Wikimedia Stewards have repos/stewards group in GitLab. Let's manage it automatically from the Stewards-Onboarding-Tool, to ensure all stewards have access to it.
Description
Description
Details
Details
- Other Assignee
- Urbanecm
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| stewards-onboarder: Add gitlab API to config | operations/puppet | production | +18 -13 |
Event Timeline
Comment Actions
Change #1050731 had a related patch set uploaded (by Urbanecm; author: Urbanecm):
[operations/puppet@production] stewards-onboarder: Add gitlab API to config
Comment Actions
@Dzahn Can you help me with the secrets management here, please? I put the token at stewards1001:/home/urbanecm/gitlab_settings.yaml.
Comment Actions
I added the token in the private hieradata under role/common/stewards with the key profile::stewards::gitlab_api_token.
This means you can now do a:
String $gitlab_api_token = lookup('profile::stewards::gitlab_api_token,... in profile::stewards next to the existing lookups from public hieradata and have the secret value in the variable.
If you have to get it into the yaml written on disk you will then have to turn it from a file to a template (.erb) where we create the steward-onboarder.yaml and then you can use class variables in there.
Comment Actions
@Dzahn Thank you! I tried following your instructions in https://gerrit.wikimedia.org/r/c/operations/puppet/+/1050731, looks like it works. Review appreciated (but definitely can wait for Monday :)).
Comment Actions
Change #1050731 merged by Dzahn:
[operations/puppet@production] stewards-onboarder: Add gitlab API to config
Comment Actions
[urbanecm@stewards1001 /srv/repos/onboarding-system (main|u=)]$ python3 onboarder.py update == Updating gitlab_group INFO:root:Skipping urbanecm, their access level is not managed. INFO:root:Removing urbanecmtest from repos/stewards, no longer authorised == Updating ldap_group == Updating mailman_list [urbanecm@stewards1001 /srv/repos/onboarding-system (main|u=)]$
and reading it works as well!
Closing :).