domed-city 3.0.1 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: dfb7e4a9a5f9c16f580669b1bc182dc1f617847a
-  data.tar.gz: 85b9252a348897c7aeae9544d53ab7ae3f1e097f
+  metadata.gz: 6744973673ccdca6eba774cc3347a1c8d7107bbd
+  data.tar.gz: 7e4811795a1b527253938ca7204e21578078b3f1
 SHA512:
-  metadata.gz: 9e06ae2c8a29c882d6dcdc6b88c81c973f932fad476aeabc4740e37fb572e25661fc4a2126dde18f1082eb78369283721d7abd1b9c890a2f6557019b309e58a5
-  data.tar.gz: 59cbc4bf3e339285be30a35524239e7bb793a57ce84f70fc54fdd3d099ec831c6d0b8e202ffbcfb87cf736c93212b3b2eecb976b527c3069d22693b3d69c26c8
+  metadata.gz: dabbb1a896e2d68ba2eaa5312a81f78dc7781689d542d9acc71394cd3f2d4b025eeaf0f443f8811e727c938841c0f31cc448fb722c52ca41d8e816bb897bd432
+  data.tar.gz: 95a48cda0d4a8b695666a24e4d85647da09ec4637db65e8e83eb52d8a3dc9e3ed54cc34c66d5aaa7f60e8ec9f1069efdca8fb8dab5d9ac95bd6b12d22f765684

data/.rubocop.yml

@@ -9,3 +9,6 @@ LineLength:
   Description: 'Limit lines to a more generous 120 characters.'
   Enabled: true
   Max: 120
+
+Metrics/MethodLength:
+  Max: 15

data/CHANGELOG.md

@@ -1,3 +1,26 @@
+# 3.1.0
+
+Added hiera-eyaml support.
+
+This allows us to use encrypted Terraform variables via hiera lookups (the `hiera.yaml` is consumed).
+
+It also allows us to decrypt and extract SSL certificates or SSH keys which can then be used as appropriate.
+
+In order to utilise these two improvements, you must update your `itv.yaml` e.g.:
+
+```
+dome:
+  hiera_keys:
+    artifactory_password: 'deirdre::artifactory_password'
+  certs:
+    sit.phoenix.itv.com.pem: 'phoenix::sit_wildcard_cert'
+    phoenix.key: 'phoenix::certificate_key'
+```
+
+This release also containes:
+- Improved debugging/output messages.
+- More tests.
+
 # 3.0.1
 
 Forcibly unsetting environment variables `AWS_ACCESS_KEY` and `AWS_SECRET_KEY`.

data/dome.gemspec

@@ -25,4 +25,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'trollop', '~> 2.1'
   spec.add_dependency 'aws-sdk', '~> 2.1'
   spec.add_dependency 'colorize', '~> 0.7'
+  spec.add_dependency 'hiera', '~> 1.3'
+  spec.add_dependency 'hiera-eyaml', '~> 2.1'
 end

data/lib/dome.rb

@@ -3,6 +3,7 @@ require 'aws-sdk'
 require 'colorize'
 require 'fileutils'
 require 'yaml'
+require 'hiera'
 
 require 'dome/settings'
 require 'dome/version'
@@ -10,3 +11,5 @@ require 'dome/helpers/shell'
 require 'dome/environment'
 require 'dome/state'
 require 'dome/terraform'
+require 'dome/hiera_lookup'
+require 'dome/secrets'

data/lib/dome/environment.rb

@@ -1,10 +1,11 @@
 module Dome
   class Environment
-    attr_reader :environment, :account, :settings
+    attr_reader :environment, :account, :ecosystem, :settings
 
     def initialize(directories = Dir.pwd.split('/'))
       @environment = directories[-1]
       @account     = directories[-2]
+      @ecosystem   = directories[-2].split('-')[-1]
       @settings    = Dome::Settings.new
     end
 
@@ -60,7 +61,6 @@ module Dome
 
     private
 
-    # rubocop:disable Metrics/MethodLength
     # rubocop:disable Metrics/AbcSize
     def generic_error_message
       puts "The 'account' and 'environment' variables are assigned based on your current directory.\n".colorize(:red)

