hiera-eyaml-kms 0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 7e602a14226ec30ad5947431c5fa08a7a4e9d06a
+  data.tar.gz: f61d036c16aa49f5a552c46a5902744729f879b2
+SHA512:
+  metadata.gz: 5f549ed5e034e0e06364d2b4c8c3726e57de862ba42340db1e192399532af4bedca17b8cddbaaed21f7bb46d496068ee73a8f4c88b435f4733d1efb3ef224ce0
+  data.tar.gz: 298684abfb1078b1b0fb851b31facbb37c51b754ca11816475875f15d73a160d3a90fbce8c4193fa3db231dff2097fee915dfa6aee54f9944ea824ef0ab6b5c2

data/.gitignore

@@ -0,0 +1,9 @@
+.idea
+*.iml
+*.gradle
+keys/*.pem
+pkg/
+tmp/
+.DS_Store
+.ruby-version
+hiera-eyaml-kms-*.gem

data/Gemfile

@@ -0,0 +1,7 @@
+source 'https://rubygems.org/'
+
+gem 'aws-sdk', '~> 2'
+
+group :development do
+  gem "aruba"
+end

data/Gemfile.lock

@@ -0,0 +1,30 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    aruba (0.5.3)
+      childprocess (>= 0.3.6)
+      cucumber (>= 1.1.1)
+      rspec-expectations (>= 2.7.0)
+    builder (3.2.2)
+    childprocess (0.3.9)
+      ffi (~> 1.0, >= 1.0.11)
+    cucumber (1.3.10)
+      builder (>= 2.1.2)
+      diff-lcs (>= 1.1.3)
+      gherkin (~> 2.12)
+      multi_json (>= 1.7.5, < 2.0)
+      multi_test (>= 0.0.2)
+    diff-lcs (1.2.5)
+    ffi (1.9.3)
+    gherkin (2.12.2)
+      multi_json (~> 1.3)
+    multi_json (1.8.2)
+    multi_test (0.0.2)
+    rspec-expectations (2.14.4)
+      diff-lcs (>= 1.1.3, < 2.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  aruba

data/LICENSE.txt

@@ -0,0 +1,21 @@
+
+The MIT License (MIT)
+
+Copyright (c) 2015 Allan Denot
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,63 @@
+hiera-eyaml-kms
+===============
+
+This is a plugin encryptor for the hiera-eyaml project (hosted https://github.com/TomPoulton/hiera-eyaml/).
+
+*hiera-eyaml-kms encrypts and decrypts Hiera data using AWS KMS.*
+
+AWS KMS is a service that encrypts and decrypts data through API calls. Permissions are controlled by IAM. [Read more about AWS KMS](http://docs.aws.amazon.com/kms/latest/developerguide/overview.html).
+
+Using KMS avoids having to expose private keys to decrypt information when running Puppet.
+
+Requirements
+------------
+
+Since this is a plugin for hiera-eyaml, you need to install it first:
+
+```
+$ gem install hiera-eyaml
+```
+
+You might need to install the aws-sdk for ruby, with the command:
+
+```
+$ gem install aws-sdk
+```
+
+This plugin uses aws-sdk version 2.
+
+Installation
+------------
+
+```
+$ gem install hiera-eyaml-kms
+```
+
+Then see [hiera-eyaml documentation](https://github.com/TomPoulton/hiera-eyaml) for how to use the eyaml tool to encrypt and use the 'KMS' encryption_type for values to be encrypted with this plugin.
+
+Configuration
+-------------
+
+This plugin adds 2 options to hiera-eyaml:
+
+```
+--kms-key-id=<s>            KMS Key ID (default: )
+--kms-aws-region=<s>        AWS Region (default: ap-southeast-2)
+```
+
+To avoid passing CLI parameters every call to eyaml, you can create a config file to set the defaults.
+
+Config files will be read first from `/etc/eyaml/config.yaml`, then from `~/.eyaml/config.yaml` and finally by anything referenced in the `EYAML_CONFIG` environment variable.
+
+Example:
+
+```yaml
+---
+kms_key_id: '00000000-0000-0000-0000-000000000000'
+kms_aws_region: 'us-west-1'
+```
+
+Authors
+=======
+
+- [Allan Denot](http://github.com/adenot)

