hiera-eyaml-gkms 0.1.1 → 0.2.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (14) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/release.yml +30 -0
  3. data/.github/workflows/test.yml +84 -0
  4. data/.gitignore +5 -1
  5. data/.rubocop.yml +11 -36
  6. data/CHANGELOG.md +3 -0
  7. data/Gemfile +29 -0
  8. data/README.md +5 -3
  9. data/Rakefile +23 -1
  10. data/hiera-eyaml-gkms.gemspec +12 -15
  11. data/lib/hiera/backend/eyaml/encryptors/gkms/version.rb +1 -1
  12. data/lib/hiera/backend/eyaml/encryptors/gkms.rb +3 -2
  13. metadata +11 -48
  14. data/.travis.yml +0 -19
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 552d587ebe8aa72333f29a12094cb2afa42343b68c3814d827ba1275b9f59744
4
- data.tar.gz: c3a3cabb664a4e490898c2fd36645abe5150438f816dc16ede5b8616d1a9dad1
3
+ metadata.gz: abebb63c34e498568039fc4a7489167332b7f07000420fc097a55ca9c3460158
4
+ data.tar.gz: ce894e6b529bb05e72adaccb1b57f9391a27c9c5299e10b70ef194064e7b342a
5
5
  SHA512:
6
- metadata.gz: d5a1dd9d2a644c2c51417b333d75d1dfce07bd2d50ef0bc5e4f46729c6dea8b78807d1295e07cf004bc9fd70f9aad317694d5c8f886573c1687216fd34c30118
7
- data.tar.gz: ea0808a4fe08991ed1f2710acdb946d1f23546c0af86e005d4da5a45d68c87c29b0b433365487df228f16ea6dd1e5c8a93929c9127d88eb2d370ad81d1810099
6
+ metadata.gz: c434a5041678dfb4f8803dca7b411e4c759bfac5222f7fbeb7f6a1a8ad0347703bac8cc706695ddf188cf72754ac6e6f0228b99bfc2a33fa094babd07e5354e1
7
+ data.tar.gz: ed69bf8d140839cb40c724e44b3f8b19ea1ab6452c6cf5e1b005d6dcec2b1344b2e11bc38b10b26db39d703830188abae230b40ca303f45d0537b30f1a7153bf
data/.github/workflows/release.yml ADDED
@@ -0,0 +1,30 @@
1
+ name: Release
2
+
3
+ on:
4
+ push:
5
+ tags:
6
+ - '*'
7
+
8
+ jobs:
9
+ release:
10
+ runs-on: ubuntu-latest
11
+ if: github.repository_owner == 'craigwatson'
12
+ steps:
13
+ - uses: actions/checkout@v2
14
+ - name: Install Ruby 3.1
15
+ uses: ruby/setup-ruby@v1
16
+ with:
17
+ ruby-version: '3.1'
18
+ - name: Build gem
19
+ run: gem build *.gemspec
20
+ - name: Publish gem to rubygems.org
21
+ run: gem push *.gem
22
+ env:
23
+ GEM_HOST_API_KEY: '${{ secrets.RUBYGEMS_AUTH_TOKEN }}'
24
+ - name: Setup GitHub packages access
25
+ run: |
26
+ mkdir -p ~/.gem
27
+ echo ":github: Bearer ${{ secrets.GITHUB_TOKEN }}" >> ~/.gem/credentials
28
+ chmod 0600 ~/.gem/credentials
29
+ - name: Publish gem to GitHub packages
30
+ run: gem push --key github --host https://rubygems.pkg.github.com/craigwatson *.gem
data/.github/workflows/test.yml ADDED
@@ -0,0 +1,84 @@
1
+ name: Test
2
+
3
+ on:
4
+ - pull_request
5
+ - push
6
+
7
+ env:
8
+ BUNDLE_WITHOUT: release
9
+
10
+ jobs:
11
+ test:
12
+ runs-on: ubuntu-latest
13
+ strategy:
14
+ fail-fast: false
15
+ matrix:
16
+ ruby:
17
+ - "2.5"
18
+ - "2.6"
19
+ - "2.7"
20
+ - "3.0"
21
+ - "3.1"
