ci: switch from Vault to SSM for Maven Central credentials

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jbachorik

.gitlab-ci.yml

@@ -10,7 +10,6 @@ variables:
   BUILDER_IMAGE: "registry.ddbuild.io/images/mirror/dd-trace-java-docker-build:ci-base"
   # Route external Maven/Gradle resolution through Datadog's internal proxy.
   MAVEN_REPOSITORY_PROXY: "https://depot-read-api-java.us1.ddbuild.io/magicmirror/magicmirror/@current/"
-  VAULT_ADDR: "https://vault.us1.ddbuild.io"
 
 default:
   tags: ["arch:amd64"]
@@ -24,6 +23,10 @@ default:
     - export ORG_GRADLE_PROJECT_gradlePluginProxy=$MAVEN_REPOSITORY_PROXY
     - export GRADLE_ARGS="--no-daemon --stacktrace --parallel"
 
+.publish_sa:
+  variables:
+    KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: java-reggie
+
 build:
   extends: .gradle_job
   stage: build
@@ -35,7 +38,9 @@ build:
       junit: "**/build/test-results/**/*.xml"
 
 publish_to_maven_central:
-  extends: .gradle_job
+  extends:
+    - .gradle_job
+    - .publish_sa
   stage: publish
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
@@ -44,32 +49,40 @@ publish_to_maven_central:
       allow_failure: true
   # Maven Central credentials: written via scripts/update-maven-central-secrets.sh
   # GPG signing key: created via the create_key job below
-  # Both are stored in Vault and read automatically by the CI runner.
+  # Both are stored in AWS SSM and read via the java-reggie K8s service account IAM role.
   script:
-    - export ORG_GRADLE_PROJECT_mavenCentralUsername=$(vault kv get -field=username kv/k8s/gitlab-runner/java-reggie/maven-central)
-    - export ORG_GRADLE_PROJECT_mavenCentralPassword=$(vault kv get -field=password kv/k8s/gitlab-runner/java-reggie/maven-central)
-    - export ORG_GRADLE_PROJECT_signingInMemoryKey=$(vault kv get -field=gpg_private_key kv/k8s/gitlab-runner/java-reggie/signing)
-    - export ORG_GRADLE_PROJECT_signingInMemoryKeyId=$(vault kv get -field=gpg_key_id kv/k8s/gitlab-runner/java-reggie/signing)
-    - export ORG_GRADLE_PROJECT_signingInMemoryKeyPassword=$(vault kv get -field=gpg_passphrase kv/k8s/gitlab-runner/java-reggie/signing)
+    - ORG_GRADLE_PROJECT_mavenCentralUsername=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.maven_central_username --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for mavenCentralUsername"; exit 1; }
+    - export ORG_GRADLE_PROJECT_mavenCentralUsername
+    - ORG_GRADLE_PROJECT_mavenCentralPassword=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.maven_central_password --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for mavenCentralPassword"; exit 1; }
+    - export ORG_GRADLE_PROJECT_mavenCentralPassword
+    - ORG_GRADLE_PROJECT_signingInMemoryKey=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.signing.gpg_private_key --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for signingInMemoryKey"; exit 1; }
+    - export ORG_GRADLE_PROJECT_signingInMemoryKey
+    - ORG_GRADLE_PROJECT_signingInMemoryKeyId=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.signing.gpg_key_id --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for signingInMemoryKeyId"; exit 1; }
+    - export ORG_GRADLE_PROJECT_signingInMemoryKeyId
+    - ORG_GRADLE_PROJECT_signingInMemoryKeyPassword=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.signing.gpg_passphrase --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for signingInMemoryKeyPassword"; exit 1; }
+    - export ORG_GRADLE_PROJECT_signingInMemoryKeyPassword
     - ./gradlew :reggie-runtime:publishAllPublicationsToMavenCentralRepository $GRADLE_ARGS
 
