sambot 0.1.178 → 0.1.179

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5765d9dc51f85ddd7a58784b996444a30023a0f2
-  data.tar.gz: 3286429d57369a7968bc2ffd0e74784d1404ac58
+  metadata.gz: a0e07b3e1bac4b8ba2285c15bb23b2a8548289be
+  data.tar.gz: 836a12b7924d4996e8b50585071493ec96eb564d
 SHA512:
-  metadata.gz: ac4bf37f94930957188b13f9805f0805f458731658a25207c027a4abcfdf1aa31093ad29e29d3c319f2d218c6046320ad84914743879dda8ba79c3ba8d070f49
-  data.tar.gz: c51a0fb82a4271539bfb2316cacb0f524e406ab4a71c90d297964c305b7b4bacfcdf0b24a94bc183dea88c218ca9f318a6854a97ad16cd40070db5e71ebb8706
+  metadata.gz: bbf7ee2e814fb8c4aca795c0782b3709253219c669d59b894164dc4a3dc19179e0d5c0cad9478b45f3ca96a3e6dc131c40410583fc235b15bebc4c114156edc5
+  data.tar.gz: a298786b80ced0a64ed2226d69d5fa01025c38a9179de710dc09144fff99a185bf23af4aaf2f024ba9ecfc89c38b72ef826e23a42bdac69a1fc0a4e30d354b23

data/lib/sambot.rb

@@ -10,6 +10,7 @@ require_relative 'sambot/fs'
 
 require_relative 'sambot/testing/consul_helper'
 require_relative 'sambot/testing/vault_helper'
+require_relative 'sambot/testing/fixtures'
 
 require_relative 'sambot/chef/kitchen'
 require_relative 'sambot/chef/metadata'

data/lib/sambot/chef/cookbook.rb

@@ -9,6 +9,8 @@ module Sambot
       GENERATED_FILES = {
         'teamcity.sh.erb': {eruby: true, dest: 'teamcity.sh', platform: [:windows, :centos]},
         'chefignore': {eruby: false, dest: 'chefignore', platform: [:windows, :centos]},
+        'docker-compose.yml': {eruby: false, dest: 'chefignore', platform: [:windows, :centos]},
+        '.env': {eruby: false, dest: 'chefignore', platform: [:windows, :centos]},
         'Berksfile': {eruby: false, dest: 'Berksfile', platform: [:windows, :centos]},
         '.rubocop.yml': {eruby: false, dest: '.rubocop.yml', platform: [:windows, :centos]},
         '.gitignore.sample': {eruby: false, dest: '.gitignore', platform: [:windows, :centos]},
@@ -18,10 +20,10 @@ module Sambot
 
       class << self
 
-        def build(config, cloud, vault_setup = nil)
-          create_files(config, true)
-          Generator.from_templates(config, cloud, vault_setup, GENERATED_FILES)
-          Kitchen.setup(cloud, config, vault_setup)
+        def build(config, cloud, local_workflow)
+          create_files(config)
+          Generator.from_templates(config, cloud, local_workflow, GENERATED_FILES)
+          Kitchen.setup(cloud, config, local_workflow)
           Metadata.generate(config)
           Hooks.copy()
           UI.info('The cookbook has been successfully built.')
@@ -54,14 +56,14 @@ module Sambot
 
         private
 
-        def create_files(config, build_phase = false)
-          ['.vault.yml', '.consul.yml', 'README.md'].each { |resource| FS.copy(resource) unless FS.exist?(resource) }
-          ['spec', 'test', 'attributes', 'vault'].each { |resource| FS.mkdir(resource) unless FS.exist?(resource) }
-          Dir.chdir('attributes') { FileUtils.touch('default.rb') unless build_phase }
-          Dir.chdir('spec') { FS.copy('spec_helper.rb') unless FS.exist?('spec_helper.rb') unless build_phase }
+        def create_files(config)
+          ['README.md'].each { |resource| FS.copy(resource) unless FS.exist?(resource) }
+          ['spec', 'test', 'attributes', 'local_testing'].each { |resource| FS.mkdir(resource) unless FS.exist?(resource) }
+          Dir.chdir('attributes') { FileUtils.touch('default.rb') unless FS.exist?('default.rb') }
+          Dir.chdir('spec') { FS.copy('spec_helper.rb') unless FS.exist?('spec_helper.rb') }
           ['recipes', 'libraries', 'resources', 'files', 'templates'].each { |target| FS.mkdir(target) unless FS.exist?(target) }
           Dir.chdir('recipes') do
-            FileUtils.touch('default.rb') unless FS.exist?('default.rb') && !build_phase
+            FileUtils.touch('default.rb') unless FS.exist?('default.rb')
           end
           unless FS.exist?('.config.yml')
             Template.new('.config.yml.erb').write({config: config}, '.config.yml')

data/lib/sambot/chef/generator.rb

@@ -5,9 +5,9 @@ module Sambot
     module Chef
       class Generator
 
-        def self.from_templates(config, cloud, vault_setup, generated_files)
+        def self.from_templates(config, cloud, local_workflow, generated_files)
           generated_files.each { |template_name, opts| generate_from_template(template_name.to_s, opts, config) }
-          generate_bootstrap_scripts(config, cloud, vault_setup)
+          generate_bootstrap_scripts(config, cloud, local_workflow)
         end
 
         private
@@ -29,8 +29,8 @@ module Sambot
           Template.new("bootstrap_scripts/#{path}/bootstrap.#{suffix}.erb").process({eruby: true, dest: "bootstrap.#{suffix}"})
         end
 
-        def self.generate_bootstrap_scripts(config, cloud, vault_setup)
-          cloud != 'local'? bootstrap(config, cloud) : bootstrap(config, "local/#{vault_setup}_vault")
+        def self.generate_bootstrap_scripts(config, cloud, local_workflow)
+          cloud != 'local'? bootstrap(config, cloud) : bootstrap(config, "local/#{local_workflow}")
         end
 
         def self.exists!(path)

data/lib/sambot/cli.rb

@@ -10,17 +10,11 @@ module Sambot
       execute { Chef::Cookbook.clean() }
     end
 
-    desc 'populate', 'Populates either Vault or Consul with seed data'
-    option :vault, :type => :boolean
-    option :consul, :type => :boolean
+    desc 'populate', 'Populates Vault and Consul with seed data'
     def populate
       execute do
-        unless options[:vault] || options[:consul]
-          UI.error('Please select the datastore you are populating from the following: --vault or --consul')
-          exit
-        end
-        Sambot::Testing::VaultHelper.load_secrets if options[:vault]
-        Sambot::Testing::ConsulHelper.load_values if options[:consul]
+        Sambot::Testing::VaultHelper.load_secrets(Config.read)
+        Sambot::Testing::ConsulHelper.load_values(Config.read)
       end
     end
 
@@ -33,7 +27,7 @@ module Sambot
     option :local, :type => :boolean
     option :google, :type => :boolean
     option :rackspace, :type => :boolean
-    option :vault, :type => :string, :default => 'standalone'
+    option :docker, :type => :boolean
     def build
       execute do
         cloud = nil
@@ -44,7 +38,8 @@ module Sambot
           UI.error('Please select which environment this is building for using one of the following flags: --local, --rackspace or --google')
           exit
         end
-        Chef::Cookbook.build(Config.read, cloud, options[:vault])
+        local_workflow = options[:docker] ? 'docker' : 'vagrant'
+        Chef::Cookbook.build(Config.read, cloud, local_workflow)
       end
     end
 

data/lib/sambot/config.rb

@@ -56,32 +56,24 @@ module Sambot
         end
 
         def dependencies=(value)
-          @opts['dependencies'] = @opts[:dependencies] = value
+          @opts['dependencies'] = value
         end
 
         def transform_hashes(obj)
           obj.is_a?(Hash) ? "#{obj.keys.first}', '#{obj.values.first}" : obj
         end
 
-        def description
-           @opts['description'] || @opts[:description]
-        end
+        def description; @opts['description']; end
 
-        def identifier
-           @opts['identifier'] || @opts[:identifier]
-        end
+        def identifier; @opts['identifier']; end
 
-        def suites
-           @opts['suites'] || @opts[:suites]
-        end
+        def suites; @opts['suites']; end
 
-        def version
-           @opts['version'] || @opts[:version]
-        end
+        def version; @opts['version']; end
 
-        def name
-           @opts['name'] || @opts[:name]
-        end
+        def secrets; @opts['secrets']; end
+
+        def name; @opts['name']; end
 
         def runs_on_centos?
           available_platforms.include?('centos')

data/lib/sambot/template.rb

@@ -22,7 +22,7 @@ module Sambot
       File.delete(opts[:dest]) if File.exist?(opts[:dest])
       if opts[:eruby]
         UI.debug("Parsing #{self.path} using Erubis")
-        self.write({}, opts[:dest])
+        self.write(opts, opts[:dest])
       else
         FileUtils.cp(self.path, opts[:dest].to_s)
       end

data/lib/sambot/templates/.env

@@ -0,0 +1,4 @@
+VC_VAULT_ADDR=http://127.0.0.1:8200
+VAULT_ADDR=http://127.0.0.1:8200
+VC_VAULT_TOKEN=root
+VAULT_TOKEN=root

data/lib/sambot/templates/.rubocop.yml

@@ -7,5 +7,5 @@ Style/MutableConstant:
   Exclude:
     - recipes/linux_chefdk_setup.rb
 
-Style/EmptyLinesAroundBlockBody:
+Layout/EmptyLinesAroundBlockBody:
   Enabled: false

data/lib/sambot/templates/bootstrap_scripts/google/bootstrap.ps1.erb

@@ -1,3 +1,28 @@
+#################################################################################
+# PROVISIONING A WINDOWS BOX                                                    #
+#################################################################################
+#                                                                               #
+# All our instances need to access Vault in order to retrieve secrets such as   #
+# credentials or certificates.                                                  #
+#                                                                               #
+# This bootstrap script provides the capability to do so.                       #
+#                                                                               #
+# When an instance is created through Terraform or Rundeck, this script is      #
+# provided to bootstrap the box. When the script is generated a wrapper token   #
+# is also generated - present in ENV['GCP_VAULT_TOKEN'] - which is used by      #
+# the instance to obtain the real token it needs from Vault.                    #
+#                                                                               #
+# Once the real token has been obtained, it is periodicially renewed by the     #
+# as-vault-token tool.                                                          #
+#                                                                               #
+# The periodic running of this task is managed by the as-vault-token cookbook.  #
+#                                                                               #
+#################################################################################
+
+#################################################################################
+# Miscellaneous Windows configuration.                                          #
+#################################################################################
+
 netsh advfirewall firewall add rule name="winrm" dir=in action=allow protocol=TCP localport=5985
 winrm quickconfig -q
 winrm set winrm/config/service @{AllowUnencrypted="true"}
@@ -6,6 +31,21 @@ winrm set winrm/config/service/auth @{Basic="true"}
 Add-Type -AssemblyName "System.IO.Compression.FileSystem"
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
 
