ゼロ知識シークレット保管庫 CI/CDパイプライン向け

  stages:  - deploy   deploy_prod:  stage: deploy  image: passwork/passwork-cli:latest  variables:  PASSWORK_HOST: $PASSWORK_HOST  PASSWORK_TOKEN: $PASSWORK_TOKEN  PASSWORK_MASTER_KEY: $PASSWORK_MASTER_KEY  script:  - passwork-cli exec --folder-id "$SECRETS_FOLDER_ID" ./deploy.sh  

  - name: Deploy with secrets  run: |  docker run --rm \  -e PASSWORK_HOST="${{ secrets.PASSWORK_HOST }}" \  -e PASSWORK_TOKEN="${{ secrets.PASSWORK_TOKEN }}" \  -e PASSWORK_MASTER_KEY="${{ secrets.PASSWORK_MASTER_KEY }}" \  -v ${{ github.workspace }}:/app -w /app \  passwork/passwork-cli:latest \  exec --folder-id "${{ vars.SECRETS_FOLDER_ID }}" ./deploy.sh  

  initContainers:  - name: fetch-secrets  image: passwork/passwork-cli:latest  env:  - name: PASSWORK_HOST  valueFrom:  secretKeyRef: { name: passwork-credentials, key: host }  - name: PASSWORK_TOKEN  valueFrom:  secretKeyRef: { name: passwork-credentials, key: token }  command: ["sh", "-c",  "passwork-cli exec --folder-id $SECRETS_FOLDER_ID env> / secrets/.env"]  volumeMounts:  - { name: secrets-volume, mountPath: /secrets }  

  image: passwork/passwork-cli:latest   pipelines:  branches:  main:  - step:  name: Deploy to production  deployment: production  script:  - passwork-cli exec --folder-id "$SECRETS_FOLDER_ID" ./ deploy.sh  

  import os, secrets, psycopg2 from passwork import Client   client = Client(url=os.environ["PASSWORK_HOST"],  token=os.environ["PASSWORK_TOKEN"]) new_password = secrets.token_urlsafe(32)   admin = client.get_password(item_id=os.environ["PG_ADMIN_ITEM_ID"]) conn = psycopg2.connect(host=admin.fields["PG_HOST"],  user=admin.login, password=admin.password) conn.autocommit = True with conn.cursor() as cur:  cur.execute("ALTER ROLE %s WITH PASSWORD %s",  (os.environ["PG_USER"], new_password))   item = client.get_password(item_id=os.environ["TARGET_ITEM_ID"]) item.password = new_password client.update_password(item)