 publish_snapshot:
-  extends: .gradle_job
+  extends:
+    - .gradle_job
+    - .publish_sa
   stage: publish
   rules:
     - if: '$CI_COMMIT_BRANCH == "main"'
       when: on_success
   script:
-    - SONATYPE_USERNAME=$(vault kv get -field=username kv/k8s/gitlab-runner/java-reggie/maven-central) || { echo "ERROR: vault read failed for username"; exit 1; }
-    - SONATYPE_PASSWORD=$(vault kv get -field=password kv/k8s/gitlab-runner/java-reggie/maven-central) || { echo "ERROR: vault read failed for password"; exit 1; }
+    - SONATYPE_USERNAME=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.maven_central_username --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for username"; exit 1; }
+    - SONATYPE_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.maven_central_password --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for password"; exit 1; }
     - '[[ -n "$SONATYPE_USERNAME" ]] || { echo "ERROR: SONATYPE_USERNAME is empty"; exit 1; }'
     - '[[ -n "$SONATYPE_PASSWORD" ]] || { echo "ERROR: SONATYPE_PASSWORD is empty"; exit 1; }'
-    - echo "Vault credentials loaded (username length=${#SONATYPE_USERNAME}, password length=${#SONATYPE_PASSWORD})"
     - export SONATYPE_USERNAME SONATYPE_PASSWORD
-    - ORG_GRADLE_PROJECT_signingInMemoryKey=$(vault kv get -field=gpg_private_key kv/k8s/gitlab-runner/java-reggie/signing) || { echo "ERROR: vault read failed for signing key"; exit 1; }
-    - ORG_GRADLE_PROJECT_signingInMemoryKeyId=$(vault kv get -field=gpg_key_id kv/k8s/gitlab-runner/java-reggie/signing) || { echo "ERROR: vault read failed for signing key id"; exit 1; }
-    - ORG_GRADLE_PROJECT_signingInMemoryKeyPassword=$(vault kv get -field=gpg_passphrase kv/k8s/gitlab-runner/java-reggie/signing) || { echo "ERROR: vault read failed for signing passphrase"; exit 1; }
-    - export ORG_GRADLE_PROJECT_signingInMemoryKey ORG_GRADLE_PROJECT_signingInMemoryKeyId ORG_GRADLE_PROJECT_signingInMemoryKeyPassword
+    - ORG_GRADLE_PROJECT_signingInMemoryKey=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.signing.gpg_private_key --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for signingInMemoryKey"; exit 1; }
+    - export ORG_GRADLE_PROJECT_signingInMemoryKey
+    - ORG_GRADLE_PROJECT_signingInMemoryKeyId=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.signing.gpg_key_id --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for signingInMemoryKeyId"; exit 1; }
+    - export ORG_GRADLE_PROJECT_signingInMemoryKeyId
+    - ORG_GRADLE_PROJECT_signingInMemoryKeyPassword=$(aws ssm get-parameter --region us-east-1 --name ci.java-reggie.signing.gpg_passphrase --with-decryption --query "Parameter.Value" --out text) || { echo "ERROR: SSM read failed for signingInMemoryKeyPassword"; exit 1; }
+    - export ORG_GRADLE_PROJECT_signingInMemoryKeyPassword
     - ./gradlew :reggie-runtime:publishToSonatype $GRADLE_ARGS
 
 # Run once manually to generate the GPG signing key and store it in AWS SSM

scripts/update-maven-central-secrets.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Writes Maven Central credentials to Vault at kv/k8s/gitlab-runner/java-reggie/maven-central.
-# The GitLab CI runner reads them automatically from that path via its K8s service account.
+# Writes Maven Central credentials to AWS SSM Parameter Store.
+# The GitLab CI runner reads them via the java-reggie K8s service account IAM role.
 #
 # Credentials are resolved in order:
 #   1. 1Password item "Maven Central Portal Token" (vault: Shared-Public-Software-Repositories)
@@ -9,16 +9,15 @@
 #
 # Usage: ./scripts/update-maven-central-secrets.sh [--dry-run]
 #
-# Prerequisites:
-#   - ddtool (for Vault OIDC login)
-#   - vault CLI
-#   - op (1Password CLI) — optional but recommended
+# AWS credentials are obtained automatically via aws-vault (sso-build-stable-developer).
+# 1Password CLI (op) is optional but recommended.
 
 set -euo pipefail
 
+AWS_PROFILE="sso-build-stable-developer"
 DRY_RUN=0
-VAULT_ADDR_DEFAULT="https://vault.us1.ddbuild.io"
-VAULT_PATH="kv/k8s/gitlab-runner/java-reggie/maven-central"
+AWS_REGION="us-east-1"
+SSM_PREFIX="ci.java-reggie"
 KEYCHAIN_SERVICE="java-reggie-maven-central"
 OP_ITEM_NAME="Maven Central Portal Token"
 OP_VAULT="Shared-Public-Software-Repositories"
@@ -34,7 +33,13 @@ for arg in "$@"; do
     esac
 done
 