data/Rakefile

@@ -0,0 +1 @@
+require "bundler/gem_tasks"

data/hiera-eyaml-kms.gemspec

@@ -0,0 +1,19 @@
+# -*- encoding: utf-8 -*-
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'hiera/backend/eyaml/encryptors/kms'
+
+Gem::Specification.new do |gem|
+  gem.name          = "hiera-eyaml-kms"
+  gem.version       = Hiera::Backend::Eyaml::Encryptors::Kms::VERSION
+  gem.description   = "AWS KMS encryptor for use with hiera-eyaml"
+  gem.summary       = "Encryption plugin for hiera-eyaml backend for Hiera"
+  gem.author        = "Allan Denot"
+  gem.license       = "MIT"
+
+  gem.homepage      = "http://github.com/adenot/hiera-eyaml-kms"
+  gem.files         = `git ls-files`.split($/)
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.require_paths = ["lib"]
+end

data/lib/hiera/backend/eyaml/encryptors/kms.rb

@@ -0,0 +1,65 @@
+require 'openssl'
+require 'hiera/backend/eyaml/encryptor'
+require 'hiera/backend/eyaml/utils'
+require 'hiera/backend/eyaml/options'
+require 'aws-sdk'
+
+class Hiera
+  module Backend
+    module Eyaml
+      module Encryptors
+
+        class Kms < Encryptor
+
+          self.options = {
+            :key_id => {      :desc => "KMS Key ID",
+                              :type => :string,
+                              :default => "" },
+            :aws_region => {  :desc => "AWS Region",
+                              :type => :string,
+                              :default => "ap-southeast-2" }
+          }
+
+          VERSION = "0.1"
+          self.tag = "KMS"
+
+          def self.encrypt plaintext
+            aws_region = self.option :aws_region
+            key_id = self.option :key_id
+            raise StandardError, "key_id is not defined" unless key_id
+
+            @kms = ::Aws::KMS::Client.new(
+              region: aws_region
+            )
+
+            resp = @kms.encrypt({
+              key_id: key_id,
+              plaintext: plaintext
+            })
+
+            resp.ciphertext_blob
+          end
+
+          def self.decrypt ciphertext
+            aws_region = self.option :aws_region
+
+            @kms = ::Aws::KMS::Client.new(
+              region: aws_region
+            )
+
+            resp = @kms.decrypt({
+              ciphertext_blob: ciphertext
+            })
+
+            resp.plaintext
+          end
+
+        end
+
+      end
+
+    end
+
+  end
+
+end

data/lib/hiera/backend/eyaml/encryptors/kms/eyaml_init.rb

@@ -0,0 +1,3 @@
+require 'hiera/backend/eyaml/encryptors/kms'
+
+Hiera::Backend::Eyaml::Encryptors::Kms.register

data/tools/regem.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+GEM_NAME="hiera-eyaml-kms"
+
+gem uninstall ${GEM_NAME} --executables
+RAKE_OUT=`rake build`
+VERSION=`echo ${RAKE_OUT} | awk '{print $2}'`
+echo Installing version: ${VERSION} ...
+gem install pkg/${GEM_NAME}-${VERSION}.gem --no-ri --no-rdoc
+
+if [ ! -z "$(which eyaml)" ];then
+  eyaml version
+else
+  echo "install hiera-eyaml to see if gem imports correctly"
+fi

metadata

@@ -0,0 +1,53 @@
+--- !ruby/object:Gem::Specification
+name: hiera-eyaml-kms
+version: !ruby/object:Gem::Version
+  version: '0.1'
+platform: ruby
+authors:
+- Allan Denot
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-08-26 00:00:00.000000000 Z
+dependencies: []
+description: AWS KMS encryptor for use with hiera-eyaml
+email: 
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- Gemfile
+- Gemfile.lock
+- LICENSE.txt
+- README.md
+- Rakefile
+- hiera-eyaml-kms.gemspec
+- lib/hiera/backend/eyaml/encryptors/kms.rb
+- lib/hiera/backend/eyaml/encryptors/kms/eyaml_init.rb
+- tools/regem.sh
+homepage: http://github.com/adenot/hiera-eyaml-kms
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.0.14
+signing_key: 
+specification_version: 4
+summary: Encryption plugin for hiera-eyaml backend for Hiera
+test_files: []