kumo_dockercloud 3.3.2 → 3.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5461f772c936d907aecbec36b81b5bead56b62da
-  data.tar.gz: 05c0b4c6984d8f91b0e3d2406eac231cd2df0586
+  metadata.gz: 08dfdf02e230230624971977dfb4b67c661b444b
+  data.tar.gz: 5d3d3a527876ab7c443d8add610511bf45b22808
 SHA512:
-  metadata.gz: 34d868030388555da99588becc981bee1c3373e9e0ca88b38f7247afddeef1723bfb88b37e6f9c470eff2c442a094ede7b4639233c6f4f41720c7c8b1057aae3
-  data.tar.gz: 105442d8007d76137e22e6176112f748fa751785ad69e93ee6066b47a3434b224bb415049783600433980744b05315ac2a4e06e48eaa214dcf39fed29dbbb5b4
+  metadata.gz: 619c42a20c04490590d85a3ff8dcae5c09c5bdf184eb5f26ea718121efa03ee4747d520e179f811c1739ca59e669095b9b34c84f62954ee1c39feff962f22fc0
+  data.tar.gz: 6ed1c218ea519652b5cec5da8c25a0563252ac6cab43361eceaf389f7fb8039c91594a303e9d44f3d955f3a112b6a6c122b239a3894c5672366aec04e15ab8e2

data/kumo_dockercloud.gemspec

@@ -20,7 +20,7 @@ Gem::Specification.new do |spec|
 
   spec.add_runtime_dependency 'httpi', '~> 2.4'
   spec.add_runtime_dependency 'docker_cloud', '~> 0.1'
-  spec.add_runtime_dependency 'kumo_ki', '~>1.0'
+  spec.add_runtime_dependency 'kumo_ki', '~> 1.1'
 
   spec.add_development_dependency 'bundler', '~> 1.6'
   spec.add_development_dependency 'rake', '~> 10.0'

data/lib/kumo_dockercloud.rb

@@ -11,3 +11,4 @@ require 'kumo_dockercloud/haproxy_service'
 require 'kumo_dockercloud/haproxy_container'
 require 'kumo_dockercloud/haproxy_command'
 require 'kumo_dockercloud/haproxy_event_handler'
+require 'kumo_dockercloud/credentials_decrypter'

data/lib/kumo_dockercloud/credentials_decrypter.rb

@@ -0,0 +1,14 @@
+module KumoDockerCloud
+  class CredentialsDecrypter
+    def decrypt(credentials)
+      kms = KumoKi::KMS.new
+
+      {
+        username: kms.decrypt(credentials[:encrypted_dockercloud_user][5..-1]),
+        api_key: kms.decrypt(credentials[:encrypted_dockercloud_apikey][5..-1])
+      }
+    rescue
+      raise Error.new("Could not decrypt deployment credentials")
+    end
+  end
+end

data/lib/kumo_dockercloud/haproxy_service.rb

@@ -1,7 +1,7 @@
 module KumoDockerCloud
   class HaproxyService < Service
-    def initialize(stack_name)
-      super(stack_name, 'haproxy')
+    def initialize(stack_name, docker_cloud_api = DockerCloudApi.new)
+      super(stack_name, 'haproxy', docker_cloud_api)
 
       @client = docker_cloud_api.client
     end

data/lib/kumo_dockercloud/service.rb

@@ -1,12 +1,11 @@
-require 'timeout'
-
 module KumoDockerCloud
   class Service
     attr_reader :name
 
-    def initialize(stack_name, service_name)
+    def initialize(stack_name, service_name, docker_cloud_api = DockerCloudApi.new)
       @stack_name = stack_name
       @name = service_name
+      @docker_cloud_api = docker_cloud_api
     end
 
     def self.service_by_resource_uri(resource_uri)
@@ -76,7 +75,7 @@ module KumoDockerCloud
     end
 
     def docker_cloud_api
-      @docker_cloud_api ||= KumoDockerCloud::DockerCloudApi.new
+      @docker_cloud_api
     end
 
     def get_service

data/lib/kumo_dockercloud/stack.rb

@@ -4,8 +4,7 @@ module KumoDockerCloud
   class Stack
     attr_reader :stack_name, :app_name, :options
 