-export VAULT_ADDR="${VAULT_ADDR:-$VAULT_ADDR_DEFAULT}"
+# ── Re-exec via aws-vault if not already running inside it ────────────────────
+
+if [[ -z "${AWS_VAULT:-}" ]]; then
+    command -v aws-vault >/dev/null 2>&1 || { echo "ERROR: aws-vault is required"; exit 1; }
+    echo "Re-executing via aws-vault ($AWS_PROFILE)..."
+    exec aws-vault exec "$AWS_PROFILE" -- "$0" "$@"
+fi
 
 # ── Platform detection ────────────────────────────────────────────────────────
 
@@ -43,9 +48,7 @@ IS_MACOS=0
 
 # ── Prerequisites ─────────────────────────────────────────────────────────────
 
-for cmd in vault ddtool; do
-    command -v "$cmd" >/dev/null 2>&1 || { echo "ERROR: $cmd is required"; exit 1; }
-done
+command -v aws >/dev/null 2>&1 || { echo "ERROR: aws CLI is required"; exit 1; }
 
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
@@ -54,8 +57,16 @@ op_read() {
     op item get "$OP_ITEM_NAME" --vault "$OP_VAULT" --field "$field" --reveal 2>/dev/null || true
 }
 
-op_available() {
-    command -v op >/dev/null 2>&1 && op whoami &>/dev/null
+op_signin() {
+    if ! command -v op >/dev/null 2>&1; then
+        return 1
+    fi
+    if op whoami &>/dev/null; then
+        return 0
+    fi
+    echo "1Password CLI found but not signed in — signing in..."
+    eval "$(op signin)" || return 1
+    op whoami &>/dev/null
 }
 
 keychain_read() {
@@ -82,14 +93,24 @@ prompt_secret() {
     printf '%s' "$value"
 }
 
+ssm_put() {
+    local name="$1" value="$2"
+    aws ssm put-parameter \
+        --region "$AWS_REGION" \
+        --name "$name" \
+        --value "$value" \
+        --type SecureString \
+        --overwrite
+}
+
 # ── Resolve credentials ───────────────────────────────────────────────────────
 
 USERNAME=""
 PASSWORD=""
 SOURCE=""
 
 # 1. Try 1Password
-if op_available; then
+if op_signin; then
     echo "Reading from 1Password (\"$OP_ITEM_NAME\" in $OP_VAULT)..."
     USERNAME=$(op_read "username")
     PASSWORD=$(op_read "password")
@@ -99,8 +120,6 @@ if op_available; then
     else
         echo "  Item not found or missing fields — falling back"
     fi
-else
-    command -v op >/dev/null 2>&1 && echo "1Password CLI found but not signed in (run: op signin). Falling back..."
 fi
 
 # 2. Try macOS Keychain
@@ -130,24 +149,18 @@ fi
 
 [ -n "$SOURCE" ] || SOURCE="prompt"
 
-# ── Vault login (skip if already authenticated) ───────────────────────────────
-
-echo ""
-if vault token lookup &>/dev/null; then
-    echo "Already authenticated to Vault ($VAULT_ADDR)"
-else
-    echo "Authenticating to Vault ($VAULT_ADDR)..."
-    ddtool auth login
-fi
-
-# ── Write to Vault ────────────────────────────────────────────────────────────
+# ── Write to SSM ──────────────────────────────────────────────────────────────
 
 echo ""
 if [ $DRY_RUN -eq 1 ]; then
-    echo "[dry-run] would write: vault kv put $VAULT_PATH username=<...> password=<...>"
+    echo "[dry-run] would write:"
+    echo "  ${SSM_PREFIX}.maven_central_username"
+    echo "  ${SSM_PREFIX}.maven_central_password"
 else
-    vault kv put "$VAULT_PATH" username="$USERNAME" password="$PASSWORD"
-    echo "  ✓ $VAULT_PATH"
+    ssm_put "${SSM_PREFIX}.maven_central_username" "$USERNAME"
+    echo "  ✓ ${SSM_PREFIX}.maven_central_username"
+    ssm_put "${SSM_PREFIX}.maven_central_password" "$PASSWORD"
+    echo "  ✓ ${SSM_PREFIX}.maven_central_password"
 fi
 
 # ── Offer to save to Keychain if values came from a prompt ───────────────────
@@ -163,4 +176,4 @@ if [ "$SOURCE" = "prompt" ] && [ $IS_MACOS -eq 1 ] && [ $DRY_RUN -eq 0 ]; then
 fi
 
 echo ""
-echo "Done. GitLab CI reads from: $VAULT_PATH"
+echo "Done. GitLab CI reads from: ${SSM_PREFIX}.maven_central_{username,password}"