+#################################################################################
+# Install Hashicorp Vault.                                                      #
+#################################################################################
+
+$wc = New-Object System.Net.WebClient
+$url = "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_windows_amd64.zip"
+$output = "C:\Program Files\vault"
+$zipfile = "$output\$($url.Split('/')[-1])"
+$wc.DownloadFile($url, "$zipfile")
+[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
+
+#################################################################################
+# Install Advertising Studio's as-vault-tool binary.                            #
+#################################################################################
+
 $output = "C:\Program Files\vault"
 New-Item $output -ItemType Directory -Force
 $url = "https://storage.googleapis.com/ads-devops-chef/as-vault-tool/<%= ENV['AS_VAULT_TOOL_VERSION'] %>/windows_amd64.zip"
@@ -13,6 +53,10 @@ $zipfile = "$output\$($url.Split('/')[-1])"
 $wc.DownloadFile($url, $zipfile)
 [System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
 
+#################################################################################
+# Create the tokens.json file containing the Vault access token.                #
+#################################################################################
+
 $json = @"
 {
     "vault-addr": "<%= ENV['GCP_VAULT_ADDR'] %>",
@@ -25,4 +69,11 @@ $json = @"
 New-Item 'C:\ProgramData\vault' -ItemType Directory -Force
 Set-Content -Path 'C:\ProgramData\vault\tokens.json' -Value $json
 
+###### TODO - NEED TO ADD GROUPS STUFF!!!!!
+
+#################################################################################
+# Get the real token from the wrapped token and store it in the                 #
+# tokens.json file.                                                             #
+#################################################################################
+
 & "$output\as-vault-tool" tokenrenew

data/lib/sambot/templates/bootstrap_scripts/google/bootstrap.sh.erb

@@ -1,6 +1,37 @@
 #!/bin/bash -e
 
+#################################################################################
+# PROVISIONING A LINUX BOX                                                      #
+#################################################################################
+#                                                                               #
+# All our instances need to access Vault in order to retrieve secrets such as   #
+# credentials or certificates.                                                  #
+#                                                                               #
+# This bootstrap script provides the capability to do so.                       #
+#                                                                               #
+# When an instance is created through Terraform or Rundeck, this script is      #
+# provided to bootstrap the box. When the script is generated a wrapper token   #
+# is also generated - present in ENV['GCP_VAULT_TOKEN'] - which is used by      #
+# the instance to obtain the real token it needs from Vault.                    #
+#                                                                               #
+# Once the real token has been obtained, it is periodicially renewed by the     #
+# as-vault-token tool.                                                          #
+#                                                                               #
+# The periodic running of this task is managed by the as-vault-token cookbook.  #
+#                                                                               #
+#################################################################################
+
+#################################################################################
+# Miscellaneous Linux configuration.                                            #
+#################################################################################
+
 yum install -y unzip wget
+
+#################################################################################
+# Create the tokens.json file so that Chef and other applications can access    #
+# the Vault server.                                                             #
+#################################################################################.
+
 if [ ! -d /etc/vault ]; then mkdir /etc/vault; fi
 
 cat << EOF > /etc/vault/tokens.json
@@ -12,9 +43,25 @@ cat << EOF > /etc/vault/tokens.json
 }
 EOF
 
+groupadd -fg 9897 vault-tokens
+usermod -aG vault-tokens root
+
+chmod 0640 /etc/vault/tokens.json
+chown root:vault-tokens /etc/vault/tokens.json
+
+#################################################################################
+# Install Advertising Studio's as-vault-tool binary.                            #
+#################################################################################
+
 if [ ! -d /opt/as-vault-tool/<%= ENV['AS_VAULT_TOOL_VERSION'] %> ]; then
     mkdir -p /opt/as-vault-tool/<%= ENV['AS_VAULT_TOOL_VERSION'] %>
 fi
 wget https://storage.googleapis.com/ads-devops-chef/as-vault-tool/<%= ENV['AS_VAULT_TOOL_VERSION'] %>/linux_amd64.zip
 unzip linux_amd64 -d /opt/as-vault-tool/<%= ENV['AS_VAULT_TOOL_VERSION'] %>/
+
+#################################################################################
+# Get the real token from the wrapped token and store it in the                 #
+# tokens.json file.                                                             #
+#################################################################################
+
 /opt/as-vault-tool/<%= ENV['AS_VAULT_TOOL_VERSION'] %>/as-vault-tool tokenrenew

