Get service account credentials through encrypted env var

Author: Mathieudewet

.travis.yml

@@ -15,14 +15,9 @@ cache:
 env:
   global:
     - APP_ENV=prod
-    - secure: "MfLd6GUTSrCdSLS7+IQCRpWcxMnqf4V249AZ9du2lqGqUJeXRN6nLgZuVkPtRfGk7++1yCs2dIWxfYFRNqhjDytthGk38wYTx7HETUxIJNJkGoEwhfld5w/v6ll+AsB1pAXGe/5gmQ6TxcIpx8OC8GuxuB3hq4epkrryNTes96FVCtAgezInz1lnSyClGFZ/PT4eYIZzaAH+FVW9CNGpkaz5nGLFyDW6C9M/U/Mhx2XuUxaTyzpT1yCBpFTw3fyE0YyoYqx4pK9tlHNlbDuo7hiZYllJ2Zv1J+f2eXi41RUm4Hj1EFg6jRI9e+Qr6ED8GwzHS113lFa053dTb9y7lZMVi1yRk1KHo3fh11AQqaCGMwGq5H6dL3fkIRk3lGEujLh+PWCfEC3WIfdsTegD00vKa28dFXDsF/BdkYwS3vdWP0zWBIEPl4w/P5FcqITOqL1qmQ38m3ubopvyvxUiQFnzvG+GB9vdplDhjtFq5wF5H2MUapE3PRs1HDGaT5mYIelmXcfv3mbCBB4BaqT2QeANiWOR2yJJI3Td50k9PRnjgW5thwO0Osv6UxUbCKKVqutF8/7WIcg+r3mA0kZdPkwY/mS1jZ7YBfBy+R497iO5TtefvZZ814e8X/uVAbHJcPzOHYYzpQdfxMuShJ4eOhv8B3ZdqAahMqBgd2aN0zg="
-    - secure: "HMna0O11a9JGzEsvweL7kNc8lOyU+dkFuXlSbjoyGZRHgA0jDbk58I+cikMP0+0ihVftDOudI0BIxfB8KPNYe8e7OU99KkGSQtoCop8ABT1gM7TST1KypaJstpjxI0jpFFnSy4BEjB4kJPyXOsB6PmzT7V4S2yXo0HVvLeGHGAFdjWEPdTVyCqfOrVnFgUZApggfQ4+vjFDZqPUqjfrnUl7AF/qNcqVOUXM7AxuAmG03TD+ZSg6bg0QPaVhTM9BbYV+fhXxvobYjsBoe4NEoL/Yy5WBZpn5cF/D3c347H55ChzxeO/OmtQOHDqphAITDsrpMmDi7faKTyySlVpXwrV3OWFj9kgqMpJpiX05JUE4/0p7drWAM8bsNMKPzL4jWvBhBLjKq1Vmp32M7Pu3RCnJDTTTYUWoLupAPXFhFCJ0JNbyvi/o2BkBUed0gVqgVHvDTpE5j3lgV3HVwrE+i1CVd35gJAk0OyD1ySSmKMdjIWU2LJ2h7vpTIZlEcoMOhYVFv82+/Xj4n9dAjb4G26nD0zPMq1jf5aAf8UFXR4qBOAOhAAsM1cyoCCRcTsplOHBa11+1rVcPiWO/rRq+Dc1vzp0vF8LR7gTAVQEwGJGDBbKlKWEU4vlIb+VAxrfhHdT3Zb5W7X02qSJP6sixvnbJCBZhDbOAVcWf6b0jFelo="
