search

conda-forge / infrastructure

BSD 3-Clause "New" or "Revised" License
0 stars 0 forks source link

Push secrets cirun #2

Closed soapy1 closed 2 weeks ago

soapy1 commented 3 weeks ago

Add workflow for pushing secrets from 1password to GH for CIRUN_API_KEY. CIRUN_API_KEY is a conda-forge org level secret and only conda-forge/admin-requests should have access to it.

beckermr commented 3 weeks ago

There is also retainOnDelete: https://www.pulumi.com/docs/iac/concepts/options/retainondelete/#resource-option-retainondelete

beckermr commented 3 weeks ago

Also we likely want to set the option deleteBeforeReplace to false so that secrets are updated in-plce without disturbing running jobs.

soapy1 commented 3 weeks ago

We should mark reources with protect basically always I think.

Testing this out in my demo repo, turning on protection will not allow updates to be made to the secret.

Enabling retainOnDelete allows updates to be made + doesn't delete the secret when it's removed from the pulumi config.

beckermr commented 3 weeks ago

@soapy1 LGTM!

What is the order of operations here? Your trial org runs out in two weeks, so should we try and get OSS sponsorship and then merge this? Do we merge now? I am not quite sure.

soapy1 commented 3 weeks ago

Looks like pulumi supports migrating state between backends, so I feel ok about merging this now if we are keen.

@jaimergp what is the outlook on oss sponsorship?

jaimergp commented 3 weeks ago

what is the outlook on oss sponsorship?

We need to follow https://www.pulumi.com/pricing/open-source-free-tier/, which consists of submitting an issue in https://github.com/pulumi/team-edition-for-open-source/issues. It should not take too long, but from what I can see in the closed issues, it might be a couple weeks. Also, we need some running Pulumi code in the repo to qualify. I say we merge and then I'll submit the OSS sponsorship issue?

jaimergp commented 3 weeks ago

Also, can we have some documentation in the README? Your demo repo already has some, so I think it's just a matter of copying the relevant bits for future maintainers.

soapy1 commented 2 weeks ago

@beckermr @jaimergp how do y'all want to proceed?

jaimergp commented 2 weeks ago

What are the open questions? I think we just need the README update. The OSS sponsorship can be requested as soon as we merge here.

beckermr commented 2 weeks ago

We need to make an org on pulumi in order to request OSS as well.

So once the README work is done, let's merge here and go ahead with making the org and putting in the request?

soapy1 commented 2 weeks ago

README has been added with instructions on how to run locally and with GHA :+1: Merging :rocket: