使用 Cloud KMS 提供的經過加密的憑證

Cloud Key Management Service 是 Google Cloud 服務，可讓您管理及使用加密編譯金鑰。本頁面說明如何在 Cloud Build 中使用 Cloud KMS 的加密資訊。

事前準備

  • Enable the Cloud Build and Cloud KMS APIs.

    Enable the APIs

  • 如要使用本指南提供的指令列範例，請安裝並設定 Google Cloud CLI。

  • 使用 Cloud KMS 加密機密資訊。Cloud KMS 會將已加密的內容儲存在檔案中。

  • [選用] 如要設定版本使用加密資料，請將 ENCRYPTED_FILE 轉換為 base64 (如果使用加密檔案的建構設定檔，則不需要執行這個步驟)：

        base64 ENCRYPTED_FILE

必要的 IAM 權限

將 Cloud KMS CryptoKey 解密者 (roles/cloudkms.cryptoKeyDecrypter) 身分與存取權管理角色授予 Build 服務帳戶：

  1. 在 Google Cloud 控制台中，前往 Cloud Build 的「Settings」頁面：

    開啟「設定」頁面

  2. 找出具有 Cloud KMS CryptoKey Decrypter 角色的資料列，並將其「狀態」設為「已啟用」。

設定要使用加密資料的版本

  1. 在專案根目錄中，建立名為 cloudbuild.yaml 或 cloudbuild.json 的 Cloud Build 建構設定檔。

  2. 在建構設定檔中：

    • 在所有建構 steps 後，請新增 availableSecrets 欄位，將加密值指定為環境變數，並指定用於解密的 kmsKeyName。您可以在 kmsKeyName 的值中使用替換變數。
    • 在要指定機密金鑰的建構步驟中：
      • 新增指向 bash 的 entrypoint 欄位，即可在建構步驟中使用 bash 工具。這是參照機密金鑰環境變數的必要條件。
      • 新增 secretEnv 欄位，指定加密值的環境變數。
      • 在 args 欄位中，新增 -c 標記做為第一個引數。您在 -c 後方傳遞的任何字串都會視為指令。如要進一步瞭解如何使用 -c 執行 bash 指令，請參閱 bash 說明文件。
      • 在 args 欄位中指定加密值時，請使用前置為 $$.

    The following example build config file shows how to login to Docker and pull a private image:

    YAML

     steps:
 - name: 'gcr.io/cloud-builders/docker'
   entrypoint: 'bash'
   args: ['-c', 'docker login --username=$$USERNAME --password=$$PASSWORD']
   secretEnv: ['USERNAME', 'PASSWORD']
 - name: 'gcr.io/cloud-builders/docker'
   entrypoint: 'bash'
   args: ['-c', 'docker pull $$USERNAME/IMAGE:TAG']
   secretEnv: ['USERNAME']
 availableSecrets:
   inline:
   - kmsKeyName: projects/PROJECT_ID/locations/global/keyRings/USERNAME_KEYRING_NAME/cryptoKeys/USERNAME_KEY_NAME
     envMap:
       USERNAME: 'ENCRYPTED_USERNAME'
   - kmsKeyName: projects/PROJECT_ID/locations/global/keyRings/PASSWORD_KEYRING_NAME/cryptoKeys/PASSWORD_KEY_NAME
     envMap:
       PASSWORD: 'ENCRYPTED_PASSWORD'
 的環境變數指定
    JSON
    {
  "steps": [
  {
    "name": "gcr.io/cloud-builders/docker",
    "entrypoint": "bash",
    "args": [
      "-c",
      "docker login --username=$$USERNAME --password=$$PASSWORD"
    ],
    "secretEnv": [
      "USERNAME",
      "PASSWORD"
    ]
  },
  {
    "name": "gcr.io/cloud-builders/docker",
    "entrypoint": "bash",
    "args": [
      "-c",
      "docker pull $$USERNAME/REPOSITORY:TAG"
     ],
     "secretEnv": [
      "USERNAME"
    ]
  }
  ],
  "availableSecrets": {
    "inline": [{
      "kmsKeyName":  "projects/PROJECT_ID/locations/global/keyRings/USERNAME_KEYRING_NAME/cryptoKeys/USERNAME_KEY_NAME",
      "envMap": {
        "USERNAME": "ENCRYPTED_USERNAME"
       }
   },
   {
    "kmsKeyName": "projects/PROJECT_ID/locations/global/keyRings/PASSWORD_KEYRING_NAME/cryptoKeys/PASSWORD_KEY_NAME",
    "envMap": {
        "PASSWORD": "ENCRYPTED_PASSWORD"
       }
   }]
 }
}