data/lib/sambot/templates/bootstrap_scripts/local/docker/bootstrap.ps1.erb

@@ -0,0 +1,94 @@
+#################################################################################
+# PROVISIONING A WINDOWS BOX                                                    #
+#################################################################################
+#                                                                               #
+# All our instances need to access Vault in order to retrieve secrets such as   #
+# credentials or certificates.                                                  #
+#                                                                               #
+# This bootstrap script provides the capability to do so.                       #
+#                                                                               #
+# When an instance is created through Terraform or Rundeck, this script is      #
+# provided to bootstrap the box. When the script is generated a wrapper token   #
+# is also generated  which is used by the instance to obtain the real token     #
+# it needs from Vault.                                                          #
+#                                                                               #
+# Once the real token has been obtained, it is periodicially renewed by the     #
+# as-vault-token tool.                                                          #
+#                                                                               #
+# The periodic running of this task is managed by the as-vault-token cookbook.  #
+#                                                                               #
+# When testing a cookbook using the 'sidecar' method this periodic renewal      #
+# along with the added security provided by the wrapper token is not required   #
+# given the Vault instance is located on the test instance.                     #
+#                                                                               #
+# The token used by the test instance is therefore simply the root token and    #
+# no unwrapping takes place.                                                    #
+#                                                                               #
+#################################################################################
+
+#################################################################################
+# Miscellaneous Windows configuration.                                          #
+#################################################################################
+
+$env:VAULT_ADDR="http://127.0.0.1:8200"
+$env:VAULT_TOKEN="root"
+
+Add-Type -AssemblyName "System.IO.Compression.FileSystem"
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+#################################################################################
+# Install Hashicorp Vault                                                       #
+#################################################################################
+
+New-Item 'C:\Program Files\vault' -ItemType Directory -Force
+$wc = New-Object System.Net.WebClient
+$url = "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_windows_amd64.zip"
+$output = "C:\Program Files\vault"
+$zipfile = "$output\$($url.Split('/')[-1])"
+$wc.DownloadFile($url, "$zipfile")
+[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
+
+#################################################################################
+# Install Advertising Studio's as-vault-tool binary.                            #
+#################################################################################
+
+$url = "https://storage.googleapis.com/ads-devops-chef/as-vault-tool/1.0.2/windows_amd64.zip"
+$zipfile = "$output\$($url.Split('/')[-1])"
+$wc.DownloadFile($url, $zipfile)
+[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
+
+#################################################################################
+#################################################################################
+# Everything above this marker in pre-installed on the                          #
+# adstudio/windows-provisioned/v* boxes.                                         #
+#################################################################################
+#################################################################################
+
+#################################################################################
+# Create the tokens.json file containing the Vault access token.                #
+#################################################################################
+
+$json = @"
+{
+    "vault-addr": "$env:VAULT_ADDR",
+    "skip-verify": true,
+    "wrapped": "",
+    "access": "$env:VAULT_TOKEN"
+}
+"@
+
+New-Item 'C:\ProgramData\vault' -ItemType Directory -Force
+Set-Content -Path 'C:\ProgramData\vault\tokens.json' -Value $json
+
+#################################################################################
+# Create the 'vault-tokens' group so other services/applications apart from     #
+# 'root' can access the file.                                                   #
+#################################################################################
+
+XXXXX
+
+#################################################################################
+# Populate Vault with test secrets using the Chef embedded Ruby.                #
+#################################################################################
+
+XXXXX

data/lib/sambot/templates/bootstrap_scripts/local/docker/bootstrap.sh.erb

@@ -0,0 +1,80 @@
+#!/bin/bash -e
+
+#################################################################################
+# PROVISIONING A LINUX BOX                                                      #
+#################################################################################
+#                                                                               #
+# All our instances need to access Vault in order to retrieve secrets such as   #
+# credentials or certificates.                                                  #
+#                                                                               #
+# This bootstrap script provides the capability to do so.                       #
+#                                                                               #
+# When an instance is created through Terraform or Rundeck, this script is      #
+# provided to bootstrap the box. When the script is generated a wrapper token   #
+# is also generated  which is used by the instance to obtain the real token     #
+# it needs from Vault.                                                          #
+#                                                                               #
+# Once the real token has been obtained, it is periodicially renewed by the     #
+# as-vault-token tool.                                                          #
+#                                                                               #
+# The periodic running of this task is managed by the as-vault-token cookbook.  #
+#                                                                               #
+# When testing a cookbook using the 'sidecar' method this periodic renewal      #
+# along with the added security provided by the wrapper token is not required   #
+# given the Vault instance is located on the test instance.                     #
+#                                                                               #
+# The token used by the test instance is therefore simply the root token and    #
+# no unwrapping takes place.                                                    #
+#                                                                               #
+#################################################################################
+
+#################################################################################
+# Download and install Hashicorp Vault.                                         #
+#################################################################################
+
+wget "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_linux_amd64.zip"
+unzip vault_0.6.5_linux_amd64.zip -d /usr/bin
+sudo mkdir /etc/vault
+
+#################################################################################
+# Install Advertising Studio's as-vault-tool binary.                            #
+#################################################################################
+
+echo "Download and install as-vault-tool"
+if [ ! -d "/opt/as-vault-tool/1.0.2" ]; then sudo mkdir -p /opt/as-vault-tool/1.0.2; fi
+if [ ! -f /opt/as-vault-tool/1.0.2/as-vault-tool ]; then
+  curl --fail -sSO https://storage.googleapis.com/ads-devops-chef/as-vault-tool/1.0.2/linux_amd64.zip > /dev/null 2>&1
+  sudo unzip linux_amd64 -d /opt/as-vault-tool/1.0.2/
+fi
+
+#################################################################################
+# Use the Vault server on the host machine running under Docker.                #
+#################################################################################
+
+export VAULT_ADDR=http://10.0.2.2:8200
+export VAULT_TOKEN=root
+
+#################################################################################
+# Create the tokens.json file so that Chef and other applications can access    #
+# the Vault server.                                                             #
+#################################################################################
+
+echo "Create the addressing file so that Chef and other applications can access the Vault server"
+cat << EOF > /etc/vault/tokens.json
+{
+    "vault-addr": "${VAULT_ADDR}",
+    "skip-verify": true,
+    "wrapped": "",
+    "access": "root"
+}
+EOF
+
+#################################################################################
+# Create the 'vault-tokens' group so other services/applications apart from     #
+# 'root' can access the file.                                                   #
+#################################################################################
+
+groupadd -fg 9897 vault-tokens
+usermod -aG vault-tokens root
+chmod 0640 /etc/vault/tokens.json
+chown root:vault-tokens /etc/vault/tokens.json

