Encrypted KVM with Maven-Config-Plugin
I am trying to create an encrypted KVM with the apigee-config-maven-plugin. I have setup the edge.json file but I don't want to store my kvm value in clear text. I am using bamboo and have a secret management plugin that gives me bamboo variables with my secret value, is there a way that the edge.json file can replace the values with bamboo variables or do I need to write a script for it?
Best Answer
Answer by Sai Saran Vaidyanathan
·
Jun 15, 2017 at 08:44 PM
I am afraid this is not possible within the config-plugin. What you can do is pass that variable as an argument to the maven command and then use the maven-replacer-plugin to replace the value in your edge.json to the variable passed in the maven command
<plugin>
<groupId>com.google.code.maven-replacer-plugin</groupId>
<artifactId>replacer</artifactId>
<version>1.5.2</version>
<executions>
<execution>
<phase>process-resources</phase>
<goals>
<goal>replace</goal>
</goals>
</execution>
</executions>
<configuration>
<basedir>${project.root.dir}</basedir> <!--Source directory-->
<includes>
<include>edge.json</include> <!--path to the edge.json -->
</includes>
<replacements>
<replacement>
<token>dummy</token> <!--Put a dummy token in your edge.json -->
<value>${secretValue}</value> <!--Value passed as argument -->
</replacement>
</replacements>
</configuration>
</plugin>
Your maven command will look like this
mvn apigee-config:kvms -Ptest -Dapigee.config.options=create -DsecretValue=secret
This is just an example. Let me know if this works.
would I add the dummy token to the edge.json like so?
{
"name": "encrypted-proxy-kvm",
"encrypted":true,
"entry": [
{
"name": "MESSAGE",
"value": "dummy"
}
]
}
Yes - the replacer plugin will find this file and the corresponding token, replace with the value mentioned in the pom.
Awesome this worked great. I actually ended up adding a task that ran
com.google.code.maven-replacer-plugin:replacer:replace
before running
mvn apigee-config:kvms -Ptest-Dapigee.config.options=update
This was more flexible because then I only need to edit my pom.xml file if I need to add more encrypted values, I won't need to also edit my deploy plan.
Thank you very much for the help!
Glad it worked !!!
Yes, thats the beauty.. Also if you are invoking the script using the lifecycle, you can invoke the pom using the standard maven lifecycle - so this replacer gets executed first and then the configurations.
