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)- [Commits](github/codeql-action@eb055d7...429e197)Updates `anchore/sbom-action` from 0.17.0 to 0.17.1- [Release notes](https://github.com/anchore/sbom-action/releases)- [Commits](anchore/sbom-action@d94f46e...ab9d16d)---updated-dependencies:- dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci- dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci...Signed-off-by: dependabot[bot] <support@github.com>Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Bumps the go group with 7 updates in the / directory:| Package | From | To || --- | --- | --- || [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) | `1.18.4` | `1.19.0` || [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go) | `1.13.0` | `1.14.0` || [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.30.3` | `1.30.4` || [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.27.27` | `1.27.30` || [github.com/aws/aws-sdk-go-v2/feature/s3/manager](https://github.com/aws/aws-sdk-go-v2) | `1.17.10` | `1.17.14` || [github.com/aws/aws-sdk-go-v2/service/kms](https://github.com/aws/aws-sdk-go-v2) | `1.35.3` | `1.35.5` || [github.com/ory/dockertest/v3](https://github.com/ory/dockertest) | `3.10.0` | `3.11.0` |Updates `cloud.google.com/go/kms` from 1.18.4 to 1.19.0- [Release notes](https://github.com/googleapis/google-cloud-go/releases)- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)- [Commits](googleapis/google-cloud-go@kms/v1.18.4...kms/v1.19.0)Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.13.0 to 1.14.0- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/release.md)- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.13.0...sdk/azcore/v1.14.0)Updates `github.com/aws/aws-sdk-go-v2` from 1.30.3 to 1.30.4- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)- [Commits](aws/aws-sdk-go-v2@v1.30.3...v1.30.4)Updates `github.com/aws/aws-sdk-go-v2/config` from 1.27.27 to 1.27.30- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)- [Commits](aws/aws-sdk-go-v2@config/v1.27.27...config/v1.27.30)Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.17.27 to 1.17.29- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)- [Commits](aws/aws-sdk-go-v2@credentials/v1.17.27...credentials/v1.17.29)Updates `github.com/aws/aws-sdk-go-v2/feature/s3/manager` from 1.17.10 to 1.17.14- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)- [Commits](aws/aws-sdk-go-v2@config/v1.17.10...credentials/v1.17.14)Updates `github.com/aws/aws-sdk-go-v2/service/kms` from 1.35.3 to 1.35.5- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)- [Commits](aws/aws-sdk-go-v2@service/ivs/v1.35.3...service/ecs/v1.35.5)Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.58.3 to 1.60.1- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)- [Commits](aws/aws-sdk-go-v2@service/s3/v1.58.3...service/s3/v1.60.1)Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.30.3 to 1.30.5- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)- [Commits](aws/aws-sdk-go-v2@v1.30.3...service/s3/v1.30.5)Updates `github.com/ory/dockertest/v3` from 3.10.0 to 3.11.0- [Release notes](https://github.com/ory/dockertest/releases)- [Commits](ory/dockertest@v3.10.0...v3.11.0)Updates `golang.org/x/net` from 0.27.0 to 0.28.0- [Commits](golang/net@v0.27.0...v0.28.0)Updates `golang.org/x/sys` from 0.23.0 to 0.24.0- [Commits](golang/sys@v0.23.0...v0.24.0)Updates `golang.org/x/term` from 0.22.0 to 0.23.0- [Commits](golang/term@v0.22.0...v0.23.0)Updates `google.golang.org/api` from 0.190.0 to 0.193.0- [Release notes](https://github.com/googleapis/google-api-go-client/releases)- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)- [Commits](googleapis/google-api-go-client@v0.190.0...v0.193.0)Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20240730163845-b1a4ccb954bf to 0.0.0-20240814211410-ddb44dafa142- [Commits](https://github.com/googleapis/go-genproto/commits)---updated-dependencies:- dependency-name: cloud.google.com/go/kms dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go- dependency-name: github.com/aws/aws-sdk-go-v2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go- dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go- dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/manager dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go- dependency-name: github.com/aws/aws-sdk-go-v2/service/kms dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go- dependency-name: github.com/aws/aws-sdk-go-v2/service/sts dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go- dependency-name: github.com/ory/dockertest/v3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go- dependency-name: golang.org/x/net dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go- dependency-name: golang.org/x/sys dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go- dependency-name: golang.org/x/term dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go- dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go- dependency-name: google.golang.org/genproto/googleapis/rpc dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go...Signed-off-by: dependabot[bot] <support@github.com>Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Bumps the ci group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [anchore/sbom-action](https://github.com/anchore/sbom-action).Updates `github/codeql-action` from 3.26.2 to 3.26.5- [Release notes](https://github.com/github/codeql-action/releases)- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)- [Commits](github/codeql-action@429e197...2c779ab)Updates `anchore/sbom-action` from 0.17.1 to 0.17.2- [Release notes](https://github.com/anchore/sbom-action/releases)- [Commits](anchore/sbom-action@ab9d16d...61119d4)---updated-dependencies:- dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci- dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci...Signed-off-by: dependabot[bot] <support@github.com>Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
d985200 to7e43137CompareThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Looks good! Thanks for incorporating the feedback. One last minor change
Comment on lines +264 to +267
| return []byte(defaultCredentials),nil | ||
| } | ||
| returnnil,nil | ||
| returnnil,fmt.Errorf("could not find Google credential file") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Can you update the function doc comment to reflect behavior change? Right now, it incorrectly readsand may return a nil byte slice if no value is set.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I also changed the description of the SopsGoogleCredentialsOAuthToken, where i forgot to update after removing the possibility of using a file path!
Thank you for all of your comments, and time! 🌻
…access token variableSigned-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
… the errorSigned-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
Signed-off-by: Maren Sofie Ringsby <marensofieringsby@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
The PR now contains a lot of unnecessary files that should be removed. Also--signoff is missing (for DCO). Can you please fix this? Thanks!
| @@ -1,6 +1,7 @@ | |||
| modulegithub.com/getsops/sops/v3 | |||
| go1.22 | |||
| go1.23.0 | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Can you undo this change? Thanks.
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We are facing a situation where we want to use short lived access tokens with a minimum of permissions for the kms, and not use static long lived credentials ✨
That is why we really want to add support for the use of gcp access tokens in sops using the environment variable
GOOGLE_OAUTH_ACCESS_TOKEN(also used by Pulumi/Terrafrom).