elasticsearch/.ci/init.gradle

import com.bettercloud.vault.VaultConfig
import com.bettercloud.vault.Vault

initscript {
  repositories {
    mavenCentral()
  }
  dependencies {
    classpath 'com.bettercloud:vault-java-driver:4.1.0'
  }
}

boolean USE_ARTIFACTORY = false

if (System.getenv('VAULT_ADDR') == null) {
  // When trying to reproduce errors outside of CI, it can be useful to allow this to just return rather than blowing up
  if (System.getenv('CI') == null) {
    return
  }

  throw new GradleException("You must set the VAULT_ADDR environment variable to use this init script.")
}

if (System.getenv('VAULT_ROLE_ID') == null && System.getenv('VAULT_SECRET_ID') == null && System.getenv('VAULT_TOKEN') == null) {
    // When trying to reproduce errors outside of CI, it can be useful to allow this to just return rather than blowing up
  if (System.getenv('CI') == null) {
    return
  }

  throw new GradleException("You must set either the VAULT_ROLE_ID and VAULT_SECRET_ID environment variables, " +
    "or the VAULT_TOKEN environment variable to use this init script.")
}

final String vaultPathPrefix = System.getenv('VAULT_ADDR') ==~ /.+vault-ci.+\.dev.*/ ? "secret/ci/elastic-elasticsearch/migrated" : "secret/elasticsearch-ci"

final String vaultToken = System.getenv('VAULT_TOKEN') ?: new Vault(
  new VaultConfig()
    .address(System.env.VAULT_ADDR)
    .engineVersion(1)
    .build()
)
  .withRetries(5, 1000)
  .auth()
  .loginByAppRole("approle", System.env.VAULT_ROLE_ID, System.env.VAULT_SECRET_ID)
  .getAuthClientToken()

final Vault vault = new Vault(
  new VaultConfig()
    .address(System.env.VAULT_ADDR)
    .engineVersion(1)
    .token(vaultToken)
    .build()
)
  .withRetries(5, 1000)


if (USE_ARTIFACTORY) {
  final Map<String, String> artifactoryCredentials = vault.logical()
    .read("${vaultPathPrefix}/artifactory.elstc.co")
    .getData()
  logger.info("Using elastic artifactory repos")
  Closure configCache = {
    return {
      name "artifactory-gradle-release"
      url "https://artifactory.elstc.co/artifactory/gradle-release"
      credentials {
        username artifactoryCredentials.get("username")
        password artifactoryCredentials.get("token")
      }
    }
  }
  settingsEvaluated { settings ->
    settings.pluginManagement {
      repositories {
        maven configCache()
      }
    }
  }
  projectsLoaded {
    allprojects {
      buildscript {
        repositories {
          maven configCache()
        }
      }
      repositories {
        maven configCache()
      }
    }
  }
}

gradle.settingsEvaluated { settings ->
  settings.pluginManager.withPlugin("com.gradle.develocity") {
    settings.develocity {
      server = 'https://gradle-enterprise.elastic.co'
    }
  }
}


final String buildCacheUrl = System.getProperty('org.elasticsearch.build.cache.url')
final boolean buildCachePush = Boolean.valueOf(System.getProperty('org.elasticsearch.build.cache.push', 'false'))

if (buildCacheUrl) {
  final Map<String, String> buildCacheCredentials = System.getenv("GRADLE_BUILD_CACHE_USERNAME") ? [:] : vault.logical()
    .read("${vaultPathPrefix}/gradle-build-cache")
    .getData()
  gradle.settingsEvaluated { settings ->
    settings.buildCache {
      local {
        // Disable the local build cache in CI since we use ephemeral workers and it incurs an IO penalty
        enabled = false
      }
      remote(HttpBuildCache) {
        url = buildCacheUrl
        push = buildCachePush
        credentials {
          username = System.getenv("GRADLE_BUILD_CACHE_USERNAME") ?: buildCacheCredentials.get("username")
          password = System.getenv("GRADLE_BUILD_CACHE_PASSWORD") ?: buildCacheCredentials.get("password")
        }
      }
    }
  }
}