{"action":"created","issue":{"url":"https://api.github.com/repos/drone/drone/issues/1538","repository_url":"https://api.github.com/repos/drone/drone","labels_url":"https://api.github.com/repos/drone/drone/issues/1538/labels{/name}","comments_url":"https://api.github.com/repos/drone/drone/issues/1538/comments","events_url":"https://api.github.com/repos/drone/drone/issues/1538/events","html_url":"https://github.com/drone/drone/issues/1538","id":143533223,"number":1538,"title":"Delegated secrets management","user":{"login":"casualjim","id":456109,"avatar_url":"https://avatars.githubusercontent.com/u/456109?v=3","gravatar_id":"","url":"https://api.github.com/users/casualjim","html_url":"https://github.com/casualjim","followers_url":"https://api.github.com/users/casualjim/followers","following_url":"https://api.github.com/users/casualjim/following{/other_user}","gists_url":"https://api.github.com/users/casualjim/gists{/gist_id}","starred_url":"https://api.github.com/users/casualjim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/casualjim/subscriptions","organizations_url":"https://api.github.com/users/casualjim/orgs","repos_url":"https://api.github.com/users/casualjim/repos","events_url":"https://api.github.com/users/casualjim/events{/privacy}","received_events_url":"https://api.github.com/users/casualjim/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2016-03-25T16:16:08Z","updated_at":"2016-04-01T01:05:39Z","closed_at":null,"body":"First off we're willing to do the work proposed, I wanted to share the approach and general idea first.\r\n\r\n## Current state of affairs\r\n\r\nDrone allows for encryption of secrets but it works locally and so the secrets yaml file needs to be shared amongst \"blessed\" team members who gate changes to .drone.yml.\r\n\r\n## Expected behavior\r\n\r\nDecouple and delegate managing secrets yaml content from the ability to encrypt drone.yml. Every maintainer should be able to encrypt the .drone.yml file. But the ability to add or change secrets should still be gated through a set of \"blessed\" individuals.\r\n\r\n## Proposed approach\r\n\r\nTo achieve this we can introduce a secure secrets store like hashicorps vault, dockers notary, ... The backend might actually be pluggable, for a first pass I think hashicorps vault is most appropriate. \r\n\r\nThe drone-cli will submit the .drone.yml file to the drone API server and gets the encryption string back. This then gets stored in .drone.sec. This can be a flag that allows people the choice but by default we stick to the current behavior of needing a local file.\r\n\r\nThe drone-api server needs to get a new endpoint to accommodate this new workflow. There will also be a config necessary so that the drone api server knows how to connect to the secure store backend.\r\n\r\nThe secrets are now provided through vault, so the people who can write or even read that are highly privileged accounts but this is decoupled from the build system.\r\n"},"comment":{"url":"https://api.github.com/repos/drone/drone/issues/comments/204196192","html_url":"https://github.com/drone/drone/issues/1538#issuecomment-204196192","issue_url":"https://api.github.com/repos/drone/drone/issues/1538","id":204196192,"user":{"login":"bradrydzewski","id":817538,"avatar_url":"https://avatars.githubusercontent.com/u/817538?v=3","gravatar_id":"","url":"https://api.github.com/users/bradrydzewski","html_url":"https://github.com/bradrydzewski","followers_url":"https://api.github.com/users/bradrydzewski/followers","following_url":"https://api.github.com/users/bradrydzewski/following{/other_user}","gists_url":"https://api.github.com/users/bradrydzewski/gists{/gist_id}","starred_url":"https://api.github.com/users/bradrydzewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradrydzewski/subscriptions","organizations_url":"https://api.github.com/users/bradrydzewski/orgs","repos_url":"https://api.github.com/users/bradrydzewski/repos","events_url":"https://api.github.com/users/bradrydzewski/events{/privacy}","received_events_url":"https://api.github.com/users/bradrydzewski/received_events","type":"User","site_admin":false},"created_at":"2016-04-01T01:05:39Z","updated_at":"2016-04-01T01:05:39Z","body":"I've gotten some pretty good feedback thus far including a preliminary security review (thanks @nlf and team) so I feel pretty good merging this. I've merged initial support for a `drone sign` command and `drone secrets` subcommands in the CLI.\r\n\r\nI will work on including this in the 0.5 release and post updates to this thread when available. In the meantime, if anyone has any concerns, feel free to let me know."}}