22
+ puppet:
23
+ - "~> 7.0"
24
+ - "~> 6.0"
25
+ - "https://github.com/puppetlabs/puppet.git#main"
26
+ exclude:
27
+ - ruby: "2.6"
28
+ puppet: "~> 7.0"
29
+ - ruby: "2.5"
30
+ puppet: "~> 7.0"
31
+
32
+ - ruby: "3.1"
33
+ puppet: "~> 6.0"
34
+ - ruby: "3.0"
35
+ puppet: "~> 6.0"
36
+
37
+ - ruby: "2.6"
38
+ puppet: "https://github.com/puppetlabs/puppet.git#main"
39
+ - ruby: "2.5"
40
+ puppet: "https://github.com/puppetlabs/puppet.git#main"
41
+ env:
42
+ PUPPET_VERSION: ${{ matrix.puppet }}
43
+ COVERAGE: ${{ matrix.coverage }}
44
+ name: "Ruby ${{ matrix.ruby }} - Puppet ${{ matrix.puppet }}"
45
+ steps:
46
+ - name: Enable coverage reporting on Ruby 3.1
47
+ if: matrix.puppet == '~> 7.0' && matrix.ruby == '3.1'
48
+ run: echo 'COVERAGE=yes' >> $GITHUB_ENV
49
+ - uses: actions/checkout@v2
50
+ - name: Install Ruby ${{ matrix.ruby }}
51
+ uses: ruby/setup-ruby@v1
52
+ with:
53
+ ruby-version: ${{ matrix.ruby }}
54
+ bundler-cache: true
55
+ - name: Rubocop
56
+ run: bundle exec rubocop
57
+ - name: Verify Build
58
+ run: gem build *.gemspec
59
+ - name: Integration
60
+ env:
61
+ GCP_CREDENTIALS: ${{ secrets.GCP_CREDENTIALS }}
62
+ GCP_PROJECT: ${{ secrets.GCP_PROJECT }}
63
+ GCP_LOCATION: ${{ secrets.GCP_LOCATION }}
64
+ GCP_KEYRING: ${{ secrets.GCP_KEYRING }}
65
+ GCP_CRYPTO_KEY: ${{ secrets.GCP_CRYPTO_KEY }}
66
+ run: |
67
+ echo "${GCP_CREDENTIALS}" > ./credentials.json
68
+ echo "${GITHUB_SHA}" > ./input.txt
69
+ bundle exec eyaml encrypt --gkms-project="${GCP_PROJECT}" \
70
+ --gkms-location="${GCP_LOCATION}" \
71
+ --gkms-keyring="${GCP_KEYRING}" \
72
+ --gkms-crypto-key="${GCP_CRYPTO_KEY}" \
73
+ --gkms-credentials=./credentials.json \
74
+ -n gkms -o string -s "${GITHUB_SHA}" > ./cipher.txt
75
+ bundle exec eyaml decrypt --gkms-project="${GCP_PROJECT}" \
76
+ --gkms-location="${GCP_LOCATION}" \
77
+ --gkms-keyring="${GCP_KEYRING}" \
78
+ --gkms-crypto-key="${GCP_CRYPTO_KEY}" \
79
+ --gkms-credentials=./credentials.json \
80
+ -n gkms -f ./cipher.txt > ./plain.txt
81
+ echo "Input: ${GITHUB_SHA}"
82
+ echo "Ciphertext: $(cat ./cipher.txt)"
83
+ echo "Plaintext: $(cat ./plain.txt)"
84
+ diff ./input.txt ./plain.txt
data/.gitignore CHANGED
@@ -6,5 +6,9 @@ pkg/
6
6
  tmp/
7
7
  .DS_Store
8
8
  .ruby-version
9
- hiera-eyaml-google-kms-*.gem
9
+ *.gem
10
10
  Gemfile.lock
11
+ vendor
12
+ .bundle/
13
+ .envrc
14
+ credentials.json
data/.rubocop.yml CHANGED
@@ -1,14 +1,23 @@
1
1
  ---
2
2
  AllCops:
3
3
  DisplayCopNames: true
4
- TargetRubyVersion: '2.4'
5
- Metrics/LineLength:
4
+ NewCops: enable
5
+ SuggestExtensions: false
6
+ Gemspec/RequiredRubyVersion:
7
+ Enabled: false
8
+ Gemspec/RequireMFA:
9
+ Enabled: false
10
+ Layout/LineLength:
6
11
  Description: People have wide screens, use them.