-    - secure: "NK5rLjp6jFssdr4vdg/Nrj5azYhHEzT7PB4GPfL2xvX6N5dPU6y2vZ8Hs5ve+KQbHILLgF4E2cApP5Tdejrch3ayeuFVcWyN9AqzwnKy4g+OkSIZrwkR4cL3ojMfmUiQ/Py8HXdKioYm64OdZmwiFruAbK6zWVb2+6oYyza10ACgDFalKh6nEjUeYfJHQxisFWnxCNcTNJgp9WWT5QzHSGU6kD/xfkNzW7tQgQOu+k+Jc6c6djzZL/Zu3yUInSe4XxcBLybGTTMTXaSLVQBDz+QlKRlw3AMGhdc/xS5n7kuzaCmrYJOvHFIF04rbDAP20RA/yt6knMOEQ/Esged8g03Hudae4cK1/fYdp+RUY6E/W12OLzxh+RuMYxzAnm/I5PQvJruxiIm1f9P9iLt2v+LHb4YDPliBrm/CEstJ5rLCKYXIx3qtnDdV+4hjg7JSEkMBljkAfWLpbYwjcux4DYQToRTHCIRTbDbxPAEcN2dglP8UPBK6i9hJxm3lZ1N6WD4yb+BftK+9wx3VM92KXJg7vCqMmjLfrtKtl7ZhcFfDabmxHxgMRXuVuFdUXXkXnv0YZXaXzdZBzLqQsJUpjGJzxNEyY8n3H4OKTcu9ou08sWUNQhUiwm3uQUj7CYxde4Zm3g+Z0OMvbFbWojwHlvoggaxYp81yi4rFMXa6h0U="
-    - secure: "VvyqaSyVXQnAkhX5iagZiptiXnBnB5uJod4NC7YHXIc6+o/UIvjAO6ez+u5DvEJAP+QqBotlGrtTAStjwI/x4gU9LnQWQmdNVVZB3nQ5dHzaerR62NQB0vaB/00U9Dc0bP0RF/1SjCj8zWfecam6PD5N37Qqn3CgQ1DZrmi0Dq4Jq8szV+hZIUFSHJQILu625AuIw+5+DSDXEfSowa/j/EkH4mv/SIo+hcCSqJESob37wKMZVKiFjxrKmvmaqhDEKvDZFWhtZcAw0d9L7dsMD6MODWf1IO9MiQ2WvlKbkbBN8/Hh6CmcJ4yPuWFAbwD+4UjEib0Tvuy5cf4CBvs5l+s/ejmiwR8Cp7+ouBzrM6CRyf5nOaoNbC2+4irBwuVB4e0RYQcY6c+/hz8B6kA7odk9CYkU1/0Iz/1E+SMZUERQOed12gBeY0hAIucpPqkFg47YzKeB2a8MgqfvSEltdbVn+kIED6m87+kMqT/s5TilfbEviObBrjdo+zGaqQu/dbDoBT1EsZxj91FIieKw4OBm1yYfOlo0MAPxjf/Vu1X8IbVllRBLVm0H1jeZHxS7ORMetjfMr2IOJBsmC/SsPKSjrCVAHF9OdwCnHOOgTKsW7KMpm9BbkjiN5EwH3pxkDR56xd/R+jUCNnkKiHC7DStCUGjsgibmKwplkrwsFZs="
 
