-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* feat: add hardcoded user role environment var * feat: add role finder script * feat: update packages * feat: basic validation of intention actions * feat: action auth auditing
- Loading branch information
Showing
26 changed files
with
2,294 additions
and
1,999 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,15 @@ | ||
| { | ||
| "$schema": "https://json.schemastore.org/nest-cli", | ||
| "collection": "@nestjs/schematics", | ||
| "sourceRoot": "src" | ||
| "sourceRoot": "src", | ||
| "compilerOptions": { | ||
| "plugins": [ | ||
| { | ||
| "name": "@nestjs/swagger", | ||
| "options": { | ||
| "introspectComments": true | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| } |
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| cd "${0%/*}" | ||
|
|
||
| INSTALL_VERSION="12.0.3" | ||
|
|
||
| echo "===> Intention open" | ||
| # Open intention | ||
| RESPONSE=$(curl -s -X POST $BROKER_URL/v1/intention/open \ | ||
| -H 'Content-Type: application/json' \ | ||
| -u "$BASIC_HTTP_USER:$BASIC_HTTP_PASSWORD" \ | ||
| -d @<(cat provision-db-intention.json | \ | ||
| jq ".event.url=\"http://sample.com/job\" \ | ||
| " \ | ||
| )) | ||
| echo "$BROKER_URL/v1/intention/open:" | ||
| echo $RESPONSE | jq '.' | ||
| if [ "$(echo $RESPONSE | jq '.error')" != "null" ]; then | ||
| echo "Exit: Error detected" | ||
| exit 0 | ||
| fi | ||
|
|
||
| # Save intention token for later | ||
| INTENTION_TOKEN=$(echo $RESPONSE | jq -r '.token') | ||
| # echo "Hashed transaction.id: $(echo -n $INTENTION_TOKEN | shasum -a 256)" | ||
|
|
||
| echo "===> DB provision" | ||
|
|
||
| # Get token for provisioning a db access | ||
| DB_INTENTION_TOKEN=$(echo $RESPONSE | jq -r '.actions.database.token') | ||
| echo "DB_INTENTION_TOKEN: $DB_INTENTION_TOKEN" | ||
|
|
||
| # Get secret id for db access | ||
| JENKINS_VAULT_TOKEN=$(curl -s -X POST $BROKER_URL/v1/provision/token/self -H 'X-Broker-Token: '"$DB_INTENTION_TOKEN"'' -H 'X-Vault-Role-Id: '"$PROVISION_ROLE_ID"'') | ||
| echo "$BROKER_URL/v1/provision/token/self:" | ||
| echo $JENKINS_VAULT_TOKEN | jq '.' | ||
|
|
||
| # Not shown: Use Vault Token to access database | ||
|
|
||
| echo "===> Intention close" | ||
|
|
||
| # Use saved intention token to close intention | ||
| curl -s -X POST $BROKER_URL/v1/intention/close -H 'X-Broker-Token: '"$INTENTION_TOKEN"'' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| { | ||
| "event": { | ||
| "provider": "db-demo", | ||
| "reason": "Job triggered", | ||
| "url": "JOB_URL" | ||
| }, | ||
| "actions": [ | ||
| { | ||
| "action": "database-access", | ||
| "id": "database", | ||
| "provision": ["token/self"], | ||
| "service": { | ||
| "name": "fluent-bit", | ||
| "project": "fluent", | ||
| "environment": "production" | ||
| } | ||
| } | ||
| ], | ||
| "user": { | ||
| "id": "mbystedt@idir" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| # ./role-finder.sh prod fluent fluent-bit | ||
| # $1: vault environment | ||
| # $2: project name | ||
| # $3: service name | ||
|
|
||
| if [ -z "$1" ] | ||
| then | ||
| echo "No environment supplied" | ||
| fi | ||
|
|
||
| if [ -n "$1" ] | ||
| then | ||
| VAULT_ADDR="https://vault-iit-$1.apps.silver.devops.gov.bc.ca" | ||
| if [ "prod" = $1 ] | ||
| then | ||
| VAULT_ADDR="https://vault-iit.apps.silver.devops.gov.bc.ca" | ||
| fi | ||
| VAULT_TOKEN=$(VAULT_ADDR=$VAULT_ADDR vault login -method=oidc -format json -no-store | jq -r '.auth.client_token') | ||
| DEV_ROLE_ID= $(VAULT_ADDR=$VAULT_ADDR VAULT_TOKEN=$VAULT_TOKEN vault read -format json auth/vs_apps_approle/role/$2_$3_dev/role-id 2> /dev/null | jq -r '.data.role_id') | ||
| TEST_ROLE_ID=$(VAULT_ADDR=$VAULT_ADDR VAULT_TOKEN=$VAULT_TOKEN vault read -format json auth/vs_apps_approle/role/$2_$3_test/role-id 2> /dev/null | jq -r '.data.role_id') | ||
| PROD_ROLE_ID=$(VAULT_ADDR=$VAULT_ADDR VAULT_TOKEN=$VAULT_TOKEN vault read -format json auth/vs_apps_approle/role/$2_$3_prod/role-id 2> /dev/null | jq -r '.data.role_id') | ||
|
|
||
| echo "$2 : $3 - Role Id" | ||
| echo "dev: $DEV_ROLE_ID" | ||
| echo "test: $TEST_ROLE_ID" | ||
| echo "prod: $PROD_ROLE_ID" | ||
| VAULT_WRAP_JSON=$(echo "{\"app\": \"$2 : $3\", \"dev\": \"$DEV_ROLE_ID\", \"test\": \"$TEST_ROLE_ID\", \"prod\": \"$PROD_ROLE_ID\"}" | \ | ||
| VAULT_ADDR=$VAULT_ADDR VAULT_TOKEN=$VAULT_TOKEN vault write -format json /sys/wrapping/wrap -) | ||
| echo $VAULT_WRAP_JSON | jq '.' | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.