7
12
  Max: 200
13
+ Metrics/MethodLength:
14
+ Enabled: false
8
15
  Style/BlockDelimiters:
9
16
  Description: Prefer braces for chaining. Mostly an aesthetical choice. Better to
10
17
  be consistent then.
11
18
  EnforcedStyle: braces_for_chaining
19
+ Style/HashSyntax:
20
+ EnforcedShorthandSyntax: either
12
21
  Style/EmptyElse:
13
22
  Description: Enforce against empty else clauses, but allow `nil` for clarity.
14
23
  EnforcedStyle: empty
@@ -47,37 +56,3 @@ Style/Documentation:
47
56
  - spec/**/*
48
57
  Style/WordArray:
49
58
  EnforcedStyle: brackets
50
- Style/ClassAndModuleChildren:
51
- Enabled: false
52
- Style/CollectionMethods:
53
- Enabled: true
54
- Style/MethodCalledOnDoEndBlock:
55
- Enabled: true
56
- Style/StringMethods:
57
- Enabled: true
58
- Layout/EndOfLine:
59
- Enabled: false
60
- Layout/HeredocIndentation:
61
- Enabled: false
62
- Metrics/AbcSize:
63
- Enabled: false
64
- Metrics/BlockLength:
65
- Enabled: false
66
- Metrics/ClassLength:
67
- Enabled: false
68
- Metrics/CyclomaticComplexity:
69
- Enabled: false
70
- Metrics/MethodLength:
71
- Enabled: false
72
- Metrics/ModuleLength:
73
- Enabled: false
74
- Metrics/ParameterLists:
75
- Enabled: false
76
- Metrics/PerceivedComplexity:
77
- Enabled: false
78
- Style/AsciiComments:
79
- Enabled: false
80
- Style/IfUnlessModifier:
81
- Enabled: false
82
- Style/SymbolProc:
83
- Enabled: false
data/CHANGELOG.md CHANGED
@@ -3,6 +3,9 @@
3
3
  Release notes for the Google Cloud KMS hiera-eyaml plugin.
4
4
 
5
5
  ---------------------------------------------------------
6
+ ## 2022-11-13 - 0.2.0
7
+ * Fully supporting google-cloud-kms 2.0 constructor syntax
8
+
6
9
  ## 2021-06-03 - 0.1.1
7
10
  * Loosened dependency version requirement on hiera-eyaml for compatibility with Puppet 7.7
8
11
 
data/Gemfile CHANGED
@@ -1,4 +1,33 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  source 'https://rubygems.org/'
4
+
5
+ # Find a location or specific version for a gem. place_or_version can be a
6
+ # version, which is most often used. It can also be git, which is specified as
7
+ # `git://somewhere.git#branch`. You can also use a file source location, which
8
+ # is specified as `file://some/location/on/disk`.