data/lib/dome/hiera_lookup.rb

@@ -0,0 +1,91 @@
+module Dome
+  class HieraLookup
+    def initialize(environment)
+      @environment = environment.environment
+      @account     = environment.account
+      @ecosystem   = environment.ecosystem
+      @settings    = Dome::Settings.new
+    end
+
+    def config
+      @config ||= YAML.load_file(File.join(puppet_dir, 'hiera.yaml')).merge(default_config)
+    end
+
+    def default_config
+      {
+        logger: 'noop',
+        yaml: {
+          datadir: "#{puppet_dir}/hieradata"
+        },
+        eyaml: {
+          datadir: "#{puppet_dir}/hieradata",
+          pkcs7_private_key: eyaml_private_key,
+          pkcs7_public_key: eyaml_public_key
+        }
+      }
+    end
+
+    def puppet_dir
+      directory = File.join(@settings.project_root, 'puppet')
+      puts "The configured Puppet directory is: #{directory.colorize(:green)}" unless @directory
+      @directory ||= directory
+    end
+
+    def eyaml_private_key
+      private_key = File.join(puppet_dir, 'keys/private_key.pkcs7.pem')
+      raise "Cannot find eyaml private key! Make sure it exists at #{private_key}" unless File.exist?(private_key)
+      puts "Found eyaml private key: #{private_key.colorize(:green)}"
+      private_key
+    end
+
+    def eyaml_public_key
+      public_key = File.join(puppet_dir, 'keys/public_key.pkcs7.pem')
+      raise "Cannot find eyaml public key! Make sure it exists at #{public_key}" unless File.exist?(public_key)
+      puts "Found eyaml public key: #{public_key.colorize(:green)}"
+      public_key
+    end
+
+    def lookup(key, default = nil, order_override = nil, resolution_type = :priority)
+      hiera = Hiera.new(config: config)
+
+      hiera_scope = {}
+      hiera_scope['ecosystem'] = @ecosystem
+      hiera_scope['location']  = 'aeuw1'
+      hiera_scope['env']       = @environment
+
+      hiera.lookup(key.to_s, default, hiera_scope, order_override, resolution_type)
+    end
+
+    def secret_env_vars(secret_vars)
+      secret_vars.each_pair do |key, val|
+        hiera_lookup = lookup(val)
+        terraform_env_var = "TF_VAR_#{key}"
+        ENV[terraform_env_var] = hiera_lookup
+        if hiera_lookup
+          puts "Setting #{terraform_env_var.colorize(:green)}."
+        else
+          puts "Hiera lookup failed for '#{val}', so #{terraform_env_var} was not set.".colorize(:red)
+        end
+      end
+    end
+
+    def extract_certs(certs)
+      create_certificate_directory
+
+      certs.each_pair do |key, val|
+        directory = "#{certificate_directory}/#{key}"
+        puts "Extracting certificate #{key.colorize(:green)} into #{directory.colorize(:green)}"
+        File.open(directory, 'w') { |f| f.write(lookup(val)) }
+      end
+    end
+
+    def create_certificate_directory
+      puts "Creating certificate directory at #{certificate_directory.colorize(:green)}"
+      FileUtils.mkdir_p certificate_directory
+    end
+
+    def certificate_directory
+      "#{@settings.project_root}/terraform/certs"
+    end
+  end
+end

data/lib/dome/secrets.rb

@@ -0,0 +1,38 @@
+module Dome
+  class Secrets
+    attr_reader :settings, :hiera
+
+    def initialize(environment)
+      @environment = environment
+      @settings    = Dome::Settings.new
+      @hiera       = Dome::HieraLookup.new(@environment)
+    end
+
+    def secret_env_vars
+      return if dome_config.nil? || hiera_keys_config.nil?
+      @hiera.secret_env_vars(hiera_keys_config)
+    end
+
+    def extract_certs
+      return if dome_config.nil? || certs_config.nil?
+      @hiera.extract_certs(certs_config)
+    end
+
+    def dome_config
+      puts "No #{'dome'.colorize(:green)} key found in your itv.yaml." unless @settings.parse['dome']
+      @settings.parse['dome']
+    end
+
+    def hiera_keys_config
+      puts "No #{'hiera_keys'.colorize(:green)} sub-key under #{'dome'.colorize(:green)} key found "\
+      'in your itv.yaml.' unless @settings.parse['dome']['hiera_keys']
+      @settings.parse['dome']['hiera_keys']
+    end
+
+    def certs_config
+      puts "No #{'certs'.colorize(:green)} sub-key under #{'dome'.colorize(:green)} key found "\
+      'in your itv.yaml.' unless @settings.parse['dome']['certs']
+      @settings.parse['dome']['certs']
+    end
+  end
+end

data/lib/dome/settings.rb

@@ -12,5 +12,9 @@ module Dome
     def itv_yaml_path
       '../../../itv.yaml'
     end
+
+    def project_root
+      File.realpath(File.dirname(itv_yaml_path))
+    end
   end
 end

data/lib/dome/terraform.rb

@@ -6,6 +6,7 @@ module Dome
 
     def initialize
       @environment = Dome::Environment.new
+      @secrets     = Dome::Secrets.new(@environment)
       @state       = Dome::State.new(@environment)
       @plan_file   = "plans/#{@environment.account}-#{@environment.environment}-plan.tf"
     end
@@ -45,13 +46,16 @@ module Dome
     end
 
     def apply
+      @secrets.secret_env_vars
       command         = "terraform apply #{@plan_file}"
       failure_message = 'something went wrong when applying the TF plan'
       execute_command(command, failure_message)
     end
 
     def create_plan
-      command         = "terraform plan -module-depth=1 -refresh=true -out=#{@plan_file} -var-file=params/env.tfvars"
+      @secrets.secret_env_vars
+      @secrets.extract_certs
+      command         = "terraform plan -refresh=true -out=#{@plan_file} -var-file=params/env.tfvars"
       failure_message = 'something went wrong when creating the TF plan'
       execute_command(command, failure_message)
     end

data/lib/dome/version.rb

@@ -1,3 +1,3 @@
 module Dome
-  VERSION = '3.0.1'.freeze
+  VERSION = '3.1.0'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: domed-city
 version: !ruby/object:Gem::Version
-  version: 3.0.1
+  version: 3.1.0
 platform: ruby
 authors:
 - ITV
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-06 00:00:00.000000000 Z
+date: 2016-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -108,6 +108,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.7'
+- !ruby/object:Gem::Dependency
+  name: hiera
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: hiera-eyaml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
 description: 
 email:
 - common-platform-team-group@itv.com
@@ -131,6 +159,8 @@ files:
 - lib/dome.rb
 - lib/dome/environment.rb
 - lib/dome/helpers/shell.rb
+- lib/dome/hiera_lookup.rb
+- lib/dome/secrets.rb
 - lib/dome/settings.rb
 - lib/dome/state.rb
 - lib/dome/terraform.rb