    Replace the placeholder values in the above commands with the following:

    • PROJECT_ID: The ID of the Google Cloud project which contains your Cloud KMS service.
    • USERNAME_KEYRING_NAME: The key ring name of your Docker username.
    • USERNAME_KEY_NAME: The key name of your Docker username.
    • ENCRYPTED_USERNAME: Your encrypted Docker username in base64 format.
    • PASSWORD_KEYRING_NAME: The key ring name of your Docker password.
    • PASSWORD_KEY_NAME: The key name of your Docker password.
    • ENCRYPTED_PASSWORD: Your encrypted Docker password in base64 format.
    • REPOSITORY: The name of your Docker repository from where you're pulling the image.

    • TAG: The tag name of your image.

  3. Use the build config file to manually start a build or to automate builds using triggers.

Configuring builds to use encrypted files

  1. In your project root directory, create a Cloud Build build config file named cloudbuild.yaml or cloudbuild.json.

  2. In your build config file, before any build steps that interact with the decrypted file, add a gcloud build step to decrypt the encrypted file using the encryption key. The following example build config file shows how to login to Docker using the encrypted file with Docker password:

    YAML 

    steps:
- name: gcr.io/cloud-builders/gcloud
  args:
  - kms
  - decrypt
  - "--ciphertext-file=ENCRYPTED_PASSWORD_FILE"
  - "--plaintext-file=PLAINTEXT_PASSWORD_FILE"
  - "--location=global"
  - "--keyring=KEYRING_NAME"
  - "--key=KEY_NAME"
- name: gcr.io/cloud-builders/docker
  entrypoint: bash
  args:
  - "-c"
  - docker login --username=DOCKER_USERNAME --password-stdin < PLAINTEXT_PASSWORD_FILE

    JSON 

    {
  "steps": [
  {
    "name": "gcr.io/cloud-builders/gcloud",
    "args": [
      "kms",
      "decrypt",
      "--ciphertext-file=ENCRYPTED_PASSWORD_FILE",
      "--plaintext-file=PLAINTEXT_PASSWORD_FILE",
      "--location=global",
      "--keyring=KEYRING_NAME",
      "--key=KEY_NAME"
    ]
  },
  {
    "name": "gcr.io/cloud-builders/docker",
    "entrypoint": "bash",
    "args": [
      "-c",
      "docker login --username=DOCKER_USERNAME --password-stdin < PLAINTEXT_PASSWORD_FILE"
    ]
   }
  ]
}

    Replace the placeholder values in the above commands with the following:

    • KEYRING_NAME: The key ring name of your Docker password.
    • KEY_NAME: The key name of your Docker password.
    • ENCRYPTED_PASSWORD_FILE: Encrypted file with your Docker password.
    • PLAINTEXT_PASSWORD_FILE: Plaintext file with your Docker password.

  3. Use the build config file to manually start a build or to automate builds using triggers.

Configuring builds to use encrypted data (legacy)

To encrypt sensitive data using Cloud KMS and use that data in a build config file:

  1. In your build config file, add a secrets field to specify the encrypted value and the CryptoKey to use to decrypt it. Then, in the build step where you want to use the encrypted variable, add a secretEnv field to specify the variable as an environment variable. Include the variable's name in the secretEnv field. If you specify the variable value, or a non-secret environment variable with the same name, Cloud Build throws an error.

    YAML

    steps:
- name: 'gcr.io/cloud-builders/docker'
  entrypoint: 'bash'
  args: ['-c', 'docker login --username=user-name --password=$$PASSWORD']
  secretEnv: ['PASSWORD']
- name: 'gcr.io/cloud-builders/docker'
  args: ['push', 'user-name/myubuntu']
secrets:
- kmsKeyName: projects/project-id/locations/global/keyRings/keyring-name/cryptoKeys/key-name
  secretEnv:
    PASSWORD: 'encrypted-password'

    JSON

    {
  "steps": [
  {
    "name": "gcr.io/cloud-builders/docker",
    "entrypoint": "bash",
    "args": [
      "-c",
      "docker login --username=user-name --password=$$PASSWORD"
    ],
    "secretEnv": [
      "PASSWORD"
     ]
   },
   {
     "name": "gcr.io/cloud-builders/docker",
     "args": [
       "push",
       "user-name/myubuntu"
      ]
   }
   ],
   "secrets": [
   {
     "kmsKeyName": "projects/project-id/locations/global/keyRings/keyring-name/cryptoKeys/key-name",
     "secretEnv": {
       "PASSWORD": "encrypted-password"
     }
   }
   ]
}

後續步驟