9
+ def location_for(place_or_version, fake_version = nil)
10
+ case place_or_version
11
+ when %r{^(https[:@][^#]*)#(.*)}
12
+ [fake_version, { git: Regexp.last_match(1), branch: Regexp.last_match(2), require: false }].compact
13
+ when %r{^file://(.*)}
14
+ ['>= 0', { path: File.expand_path(Regexp.last_match(1)), require: false }]
15
+ else
16
+ [place_or_version, { require: false }]
17
+ end
18
+ end
19
+
4
20
  gemspec
21
+
22
+ group :development do
23
+ gem 'puppet', *location_for(ENV.fetch('PUPPET_VERSION')) if ENV.fetch('PUPPET_VERSION', nil)
24
+ end
25
+
26
+ group :test do
27
+ gem 'rubocop'
28
+ end
29
+
30
+ group :coverage, optional: ENV.fetch('COVERAGE', nil) != 'yes' do
31
+ gem 'codecov', require: false
32
+ gem 'simplecov-console', require: false
33
+ end
data/README.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # hiera-eyaml-gkms
2
2
 
3
- [![Build Status](https://secure.travis-ci.org/craigwatson/hiera-eyaml-gkms.svg?branch=master)](http://travis-ci.org/craigwatson/hiera-eyaml-gkms)
3
+ [![Build Status](https://github.com/craigwatson/hiera-eyaml-gkms/actions/workflows/test.yml/badge.svg?branch=master)](https://github.com/craigwatson/hiera-eyaml-gkms/actions/workflows/test.yml?query=branch%3Amaster++)
4
4
  [![Gem Version](https://img.shields.io/gem/v/hiera-eyaml-gkms.svg)](https://rubygems.org/gems/hiera-eyaml-gkms)
5
5
  [![Gem Downloads](https://img.shields.io/gem/dt/hiera-eyaml-gkms.svg)](https://rubygems.org/gems/hiera-eyaml-gkms)
6
6
 
@@ -62,6 +62,8 @@ The plugin can also be run using Google Compute Engine's service account by pass
62
62
 
63
63
  ## Terraform Example
64
64
 
65
+ _Note: Due to changes in Terraform provider syntax and formatting, this code may age!_
66
+
65
67
  ```
66
68
  resource "google_kms_key_ring" "keyring" {
67
69
  name = "keyring"
@@ -70,7 +72,7 @@ resource "google_kms_key_ring" "keyring" {
70
72
 
71
73
  resource "google_kms_crypto_key" "puppet_eyaml" {
72
74
  name = "puppet_eyaml"
73
- key_ring = "${google_kms_key_ring.keyring.self_link}"
75
+ key_ring = google_kms_key_ring.keyring.self_link
74
76
 
75
77
  lifecycle {
76
78
  prevent_destroy = true
@@ -78,7 +80,7 @@ resource "google_kms_crypto_key" "puppet_eyaml" {
78
80
  }
79
81
 
80
82
  resource "google_kms_crypto_key_iam_member" "eyaml" {
81
- crypto_key_id = "${google_kms_crypto_key.puppet_eyaml.self_link}"
83
+ crypto_key_id = google_kms_crypto_key.puppet_eyaml.self_link
82
84
  role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
83
85
  member = "serviceAccount:${data.google_project.project.number}-compute@developer.gserviceaccount.com"
84
86
  }
data/Rakefile CHANGED
@@ -1,8 +1,30 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ begin
4
+ require 'simplecov'
5
+ require 'simplecov-console'
6
+ require 'codecov'
7
+ rescue LoadError
8
+ else
9
+ SimpleCov.start do
10
+ track_files 'lib/**/*.rb'
11
+ add_filter '/spec'
12
+ enable_coverage :branch
13
+
14
+ # do not track vendored files
15
+ add_filter '/vendor'
16
+ add_filter '/.vendor'
17
+ end
18
+
19
+ SimpleCov.formatters = [
20
+ SimpleCov::Formatter::Console,
21
+ SimpleCov::Formatter::Codecov,
22
+ ]
23
+ end
24
+
3
25
  require 'bundler/gem_tasks'
4
- require 'rubocop/rake_task'
5
26
 
27
+ require 'rubocop/rake_task'
