search

renovatebot / app-support

Discussion/support issues for the hosted Renovate App
0 stars 0 forks source link

Cannot encrypt GCP service account JSON for Docker Registry password #13

Closed ajcann closed 3 years ago

ajcann commented 5 years ago

What Renovate type are you using? Hosted App

Describe the bug In order to authenticate to Google Container Registry with a read-only service account one must use the username '_json_key' with the password being the service account's json key file (something like 2500 characters). When trying to encrypt this service account json file at https://renovatebot.com/encrypt, I see 'false' in the browser and 'Message too long for RSA' in the browser console. It appears the max accepted characters is ~245.

Perhaps there is another way to authenticate to GCR with a read-only service account?

Reference: https://cloud.google.com/container-registry/docs/advanced-authentication#access_token

Did you see anything helpful in debug logs? 'Message too long for RSA' in browser console at https://renovatebot.com/encrypt

To Reproduce Steps to reproduce the behavior:

  1. Try to encrypt a long string at https://renovatebot.com/encrypt

Expected behavior The string is encrypted and the resulting encrypted string can be used in renovate's encrypted block

rarkins commented 5 years ago

Unfortunately this is a technical limitation with no immediate solution. Our plan is to eventually allow secrets to be uploaded via the Dashboard instead of encoded in config, but that's going to take a bit of work first.

I'm not familiar enough with GCP to know if there's a better way. For AWS's ECR we dynamically generate long authentication keys at runtime by using a standard key/secret pair in config. Potentially if GCP support generating JSON keys at runtime using a shorter username/password then it's an option.

If you would be OK with this read-only key file being seen by us (Renovate hosts) then I could add it manually for you to our backend if you can send it to us via email or some other method that satisfies you.

ajcann commented 5 years ago

Kind of you to offer! I think we'll experiment with a few other options at the moment.

I do believe GCP offers access tokens as well (similar in spirit to the ECR scheme), but I'm not familiar enough with it to say whether it would be a major effort to support.

I don't suppose GitHub Apps have the ability to read secrets (new feature of repos that was introduced with Github Actions) of repos to which it has permission?

rarkins commented 4 years ago

I don't suppose GitHub Apps have the ability to read secrets (new feature of repos that was introduced with Github Actions) of repos to which it has permission?

I don't believe so, unfortunately

rarkins commented 3 years ago

I'm going to archive this repository so that we have conversations in one place. Therefore please create an "App Support" discussion here if this problem or suggestion is still relevant: https://github.com/renovatebot/renovate/discussions