data/lib/sambot/templates/bootstrap_scripts/local/vagrant/bootstrap.ps1.erb

@@ -0,0 +1,99 @@
+#################################################################################
+# PROVISIONING A WINDOWS BOX                                                    #
+#################################################################################
+#                                                                               #
+# All our instances need to access Vault in order to retrieve secrets such as   #
+# credentials or certificates.                                                  #
+#                                                                               #
+# This bootstrap script provides the capability to do so.                       #
+#                                                                               #
+# When an instance is created through Terraform or Rundeck, this script is      #
+# provided to bootstrap the box. When the script is generated a wrapper token   #
+# is also generated  which is used by the instance to obtain the real token     #
+# it needs from Vault.                                                          #
+#                                                                               #
+# Once the real token has been obtained, it is periodicially renewed by the     #
+# as-vault-token tool.                                                          #
+#                                                                               #
+# The periodic running of this task is managed by the as-vault-token cookbook.  #
+#                                                                               #
+# Given this script is for local Test-Kitchen use only, the wrapped token is    #
+# generated on the test instance and then unwrapped immediately. No renewal     #
+# takes place when testing - except when testing the as-vault-token             #
+# cookbook of course!
+#                                                                               #
+#################################################################################
+
+#################################################################################
+# Miscellaneous Windows configuration.                                          #
+#################################################################################
+
+$env:VAULT_ADDR="http://192.168.255.5:8200"
+$env:VAULT_TOKEN="root"
+
+Add-Type -AssemblyName "System.IO.Compression.FileSystem"
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+#################################################################################
+# Install Hashicorp Vault.                                                      #
+#################################################################################
+
+New-Item 'C:\Program Files\vault' -ItemType Directory -Force
+$wc = New-Object System.Net.WebClient
+$url = "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_windows_amd64.zip"
+$output = "C:\Program Files\vault"
+$zipfile = "$output\$($url.Split('/')[-1])"
+$wc.DownloadFile($url, "$zipfile")
+[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
+
+#################################################################################
+# Install Advertising Studio's as-vault-tool binary.                            #
+#################################################################################
+
+$url = "https://storage.googleapis.com/ads-devops-chef/as-vault-tool/1.0.2/windows_amd64.zip"
+$zipfile = "$output\$($url.Split('/')[-1])"
+$wc.DownloadFile($url, $zipfile)
+[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
+
+#################################################################################
+# Generate the wrapped token which is normally provided by the bootstrapping    #
+# system.                                                                       #
+#################################################################################
+
+$token = ($(& "$output\vault" token-create -policy=nightswatch-ro -role=nightswatch-ro -wrap-ttl=72h) -match '^wrapping_token:').Split(' ')[-1].Trim()
+
+#################################################################################
+# Create the tokens.json file containing the Vault access token.                #
+#################################################################################
+
+$json = @"
+{
+    "vault-addr": "$env:VAULT_ADDR",
+    "skip-verify": true,
+    "wrapped": "$token",
+    "access": ""
+}
+"@
+
+New-Item 'C:\ProgramData\vault' -ItemType Directory -Force
+Set-Content -Path 'C:\ProgramData\vault\tokens.json' -Value $json
+
+#################################################################################
+# Create the 'vault-tokens' group so other services/applications apart from     #
+# 'root' can access the file.                                                   #
+#################################################################################
+
+###### TODO - NEED TO ADD GROUPS STUFF!!!!!
+
+#################################################################################
+# Get the real token from the wrapped token and store it in the                 #
+# tokens.json file.                                                             #
+#################################################################################
+
+& "$output\as-vault-tool" tokenrenew
+
+#################################################################################
+# Populate Vault with test secrets using the Chef embedded Ruby.                #
+#################################################################################
+
+XXXXX