-    #TODO delete options
-    def initialize(app_name, env_name, options = { contactable: true })
+    def initialize(app_name, env_name, options = {})
       @app_name = app_name
       @stack_name = "#{app_name}-#{env_name}"
       @options = options
@@ -15,15 +14,15 @@ module KumoDockerCloud
       validate_params(service_name, 'Service name')
       validate_params(version, 'Version')
 
-      service = Service.new(stack_name, service_name)
+      service = Service.new(stack_name, service_name, docker_cloud_api)
       service.deploy(version)
       checker.verify(service)
     end
 
     def deploy_blue_green(service_names, version, checker = ServiceChecker.new)
-      haproxy_service = HaproxyService.new(@stack_name)
+      haproxy_service = HaproxyService.new(@stack_name, docker_cloud_api)
 
-      services = service_names.map { |name| Service.new(stack_name, name) }
+      services = service_names.map { |name| Service.new(stack_name, name, docker_cloud_api) }
       ordered_deployment(services).each do |service|
         begin
           ConsoleJockey.write_line("Attempting to put #{service.name} into maintenance mode in HAProxy")
@@ -59,8 +58,17 @@ module KumoDockerCloud
       raise KumoDockerCloud::Error.new("#{param_name} cannot be empty") if param_value.empty?
     end
 
+    def kms
+      @kms ||= KumoKi::KMS.new
+    end
+
     def docker_cloud_api
-      @docker_cloud_api ||= DockerCloudApi.new
+      dockercloud_api_options = {}
+      if @options[:encrypted_dockercloud_user] && @options[:encrypted_dockercloud_apikey]
+        dockercloud_api_options.merge! KumoDockerCloud::CredentialsDecrypter.new.decrypt(@options)
+      end
+
+      @docker_cloud_api ||= DockerCloudApi.new(dockercloud_api_options)
     end
   end
 end

data/lib/kumo_dockercloud/version.rb

@@ -1,3 +1,3 @@
 module KumoDockerCloud
-  VERSION = '3.3.2'
+  VERSION = '3.4.0'
 end

data/spec/kumo_dockercloud/credentials_decrypter_spec.rb

@@ -0,0 +1,30 @@
+require 'spec_helper'
+
+describe KumoDockerCloud::CredentialsDecrypter do
+  describe '#decrypt' do
+    let(:encrypted_user) { 'encrypted_user' }
+    let(:encrypted_apikey) { 'encrypted_apikey' }
+    let(:plaintext_user) { 'plaintext_user' }
+    let(:plaintext_apikey) { 'plaintext_apikey' }
+    let(:encrypted) { { encrypted_dockercloud_user: "[ENC,#{encrypted_user}", encrypted_dockercloud_apikey: "[ENC,#{encrypted_apikey}" } }
+
+    let(:kms) { instance_double(KumoKi::KMS) }
+
+    subject { described_class.new.decrypt(encrypted) }
+
+    before do
+      allow(KumoKi::KMS).to receive(:new).and_return(kms)
+      allow(kms).to receive(:decrypt).with(encrypted_user).and_return(plaintext_user)
+      allow(kms).to receive(:decrypt).with(encrypted_apikey).and_return(plaintext_apikey)
+    end
+
+    it 'decrypts encrypted credentials' do
+      expect(subject).to eq({ username: plaintext_user, api_key: plaintext_apikey })
+    end
+
+    it 'throws an exception if the credentials cannot be encrypted' do
+      allow(kms).to receive(:decrypt).and_raise(KumoKi::DecryptionError)
+      expect { subject }.to raise_error(KumoDockerCloud::Error, 'Could not decrypt deployment credentials')
+    end
+  end
+end

data/spec/kumo_dockercloud/stack_spec.rb

@@ -9,14 +9,41 @@ describe KumoDockerCloud::Stack do
     let(:version) { '1' }
     let(:checker) { instance_double(KumoDockerCloud::ServiceChecker, verify: nil) }
     let(:service) { instance_double(KumoDockerCloud::Service) }
+    let(:dockercloud_api) { instance_double(KumoDockerCloud::DockerCloudApi) }
 
     before do
-      allow(KumoDockerCloud::Service).to receive(:new).with(stack_name, service_name).and_return(service)
+      allow(KumoDockerCloud::DockerCloudApi).to receive(:new).with({}).and_return(dockercloud_api)
+      allow(KumoDockerCloud::Service).to receive(:new).with(stack_name, service_name, dockercloud_api).and_return(service)
       allow(service).to receive(:deploy).with(version)
     end
 
     subject { stack.deploy(service_name, version) }
 
+    context 'with encrypted credentials' do
+      let(:encrypted_creds) { { encrypted_dockercloud_user: "[ENC,#{encrypted_user}", encrypted_dockercloud_apikey: "[ENC,#{encrypted_apikey}" } }
+      let(:stack_with_encrypted_creds) { described_class.new(app_name, environment_name, encrypted_creds) }
+      let(:credentials_decrypter) { instance_double(KumoDockerCloud::CredentialsDecrypter) }
+      let(:encrypted_user) { 'encrypted_user' }
+      let(:encrypted_apikey) { 'encrypted_apikey' }
+      let(:plaintext_user) { 'plaintext_user' }
+      let(:plaintext_apikey) { 'plaintext_apikey' }
+      let(:decrypted_creds) { { username: plaintext_user, api_key: plaintext_apikey } }
+
+      subject { stack_with_encrypted_creds.deploy(service_name, version) }
+
+      before do
+        allow(KumoDockerCloud::CredentialsDecrypter).to receive(:new).and_return(credentials_decrypter)
+        allow(credentials_decrypter).to receive(:decrypt).with(encrypted_creds).and_return(decrypted_creds)
+        allow(KumoDockerCloud::DockerCloudApi).to receive(:new).with(decrypted_creds).and_return(dockercloud_api)
+      end
+
+      it 'decrypts the credentials and uses them to authenticate with docker cloud' do
+        expect(KumoDockerCloud::Service).to receive(:new).with(stack_name, service_name, dockercloud_api).and_return(service)
+
+        subject
+      end
+    end
+
     it 'deploys the version of my service' do
       expect(service).to receive(:deploy).with(version)
       subject
@@ -74,11 +101,13 @@ describe KumoDockerCloud::Stack do
     let(:service_a) { instance_double(KumoDockerCloud::Service, :service_a, state: 'Running', deploy: nil, name: 'service_a') }
     let(:service_b) { instance_double(KumoDockerCloud::Service, :service_b, state: 'Running', deploy: nil, name: 'service_b') }
     let(:haproxy) { instance_double(KumoDockerCloud::HaproxyService, :haproxy_svc, disable_service: nil, enable_service: nil) }
+    let(:dockercloud_api) { instance_double(KumoDockerCloud::DockerCloudApi) }
 
     before do
-      allow(KumoDockerCloud::Service).to receive(:new).with(stack_name, 'service-a').and_return(service_a)
-      allow(KumoDockerCloud::Service).to receive(:new).with(stack_name, 'service-b').and_return(service_b)
-      allow(KumoDockerCloud::HaproxyService).to receive(:new).with(stack_name).and_return(haproxy)
+      allow(KumoDockerCloud::DockerCloudApi).to receive(:new).with({}).and_return(dockercloud_api)
+      allow(KumoDockerCloud::Service).to receive(:new).with(stack_name, 'service-a', dockercloud_api).and_return(service_a)
+      allow(KumoDockerCloud::Service).to receive(:new).with(stack_name, 'service-b', dockercloud_api).and_return(service_b)
+      allow(KumoDockerCloud::HaproxyService).to receive(:new).with(stack_name, dockercloud_api).and_return(haproxy)
       allow(KumoDockerCloud::ConsoleJockey).to receive(:write_line)
     end
 