6
28
  RuboCop::RakeTask.new(:rubocop) do |t|
7
29
  t.options = ['--display-cop-names']
8
30
  end
data/hiera-eyaml-gkms.gemspec CHANGED
@@ -7,24 +7,21 @@ require 'hiera/backend/eyaml/encryptors/gkms/version'
7
7
  require 'English'
8
8
 
9
9
  Gem::Specification.new do |gem|
10
- gem.name = 'hiera-eyaml-gkms'
11
- gem.version = Hiera::Backend::Eyaml::Encryptors::GkmsVersion::VERSION
10
+ gem.name = 'hiera-eyaml-gkms'
11
+ gem.version = Hiera::Backend::Eyaml::Encryptors::GkmsVersion::VERSION
12
12
  gem.description = 'Google Cloud KMS plugin for Hiera-EYAML'
13
- gem.summary = 'Encryption plugin for hiera-eyaml backend for Hiera, using Google Cloud KMS'
14
- gem.author = 'Craig Watson'
15
- gem.license = 'Apache-2.0'
16
- gem.required_ruby_version = '>=2.4'
13
+ gem.summary = 'Encryption plugin for hiera-eyaml backend for Hiera, using Google Cloud KMS'
14
+ gem.author = 'Craig Watson'
15
+ gem.license = 'Apache-2.0'
16
+ gem.homepage = 'https://github.com/craigwatson/hiera-eyaml-gkms'
17
17
 
18
- gem.homepage = 'https://github.com/craigwatson/hiera-eyaml-gkms'
19
- gem.files = `git ls-files`.split($RS)
20
- gem.executables = gem.files.grep(%r{^bin/}).map { |f| File.basename(f) }
21
- gem.test_files = gem.files.grep(%r{^(test|spec|features)/})
18
+ gem.files = `git ls-files`.split($INPUT_RECORD_SEPARATOR).grep_v(%r{/^features.*$/})
19
+ gem.executables = gem.files.grep(%r{^bin/}).map { |f| File.basename(f) }
22
20
  gem.require_paths = ['lib']
23
21
 
24
- gem.add_runtime_dependency('google-cloud-kms', '2.0.0')
25
- gem.add_runtime_dependency('google-cloud-kms-v1', '0.3.0')
26
- gem.add_runtime_dependency('hiera-eyaml', '>= 3.2.0', '< 4.0')
22
+ gem.add_dependency('google-cloud-kms', '2.0.0')
23
+ gem.add_dependency('hiera-eyaml', '>= 3.2.0', '< 4.0')
27
24
 
28
- gem.add_development_dependency('rake', '13.0.1')
29
- gem.add_development_dependency('rubocop', '1.3.1')
25
+ gem.required_ruby_version = '>= 2.5.0', ' < 4'
26
+ gem.metadata['rubygems_mfa_required'] = 'false'
30
27
  end
data/lib/hiera/backend/eyaml/encryptors/gkms/version.rb CHANGED
@@ -5,7 +5,7 @@ class Hiera
5
5
  module Eyaml
6
6
  module Encryptors
7
7
  module GkmsVersion
8
- VERSION = '0.1.1'
8
+ VERSION = '0.2.0'
9
9
  end
10
10
  end
11
11
  end
data/lib/hiera/backend/eyaml/encryptors/gkms.rb CHANGED
@@ -56,14 +56,15 @@ class Hiera
56
56
  credentials = option :credentials
57
57
  raise StandardError, 'gkms_credentials is not defined' unless credentials
58
58
 
59
- ::Google::Cloud::Kms::V1::KeyManagementService::Client.configure do |config|
59
+ Google::Cloud::Kms.configure do |config|
60
60
  config.credentials = credentials
61
+ config.timeout = 10.0
61
62
  end
62
63
  else
63
64
  ENV['GOOGLE_AUTH_SUPPRESS_CREDENTIALS_WARNINGS'] = '1'
64
65
  end
65
66
 
66
- ::Google::Cloud::Kms::V1::KeyManagementService::Client.new
67
+ ::Google::Cloud::Kms.key_management_service
67
68
  end
68
69
 
69
70
  def self.key_path
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: hiera-eyaml-gkms
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.1
4
+ version: 0.2.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Craig Watson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-06-03 00:00:00.000000000 Z
11