data/lib/sambot/templates/bootstrap_scripts/local/vagrant/bootstrap.sh.erb

@@ -0,0 +1,90 @@
+#!/bin/bash -e
+
+#################################################################################
+# PROVISIONING A LINUX BOX                                                      #
+#################################################################################
+#                                                                               #
+# All our instances need to access Vault in order to retrieve secrets such as   #
+# credentials or certificates.                                                  #
+#                                                                               #
+# This bootstrap script provides the capability to do so.                       #
+#                                                                               #
+# When an instance is created through Terraform or Rundeck, this script is      #
+# provided to bootstrap the box. When the script is generated a wrapper token   #
+# is also generated  which is used by the instance to obtain the real token     #
+# it needs from Vault.                                                          #
+#                                                                               #
+# Once the real token has been obtained, it is periodicially renewed by the     #
+# as-vault-token tool.                                                          #
+#                                                                               #
+# The periodic running of this task is managed by the as-vault-token cookbook.  #
+#                                                                               #
+# Given this script is for local Test-Kitchen use only, the wrapped token is    #
+# generated on the test instance and then unwrapped immediately. No renewal     #
+# takes place when testing - except when testing the as-vault-token             #
+# cookbook of course!
+#                                                                               #
+#################################################################################
+
+#################################################################################
+# Miscellaneous Windows configuration.                                          #
+#################################################################################
+
+export VAULT_ADDR=http://192.168.255.5:8200
+export VAULT_TOKEN=root
+
+sudo yum install -y unzip
+
+#################################################################################
+# Download and install Hashicorp Vault.                                         #
+#################################################################################
+
+wget "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_linux_amd64.zip"
+unzip vault_0.6.5_linux_amd64.zip -d /usr/bin
+sudo mkdir /etc/vault
+
+#################################################################################
+# Generate the wrapped token which is normally provided by the bootstrapping    #
+# system.                                                                       #
+#################################################################################
+
+token=$(vault token-create -policy=nightswatch-ro -role=nightswatch-ro -wrap-ttl=72h | awk '/^wrapping_token:/ {print $2}')
+
+#################################################################################
+# Create the tokens.json file so that Chef and other applications can access    #
+# the Vault server.                                                             #
+#################################################################################
+
+cat << EOF > /etc/vault/tokens.json
+{
+    "vault-addr": "${VAULT_ADDR}",
+    "skip-verify": true,
+    "wrapped": "${token}",
+    "access": ""
+}
+EOF
+
+#################################################################################
+# Create the 'vault-tokens' group so other services/applications apart from     #
+# 'root' can access the file.                                                   #
+#################################################################################
+
+groupadd -fg 9897 vault-tokens
+usermod -aG vault-tokens root
+chmod 0640 /etc/vault/tokens.json
+chown root:vault-tokens /etc/vault/tokens.json
+
+#################################################################################
+# Install Advertising Studio's as-vault-tool binary.                            #
+#################################################################################
+
+sudo mkdir -p /opt/as-vault-tool/1.0.2
+wget https://storage.googleapis.com/ads-devops-chef/as-vault-tool/1.0.2/linux_amd64.zip
+sudo unzip linux_amd64 -d /opt/as-vault-tool/1.0.2/
+
+#################################################################################
+# Get the real token from the wrapped token and store it in the                 #
+# tokens.json file.                                                             #
+#################################################################################
+
+sudo /opt/as-vault-tool/1.0.2/as-vault-tool tokenrenew

data/lib/sambot/templates/docker-compose.yml

@@ -0,0 +1,10 @@
+version: '2'
+services:
+  vault:
+    image: vault
+    container_name: vault
+    ports:
+      - "8200:8200"
+    cap_add:
+      - IPC_LOCK
+    entrypoint: vault server -dev -log-level=debug -dev-listen-address=0.0.0.0:8200 -dev-root-token-id=root

data/lib/sambot/templates/test_kitchen/local.yml.erb

@@ -17,9 +17,6 @@ platforms:
 <!--% if @platforms.include?('centos') %-->
   - name: centos-7.2
     driver:
-      <!--% if @vault_setup == 'sidecar' %-->
-      box: adstudio/centos-provisioned-v5
-      <!--% end %-->
       network:
       - ["private_network", {ip: "192.168.255.10"}]
 <!--% end %-->

data/lib/sambot/testing/consul_helper.rb

@@ -5,7 +5,7 @@ module Sambot
 
       class << self
 
-        def load_values(filename)
+        def load_values(config)
         end
 
       end

data/lib/sambot/testing/fixtures.rb

@@ -0,0 +1,17 @@
+
+module Sambot
+  module Testing
+    class Fixtures
+
+      class << self
+
+        def get_path(spec, fixture_file)
+          parts = spec.split('spec')
+          File.join(parts[0], 'spec/fixtures', parts[1] + 'spec', fixture_file)
+        end
+
+      end
+
+    end
+  end
+end

data/lib/sambot/testing/vault_helper.rb

@@ -1,5 +1,6 @@
 require 'yaml'
 require 'vault'
+require 'fileutils'
 
 module Sambot
   module Testing
@@ -7,30 +8,35 @@ module Sambot
 
       class << self
 
-        def load_secrets(filename = '.vault.yml', src = 'vault')
-          if File.exist?(filename)
-            read_secrets(filename, src)
-          else
-            UI.info("No secrets configuration file is available so Vault was not populated with any secrets")
-            return 0
+        VAULT_CONFIG_BINARY = 'vault-config'
+        WORKING_DIR = '/tmp/sambot/testing/vault'
+        VAULT_POLICIES_REPO = 'git@github.exacttarget.com:ads-devops/vault-policies.git'
+
+        def setup
+          FileUtils.rm_r(WORKING_DIR) if Dir.exist?(WORKING_DIR)
+          FileUtils.mkpath WORKING_DIR
+          Dir.chdir WORKING_DIR do
+            `git clone --depth=1 --single-branch -q #{VAULT_POLICIES_REPO}`
+            Dir.chdir 'vault-policies/dev/vault-config' do
+              FS.copy(VAULT_CONFIG_BINARY)
+              `./#{VAULT_CONFIG_BINARY} config`
+            end
           end
         end
 