@@ -128,6 +157,33 @@ describe KumoDockerCloud::Stack do
       allow(checker).to receive(:verify).with(service_a).and_raise(KumoDockerCloud::ServiceDeployError)
       expect { subject }.to raise_error(KumoDockerCloud::ServiceDeployError)
     end
+
+    context 'with encrypted credentials' do
+      let(:encrypted_creds) { { encrypted_dockercloud_user: "[ENC,#{encrypted_user}", encrypted_dockercloud_apikey: "[ENC,#{encrypted_apikey}" } }
+      let(:stack_with_encrypted_creds) { described_class.new(app_name, environment_name, encrypted_creds) }
+      let(:credentials_decrypter) { instance_double(KumoDockerCloud::CredentialsDecrypter) }
+      let(:encrypted_user) { 'encrypted_user' }
+      let(:encrypted_apikey) { 'encrypted_apikey' }
+      let(:plaintext_user) { 'plaintext_user' }
+      let(:plaintext_apikey) { 'plaintext_apikey' }
+      let(:decrypted_creds) { { username: plaintext_user, api_key: plaintext_apikey } }
+
+      subject { stack_with_encrypted_creds.deploy_blue_green(service_names, version, checker) }
+
+      before do
+        allow(KumoDockerCloud::CredentialsDecrypter).to receive(:new).and_return(credentials_decrypter)
+        allow(credentials_decrypter).to receive(:decrypt).with(encrypted_creds).and_return(decrypted_creds)
+        allow(KumoDockerCloud::DockerCloudApi).to receive(:new).with(decrypted_creds).and_return(dockercloud_api)
+      end
+
+      it 'decrypts the credentials and uses them to authenticate with docker cloud' do
+        expect(KumoDockerCloud::Service).to receive(:new).with(stack_name, 'service-a', dockercloud_api).and_return(service_a)
+        expect(KumoDockerCloud::Service).to receive(:new).with(stack_name, 'service-b', dockercloud_api).and_return(service_b)
+        expect(KumoDockerCloud::HaproxyService).to receive(:new).with(stack_name, dockercloud_api).and_return(haproxy)
+
+        subject
+      end
+    end
   end
 
   describe '#services' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kumo_dockercloud
 version: !ruby/object:Gem::Version
-  version: 3.3.2
+  version: 3.4.0
 platform: ruby
 authors:
 - Redbubble
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-06-02 00:00:00.000000000 Z
+date: 2016-06-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httpi
@@ -46,14 +46,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.1'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -158,6 +158,7 @@ files:
 - kumo_dockercloud.gemspec
 - lib/kumo_dockercloud.rb
 - lib/kumo_dockercloud/console_jockey.rb
+- lib/kumo_dockercloud/credentials_decrypter.rb
 - lib/kumo_dockercloud/deployment.rb
 - lib/kumo_dockercloud/docker_cloud_api.rb
 - lib/kumo_dockercloud/environment.rb
@@ -184,6 +185,7 @@ files:
 - spec/fixtures/stack.yml.erb
 - spec/kumo_docker_cloud_spec.rb
 - spec/kumo_dockercloud/console_jockey_spec.rb
+- spec/kumo_dockercloud/credentials_decrypter_spec.rb
 - spec/kumo_dockercloud/docker_cloud_api_spec.rb
 - spec/kumo_dockercloud/environment_config_spec.rb
 - spec/kumo_dockercloud/environment_spec.rb
@@ -229,6 +231,7 @@ test_files:
 - spec/fixtures/stack.yml.erb
 - spec/kumo_docker_cloud_spec.rb
 - spec/kumo_dockercloud/console_jockey_spec.rb
+- spec/kumo_dockercloud/credentials_decrypter_spec.rb
 - spec/kumo_dockercloud/docker_cloud_api_spec.rb
 - spec/kumo_dockercloud/environment_config_spec.rb
 - spec/kumo_dockercloud/environment_spec.rb