+ date: 2022-11-13 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: google-cloud-kms
@@ -24,20 +24,6 @@ dependencies:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
26
  version: 2.0.0
27
- - !ruby/object:Gem::Dependency
28
- name: google-cloud-kms-v1
29
- requirement: !ruby/object:Gem::Requirement
30
- requirements:
31
- - - '='
32
- - !ruby/object:Gem::Version
33
- version: 0.3.0
34
- type: :runtime
35
- prerelease: false
36
- version_requirements: !ruby/object:Gem::Requirement
37
- requirements:
38
- - - '='
39
- - !ruby/object:Gem::Version
40
- version: 0.3.0
41
27
  - !ruby/object:Gem::Dependency
42
28
  name: hiera-eyaml
43
29
  requirement: !ruby/object:Gem::Requirement
@@ -58,43 +44,16 @@ dependencies:
58
44
  - - "<"
59
45
  - !ruby/object:Gem::Version
60
46
  version: '4.0'
61
- - !ruby/object:Gem::Dependency
62
- name: rake
63
- requirement: !ruby/object:Gem::Requirement
64
- requirements:
65
- - - '='
66
- - !ruby/object:Gem::Version
67
- version: 13.0.1
68
- type: :development
69
- prerelease: false
70
- version_requirements: !ruby/object:Gem::Requirement
71
- requirements:
72
- - - '='
73
- - !ruby/object:Gem::Version
74
- version: 13.0.1
75
- - !ruby/object:Gem::Dependency
76
- name: rubocop
77
- requirement: !ruby/object:Gem::Requirement
78
- requirements:
79
- - - '='
80
- - !ruby/object:Gem::Version
81
- version: 1.3.1
82
- type: :development
83
- prerelease: false
84
- version_requirements: !ruby/object:Gem::Requirement
85
- requirements:
86
- - - '='
87
- - !ruby/object:Gem::Version
88
- version: 1.3.1
89
47
  description: Google Cloud KMS plugin for Hiera-EYAML
90
48
  email:
91
49
  executables: []
92
50
  extensions: []
93
51
  extra_rdoc_files: []
94
52
  files:
53
+ - ".github/workflows/release.yml"
54
+ - ".github/workflows/test.yml"
95
55
  - ".gitignore"
96
56
  - ".rubocop.yml"
97
- - ".travis.yml"
98
57
  - CHANGELOG.md
99
58
  - Gemfile
100
59
  - LICENSE.txt
@@ -108,7 +67,8 @@ files:
108
67
  homepage: https://github.com/craigwatson/hiera-eyaml-gkms
109
68
  licenses:
110
69
  - Apache-2.0
111
- metadata: {}
70
+ metadata:
71
+ rubygems_mfa_required: 'false'
112
72
  post_install_message:
113
73
  rdoc_options: []
114
74
  require_paths:
@@ -117,14 +77,17 @@ required_ruby_version: !ruby/object:Gem::Requirement
117
77
  requirements:
118
78
  - - ">="
119
79
  - !ruby/object:Gem::Version
120
- version: '2.4'
80
+ version: 2.5.0
81
+ - - "<"
82
+ - !ruby/object:Gem::Version
83
+ version: '4'
121
84
  required_rubygems_version: !ruby/object:Gem::Requirement
122
85
  requirements:
123
86
  - - ">="
124
87
  - !ruby/object:Gem::Version
125
88
  version: '0'
126
89
  requirements: []
127
- rubygems_version: 3.0.3
90
+ rubygems_version: 3.3.7
128
91
  signing_key:
129
92
  specification_version: 4
130
93
  summary: Encryption plugin for hiera-eyaml backend for Hiera, using Google Cloud KMS
data/.travis.yml DELETED
@@ -1,19 +0,0 @@
1
- ---
2
- dist: trusty
3
- language: ruby
4
- cache: bundler
5
- sudo: false
6
- before_install:
7
- - bundle -v
8
- - rm Gemfile.lock || true
9
- - gem update --system $RUBYGEMS_VERSION
10
- - gem update bundler
11
- - gem --version
12
- - bundle -v
13
- script:
14
- bundle exec rake rubocop
15
- matrix:
16
- include:
17
- - rvm: 2.4.10
18
- - rvm: 2.6.6
19
- - rvm: 2.7.2