+# - if [ "TRAVIS_PULL_REQUEST" != "false" ]; then exit 0; fi
 before_install:
-  - if [ "TRAVIS_PULL_REQUEST" != "false" ]; then exit 0; fi
-  - openssl aes-256-cbc -K $encrypted_78c7c6c95bf0_key -iv $encrypted_78c7c6c95bf0_iv -in travis-demo-service-account.json.enc -out travis-demo-service-account.json -d
   - curl -O https://storage.googleapis.com/kubernetes-helm/helm-v2.7.2-linux-amd64.tar.gz
   - tar -zxvf helm-v2.7.2-linux-amd64.tar.gz
 
@@ -58,23 +53,27 @@ after_success:
   - curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
   - chmod +x ./kubectl
   - sudo mv ./kubectl /usr/local/bin/kubectl
-  - gcloud auth activate-service-account --key-file travis-service-account.json
+  - echo "${travis}"
+  - echo "${projectName}"
+  - echo "${DATABASE_USER}"
+  - sh -c 'echo -n ${travis} | base64 -d > travis-service-account.json'
+  - gcloud auth activate-service-account [email protected] --key-file travis-service-account.json --project=api-platform-demo-209807
   - gcloud config set compute/zone europe-west3-c
   - gcloud config set project api-platform-demo-209807
   - mkdir -p ${HOME}/.kube
   - cp ./kubeConfig ${HOME}/.kube/config
   - tar -zxvf helm-v2.7.2-linux-amd64.tar.gz
   - rm -rf helm-v2.7.2-linux-amd64.tar.gz
   - sudo mv linux-amd64/helm /usr/local/bin/helm
-  - gcloud container clusters get-credentials "api-platform-demo"
+  - gcloud container clusters get-credentials api-platform-demo-209807 --zone europe-west3-c --project api-platform-demo-209807
   - helm init
-  - docker build -t gcr.io/api-platform-demo/php -t gcr.io/api-platform-demo/php:latest api/api --target api_platform_php
-  - docker build -t gcr.io/api-platform-demo/nginx -t gcr.io/api-platform-demo/nginx:latest api/api --target api_platform_nginx
-  - docker build -t gcr.io/api-platform-demo/varnish -t gcr.io/api-platform-demo/varnish:latest api/api --target api_platform_varnish
+  - docker build --pull -t gcr.io/api-platform-demo/php -t gcr.io/api-platform-demo/php:latest api --target api_platform_php
+  - docker build --pull -t gcr.io/api-platform-demo/nginx -t gcr.io/api-platform-demo/nginx:latest api --target api_platform_nginx
+  - docker build --pull -t gcr.io/api-platform-demo/varnish -t gcr.io/api-platform-demo/varnish:latest api --target api_platform_varnish
   - gcloud docker -- push gcr.io/api-platform-demo/php:latest
   - gcloud docker -- push gcr.io/api-platform-demo/nginx:latest
   - gcloud docker -- push gcr.io/api-platform-demo/varnish:latest
-  - helm upgrade --recreate-pods --force --reset-values api-platform-demo --namespace=master \
+  - helm install api-platform-demo --namespace=${TRAVIS_COMMIT} ./api/helm/api \
       --set php.repository=gcr.io/api-platform-demo/php:latest \
       --set nginx.repository=gcr.io/api-platform-demo/nginx:latest \
       --set secret=${APP_SECRET} \

api/composer.json

@@ -48,6 +48,7 @@
         }
     },
     "replace": {
+        "symfony/polyfill-ctype": "*",
         "symfony/polyfill-iconv": "*",
         "symfony/polyfill-php71": "*",
         "symfony/polyfill-php70": "*",
@@ -56,8 +57,7 @@
     "scripts": {
         "auto-scripts": {
             "cache:clear": "symfony-cmd",
-            "assets:install --symlink --relative %PUBLIC_DIR%": "symfony-cmd",
-            "security-checker security:check": "script"
+            "assets:install": "symfony-cmd"
         },
         "post-install-cmd": [
             "@auto-scripts"

api/helm/api/values.yaml

@@ -8,21 +8,21 @@ secret: ChangeMe
 corsAllowOrigin: http://example.com
 
 php:
-  repository: gcr.io/test-api-platform/php
+  repository: gcr.io/api-platform-demo-209807/php
   tag: latest
   pullPolicy: Always
   replicaCount: 1
 
 nginx:
-  repository: gcr.io/test-api-platform/nginx
+  repository: gcr.io/api-platform-demo-209807/nginx
   tag: latest
   pullPolicy: Always
   replicaCount: 1
 
 varnish:
   enabled: true
   #url: https://example.com
-  repository: gcr.io/test-api-platform/varnish
+  repository: gcr.io/api-platform-demo-209807/varnish
   tag: latest
   pullPolicy: Always
   replicaCount: 1