-        private
-
-        def read_secrets(filename, src)
-          UI.info("Reading the secrets configuration file")
-          contents = File.read(filename)
-          if contents.empty?
+        def load_secrets(config, src = 'local_testing')
+          UI.info("Reading secrets from the configuration file")
+          if config.secrets.empty?
             UI.info("No secrets were found in the secrets configuration file")
             return 0
           else
-            store_secrets(contents, src)
+            store_secrets(config.secrets, src)
           end
         end
 
-        def store_secrets(contents, src)
-          secrets = YAML.load(contents)
+        private
+
+        def store_secrets(secrets, src)
           counter = 0
           secrets.each do |secret|
             secret['keys'].each do |item|

data/lib/sambot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sambot
-  VERSION = '0.1.178'.freeze
+  VERSION = '0.1.179'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sambot
 version: !ruby/object:Gem::Version
-  version: 0.1.178
+  version: 0.1.179
 platform: ruby
 authors:
 - Olivier Kouame
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-20 00:00:00.000000000 Z
+date: 2017-07-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor-hollaback
@@ -405,20 +405,20 @@ files:
 - lib/sambot/runtime.rb
 - lib/sambot/template.rb
 - lib/sambot/templates/.config.yml.erb
-- lib/sambot/templates/.consul.yml
+- lib/sambot/templates/.env
 - lib/sambot/templates/.gitignore.sample
 - lib/sambot/templates/.rubocop.yml
-- lib/sambot/templates/.vault.yml
 - lib/sambot/templates/Berksfile
 - lib/sambot/templates/README.md
 - lib/sambot/templates/Vagrantfile.erb
 - lib/sambot/templates/bootstrap_scripts/google/bootstrap.ps1.erb
 - lib/sambot/templates/bootstrap_scripts/google/bootstrap.sh.erb
-- lib/sambot/templates/bootstrap_scripts/local/sidecar_vault/bootstrap.ps1.erb
-- lib/sambot/templates/bootstrap_scripts/local/sidecar_vault/bootstrap.sh.erb
-- lib/sambot/templates/bootstrap_scripts/local/standalone_vault/bootstrap.ps1.erb
-- lib/sambot/templates/bootstrap_scripts/local/standalone_vault/bootstrap.sh.erb
+- lib/sambot/templates/bootstrap_scripts/local/docker/bootstrap.ps1.erb
+- lib/sambot/templates/bootstrap_scripts/local/docker/bootstrap.sh.erb
+- lib/sambot/templates/bootstrap_scripts/local/vagrant/bootstrap.ps1.erb
+- lib/sambot/templates/bootstrap_scripts/local/vagrant/bootstrap.sh.erb
 - lib/sambot/templates/chefignore
+- lib/sambot/templates/docker-compose.yml
 - lib/sambot/templates/git_hooks/pre-commit
 - lib/sambot/templates/git_hooks/pre-push
 - lib/sambot/templates/metadata.rb.erb
@@ -427,9 +427,11 @@ files:
 - lib/sambot/templates/test_kitchen/google.yml.erb
 - lib/sambot/templates/test_kitchen/local.yml.erb
 - lib/sambot/templates/test_kitchen/rackspace.yml.erb
+- lib/sambot/templates/vault-config
 - lib/sambot/templates/vault_helper.rb
 - lib/sambot/templates/winrm_config
 - lib/sambot/testing/consul_helper.rb
+- lib/sambot/testing/fixtures.rb
 - lib/sambot/testing/vault_helper.rb
 - lib/sambot/ui.rb
 - lib/sambot/version.rb

data/lib/sambot/templates/bootstrap_scripts/local/sidecar_vault/bootstrap.ps1.erb

@@ -1,33 +0,0 @@
-$env:VAULT_ADDR="http://127.0.0.1:8200"
-$env:VAULT_TOKEN="root"
-
-Add-Type -AssemblyName "System.IO.Compression.FileSystem"
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-
-New-Item 'C:\Program Files\vault' -ItemType Directory -Force
-$wc = New-Object System.Net.WebClient
-$url = "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_windows_amd64.zip"
-$output = "C:\Program Files\vault"
-$zipfile = "$output\$($url.Split('/')[-1])"
-$wc.DownloadFile($url, "$zipfile")
-[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
-
-$url = "https://storage.googleapis.com/ads-devops-chef/as-vault-tool/1.0.2/windows_amd64.zip"
-$zipfile = "$output\$($url.Split('/')[-1])"
-$wc.DownloadFile($url, $zipfile)
-[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
-
-$token = ($(& "$output\vault" token-create -policy=nightswatch-ro -role=nightswatch-ro -wrap-ttl=72h) -match '^wrapping_token:').Split(' ')[-1].Trim()
-$json = @"
-{
-    "vault-addr": "$env:VAULT_ADDR",
-    "skip-verify": true,
-    "wrapped": "$token",
-    "access": ""
-}
-"@
-
-New-Item 'C:\ProgramData\vault' -ItemType Directory -Force
-Set-Content -Path 'C:\ProgramData\vault\tokens.json' -Value $json
-
-& "$output\as-vault-tool" tokenrenew

data/lib/sambot/templates/bootstrap_scripts/local/sidecar_vault/bootstrap.sh.erb

@@ -1,45 +0,0 @@
-#!/bin/bash -e
-
-echo "Install required tools"
-sudo yum install -y unzip wget epel-release zlib-devel bzip2 openssl-devel libyaml-devel libffi-devel readline-devel gdbm-devel ncurses-devel gcc gcc-c++ make
-
-echo "Download and install Hashicorp Vault"
-if [ ! -f /usr/bin/vault ]; then
-  curl --fail -sSO "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_linux_amd64.zip" > /dev/null 2>&1
-  unzip vault_0.6.5_linux_amd64.zip -d /usr/bin;
-fi
-if [ ! -d "/etc/vault" ]; then sudo mkdir /etc/vault; fi
-
-echo "Download and install Hashicorp Consul"
-if [ ! -f /usr/bin/consul ]; then
-  curl --fail -sSO "https://releases.hashicorp.com/consul/0.8.5/consul_0.8.5_linux_amd64.zip" > /dev/null 2>&1
-  unzip consul_0.8.5_linux_amd64.zip -d /usr/bin;
-fi
-if [ ! -d "/etc/consul" ]; then sudo mkdir /etc/consul; fi
-
-########## Everything above this line is pre-installed on the 'adstudio-centos-provisioned-v*' box ############
-
-echo "Launch the Consul Agent in Development mode"
-consul agent -dev -server -bootstrap < /dev/null &> /dev/null &
-
-echo "Launch the Vault Server in Development mode"
-export VAULT_ADDR="http://127.0.0.1:8200"
-export VAULT_TOKEN="root"
-vault server -dev -dev-root-token-id=${VAULT_TOKEN} -dev-listen-address=0.0.0.0:8200 < /dev/null &> /dev/null &
-sleep 5
-vault mount -path=dev generic
-
-echo "Create the addressing file so that Chef and other applications can access the Vault server"
-cat << EOF > /etc/vault/tokens.json
-{
-    "vault-addr": "${VAULT_ADDR}",
-    "skip-verify": true,
-    "wrapped": "",
-    "access": "root"
-}
-EOF
-
-echo "Populate Vault with test secrets using the Chef embedded Ruby"
-/opt/chef/embedded/bin/gem install sambot --no-ri --no-doc
-cd /vagrant
-/opt/chef/embedded/bin/sambot populate --vault

data/lib/sambot/templates/bootstrap_scripts/local/standalone_vault/bootstrap.ps1.erb

@@ -1,33 +0,0 @@
-$env:VAULT_ADDR="http://192.168.255.5:8200"
-$env:VAULT_TOKEN="root"
-
-Add-Type -AssemblyName "System.IO.Compression.FileSystem"
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-
-New-Item 'C:\Program Files\vault' -ItemType Directory -Force
-$wc = New-Object System.Net.WebClient
-$url = "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_windows_amd64.zip"
-$output = "C:\Program Files\vault"
-$zipfile = "$output\$($url.Split('/')[-1])"
-$wc.DownloadFile($url, "$zipfile")
-[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
-
-$url = "https://storage.googleapis.com/ads-devops-chef/as-vault-tool/1.0.2/windows_amd64.zip"
-$zipfile = "$output\$($url.Split('/')[-1])"
-$wc.DownloadFile($url, $zipfile)
-[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $output)
-
-$token = ($(& "$output\vault" token-create -policy=nightswatch-ro -role=nightswatch-ro -wrap-ttl=72h) -match '^wrapping_token:').Split(' ')[-1].Trim()
-$json = @"
-{
-    "vault-addr": "$env:VAULT_ADDR",
-    "skip-verify": true,
-    "wrapped": "$token",
-    "access": ""
-}
-"@
-
-New-Item 'C:\ProgramData\vault' -ItemType Directory -Force
-Set-Content -Path 'C:\ProgramData\vault\tokens.json' -Value $json
-
-& "$output\as-vault-tool" tokenrenew

data/lib/sambot/templates/bootstrap_scripts/local/standalone_vault/bootstrap.sh.erb

@@ -1,24 +0,0 @@
-#!/bin/bash -e
-
-export VAULT_ADDR=http://192.168.255.5:8200
-export VAULT_TOKEN=root
-
-sudo yum install -y unzip
-wget "https://releases.hashicorp.com/vault/0.6.5/vault_0.6.5_linux_amd64.zip"
-unzip vault_0.6.5_linux_amd64.zip -d /usr/bin
-sudo mkdir /etc/vault
-
-token=$(vault token-create -policy=nightswatch-ro -role=nightswatch-ro -wrap-ttl=72h | awk '/^wrapping_token:/ {print $2}')
-cat << EOF > /etc/vault/tokens.json
-{
-    "vault-addr": "${VAULT_ADDR}",
-    "skip-verify": true,
-    "wrapped": "${token}",
-    "access": ""
-}
-EOF
-
-sudo mkdir -p /opt/as-vault-tool/1.0.2
-wget https://storage.googleapis.com/ads-devops-chef/as-vault-tool/1.0.2/linux_amd64.zip
-sudo unzip linux_amd64 -d /opt/as-vault-tool/1.0.2/
-sudo /opt/as-vault-tool/1.0.2/as-vault-tool tokenrenew