opendev/system-config
Code Issues Proposed changes

Set the gitpgpkey for signing nodes

Browse Source 
Since our infrastructure signing key includes a unique comment field
in its name which changes with the key each cycle when it's rotated,
we need to explicitly let Git know how to identify the key (it
doesn't automatically rely on the default secret key in the keychain
and instead expects that any optional comment be part of the name).
Use an E-mail address to identify the signing key to Git since this
will remain the same through rotation, and since the
jenkins::jenkinsuser module completely replaces the keyring files
we can simply insure our process only ever sets one key for that
address in the provided keyring contents (which is how we document
doing it already).

Change-Id: I78fe7fa331ae9b51ff0fbf91c0c2f8961b09eb88
Depends-On: Id577c4479abd2f443f73c630a12e94d3ebe63660
This commit is contained in:
Jeremy Stanley 2016-07-29 18:44:52 +00:00
parent b17b6f744b
commit c2fc3cd018
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
modules/openstack_project/manifests/signing_node.pp
View File

@ -21,6 +21,7 @@ class openstack_project::signing_node (
$secring, $secring,
$gitfullname = 'OpenStack Release Bot', $gitfullname = 'OpenStack Release Bot',
$gitemail = 'infra-root@openstack.org', $gitemail = 'infra-root@openstack.org',
$gitpgpkey = 'infra-root@openstack.org',
$gerrituser = 'release', $gerrituser = 'release',
$gerritkey = undef, $gerritkey = undef,
$project_config_repo = 'https://git.openstack.org/openstack-infra/project-config', $project_config_repo = 'https://git.openstack.org/openstack-infra/project-config',
@ -31,6 +32,7 @@ class openstack_project::signing_node (
ssh_key => $jenkins_ssh_public_key, ssh_key => $jenkins_ssh_public_key,
jenkins_gitfullname => $gitfullname, jenkins_gitfullname => $gitfullname,
jenkins_gitemail => $gitemail, jenkins_gitemail => $gitemail,
jenkins_gitpgpkey => $gitpgpkey,
jenkins_gerrituser => $gerrituser, jenkins_gerrituser => $gerrituser,
jenkins_gerritkey => $gerritkey, jenkins_gerritkey => $gerritkey,
project_config_repo => $project_config_repo, project_config_repo => $project_config_repo,

2
modules/openstack_project/manifests/slave.pp
View File

@ -7,6 +7,7 @@ class openstack_project::slave (
$sysadmins = [], $sysadmins = [],
$jenkins_gitfullname = 'OpenStack Jenkins', $jenkins_gitfullname = 'OpenStack Jenkins',
$jenkins_gitemail = 'jenkins@openstack.org', $jenkins_gitemail = 'jenkins@openstack.org',
$jenkins_gitpgpkey = 'jenkins@openstack.org',
$jenkins_gerrituser = 'jenkins', $jenkins_gerrituser = 'jenkins',
$jenkins_gerritkey = undef, $jenkins_gerritkey = undef,
$project_config_repo = 'https://git.openstack.org/openstack-infra/project-config', $project_config_repo = 'https://git.openstack.org/openstack-infra/project-config',
@ -28,6 +29,7 @@ class openstack_project::slave (
ssh_key => $ssh_key, ssh_key => $ssh_key,
gitfullname => $jenkins_gitfullname, gitfullname => $jenkins_gitfullname,
gitemail => $jenkins_gitemail, gitemail => $jenkins_gitemail,
gitpgpkey => $jenkins_gitpgpkey,
gerrituser => $jenkins_gerrituser, gerrituser => $jenkins_gerrituser,
gerritkey => $jenkins_gerritkey, gerritkey => $jenkins_gerritkey,
} }