-
Notifications
You must be signed in to change notification settings - Fork 561
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: use SNYK_CFG for IaC OCI registry env vars [CFG-1165] #2336
Conversation
@@ -92,22 +92,22 @@ describe('custom rules pull from a remote OCI registry', () => { | |||
test.each(cases)( | |||
'given %p as a registry and correct credentials, it returns a success exit code', | |||
async ( | |||
OCI_REGISTRY_NAME, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@ipapast We can get away without changing the env vars in CircleCI (and the same for snyk-iac-rules
), but I'm wondering if you think it's confusing?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think let's keep them consistent, it's not a big deal to change them in CircleCI. (we also might not remember this in a few months time :) )
+++ update in 1password
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've updated the variables in the code but will change them in CircleCI when I'm close to merging, so we don't break existing pipelines
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we should go with expand and contract; have both the new and old values on the first merge, remove after the merge. just in case someone's releasing at the same time
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actually, I just realised that the env vars in CircleCI have nothing to do with the SNYK_CFG
env vars. They are strictly configured for the tests, so we can then pass them to the SNYK_CFG
env vars. So I will keep them as they are
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
AH!! yes, you are very right, I explicitly named them with the registry name inside (docker, etc) for this reason, I should have remembered it 😆
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tested this with set
, unset
, clear
and it works great.
We had a chat on Slack with Teo about generating docs to show the usage of these env vars too.
I'm approving as it works great, some docs will be added soon
bfdef77
to
66207e2
Compare
4279330
to
2f92ad3
Compare
2d1c68e
to
828972e
Compare
828972e
to
0392d12
Compare
What does this PR do?
This PR changes the IaC OCI registry env vars to be set via
snyk config set
by using theSNYK_CFG_
prefix.Where should the reviewer start?
The code change is pretty small and straightforward, but there will be other places we'll need to change these.
For now, the tests work without changing the CircleCI environment variables because we read them and then pass them with
SNYK_CFG_
prefixed to them in the acceptance tests. I will need to update them in the public docs, 1Password, and the contract tests in https://github.com/snyk/snyk-iac-rulesHow should this be manually tested?
npm run build
snyk-dev iac test test/fixtures/iac/terraform/sg_open_ssh.tf
IaC Tests - OCI Registries Credentials
vault to set the following:snyk-dev iac test test/fixtures/iac/terraform/sg_open_ssh.tf
Any background context you want to provide?
We agreed on this in this Slack thread.
What are the relevant tickets?
https://snyksec.atlassian.net/browse/CFG-1165
Screenshots
Step 2:
Step 4:
Help docs: