Commit e99a3565 authored by Xueshan Feng's avatar Xueshan Feng
Browse files

these are moved to vault-provision/common/scripts repo.

parent d08eadc9

provision-approles.sh

deleted100755 → 0
+0 −45
Original line number Diff line number Diff line 
#!/bin/bash



# Generates policies & token roles dynamically



THIS_DIR=$(dirname $0)

source $THIS_DIR/utils/provision-func.sh

TMPDIR=$(mktemp -d /tmp/vault-workspace.XXXX)



bash_defaults



data_dir=$1

GEN_POLICIES_DIR=${TMPDIR}/policy-generated

GEN_TOKEN_ROLES_DIR=${TMPDIR}/auth/token/roles-generated

GEN_APPROLES_DIR=${TMPDIR}/auth/approle/role-generated

mkdir -p $GEN_POLICIES_DIR $GEN_TOKEN_ROLES_DIR $GEN_APPROLES_DIR



# if VAULT_TOKEN is not set, use user token (we set since we use curl, not vault CLI)

if ! is_set VAULT_TOKEN; then

  if [ -f ~/.vault-token ]; then

    export VAULT_TOKEN=$(cat ~/.vault-token)

  else

    >&2 echo 'ERROR: either VAULT_TOKEN must be set or ~/.vault-token must exist'

    >&2 echo 'on your local machine you can do `vault login -method ldap`'

    false

  fi

fi



# Provision default and customized roles. We are not changing to $data_dir, so we need to give approle api path.

echo "provision auth/approle/role/*.json"

provision -p auth/approle/role $data_dir/auth/approle/role/*.json



# Provision templated roles for projects and groups. If a role doesn't exist, create it; otherwise, update.

# Policies are already defined and created with provision-policies.sh.

for secret_path in $(cat $data_dir/secret/projects $data_dir/secret/groups) ; do

      project_category=$( dirname ${secret_path} ) # e.g. groups, projects

      project=$( basename ${secret_path} ) # e.g. et, sws, tcg, anchorage



      # generate viewer role policy name

      project_viewer_policy=$(generate_project_policy_name $data_dir/sys/policy-templates/$project_category/${project_category}-viewer-policy-name.json $project)



      # - generate default approle for groups and projects - remove last chars of project_catergrory so that "groups" become "group", "projects" "project" for rolename.

      generate_approle $data_dir/auth/approle/role-templates/default-viewer.json ${project_category}/$project_viewer_policy > $GEN_APPROLES_DIR/${project_category%?}-${project_viewer_policy}.json

done



provision -p auth/approle/role ${TMPDIR}/auth/approle/role-generated/*.json

provision-ca-roles.sh

deleted100755 → 0
+0 −26
Original line number Diff line number Diff line 
#!/bin/bash



# Sets CA roles for certificate issuance



THIS_DIR=$(dirname $0)

source $THIS_DIR/utils/provision-func.sh



bash_defaults



data_dir=$1



# if VAULT_TOKEN is not set, use user token (we set since we use curl, not vault CLI)

if ! is_set VAULT_TOKEN; then

  if [ -f ~/.vault-token ]; then

    export VAULT_TOKEN=$(cat ~/.vault-token)

  else

    >&2 echo 'ERROR: either VAULT_TOKEN must be set or ~/.vault-token must exist'

    >&2 echo 'on your local machine you can do `vault login -method ldap`'

    false

  fi

fi



# Provision ca roles. We are not changing to $data_dir, so we need to give approle api path.

echo "provision pki/roles/*.json"



provision -p pki/roles $data_dir/pki/roles/*.json

provision-ldap.sh

deleted100755 → 0
+0 −43
Original line number Diff line number Diff line 
#!/bin/bash -e



# THIS SCRIPT requires the following paths to contain values:

# - secret/global/<aws-profile>/vault/<dev|prod|stage>/duo/{ikey,skey,host}



THIS_DIR=$(dirname $0)

source $THIS_DIR/utils/provision-func.sh



bash_defaults



data_dir=$1



# if VAULT_TOKEN is not set, use user token (we set since we use curl, not vault CLI)

if ! is_set VAULT_TOKEN; then

  if [ -f ~/.vault-token ]; then

    export VAULT_TOKEN=$(cat ~/.vault-token)

  else

    >&2 echo 'ERROR: either VAULT_TOKEN must be set or ~/.vault-token must exist'

    >&2 echo 'on your local machine you can do `vault auth -method ldap`'

    false

  fi

fi



pushd $data_dir > /dev/null



# DUO VARIABLES

# used when setting up mfa in userpass and ldap backends

ikey=$(vault kv get --address=${VAULT_ADDR} --format=json ${DUO_SEC_PATH}/ikey | jq -er .data.data.value)

skey=$(vault kv get --address=${VAULT_ADDR} --format=json ${DUO_SEC_PATH}/skey | jq -er .data.data.value)

host=$(vault kv get --address=${VAULT_ADDR} --format=json ${DUO_SEC_PATH}/host | jq -er .data.data.value)

# export variables so they can be used by envsubst

export ikey skey host



# LDAP

# set up ldap and ldap group->policy assignments

export ldap_group_filter=$(generate_ldap_group_filter auth/ldap/groups)

provision auth/ldap/*.json

provision auth/ldap/groups/*.json

provision auth/ldap/users/*.json

# turn on MFA for ldap

provision -c always_update auth/ldap/duo/*



popd > /dev/null

provision-policies.sh

deleted100755 → 0
+0 −76
Original line number Diff line number Diff line 
#!/bin/bash



# Generates policies & token roles dynamically



THIS_DIR=$(dirname $0)

source $THIS_DIR/utils/provision-func.sh

TMPDIR=$(mktemp -d /tmp/vault-workspace.XXXX)



bash_defaults



data_dir=$1

GEN_POLICIES_DIR=${TMPDIR}/policy-generated

GEN_TOKEN_ROLES_DIR=${TMPDIR}/auth/token/roles-generated

GEN_APPROLES_DIR=${TMPDIR}/auth/approle/role-generated

mkdir -p $GEN_POLICIES_DIR $GEN_TOKEN_ROLES_DIR $GEN_APPROLES_DIR



# if VAULT_TOKEN is not set, use user token (we set since we use curl, not vault CLI)

if ! is_set VAULT_TOKEN; then

  if [ -f ~/.vault-token ]; then

    export VAULT_TOKEN=$(cat ~/.vault-token)

  else

    >&2 echo 'ERROR: either VAULT_TOKEN must be set or ~/.vault-token must exist'

    >&2 echo 'on your local machine you can do `vault auth -method ldap`'

    false

  fi

fi



# Provision default policies

echo

echo "== Processing default policy"

provision -c always_update -C put_policy -u put_policy -p sys/policy $data_dir/sys/policy/*.{hcl,json}



# If a secret path doesn't exist in pathes file, create it; otherwise, update. We do not delete polices - manually clean up maybe necessary.

for secret_path in $(cat $data_dir/secret/projects $data_dir/secret/groups) ; do

      project_category=$( dirname ${secret_path} ) # e.g. groups, projects

      project=$( basename ${secret_path} ) # e.g. et, sws, tcg, anchorage



      # Namespace for policies

      mkdir -p ${GEN_POLICIES_DIR}/$project_category



      # generate viewer policy

      project_viewer_policy=$(generate_project_policy_name $data_dir/sys/policy-templates/$project_category/${project_category}-viewer-policy-name.json $project)

      project_viewer_filename=$(generate_project_policy_name $data_dir/sys/policy-templates/$project_category/${project_category}-viewer-policy-name.json $project).hcl

      # generate_project_policy $data_dir/sys/policy-templates/project-viewer.hcl $project_category $project > $GEN_POLICIES_DIR/$project_viewer_filename

      # echo "generate_project_policy $data_dir/sys/policy-templates/$project_category/${project_category}-viewer.hcl $project_category $project > $GEN_POLICIES_DIR/$project_category/$project_viewer_filename"

      generate_project_policy $data_dir/sys/policy-templates/$project_category/${project_category}-viewer.hcl $project_category $project > $GEN_POLICIES_DIR/$project_category/$project_viewer_filename

      

      # generate admin policy

      project_admin_filename=$(generate_project_policy_name $data_dir/sys/policy-templates/$project_category/${project_category}-admin-policy-name.json $project).hcl

      #echo "generate_project_policy $data_dir/sys/policy-templates/$project_category/${project_category}-admin.hcl $project_category $project > $GEN_POLICIES_DIR/${project_category}/${project_admin_filename}"

      generate_project_policy $data_dir/sys/policy-templates/$project_category/${project_category}-admin.hcl $project_category $project > $GEN_POLICIES_DIR/${project_category}/${project_admin_filename}



      # - generate token role

      # generate_token_role $data_dir/auth/token/roles-templates/orphan.json $project_viewer_policy $project_viewer_policy > $GEN_ROLES_DIR/${project_viewer_policy}.json



      # - generate approle

      #if [ "$project_category" = "projects" ]; then

      #  generate_approle $data_dir/auth/approle/role-templates/drone.json $project_viewer_policy > $GEN_APPROLES_DIR/drone-${project_viewer_policy}.json

      #fi





      # Write default PLACEHOLDER

      cat << EOF > /tmp/PLACEHOLDER

{

  "data": {

      "value": "This is secret/${project_category}/${project} endpoint",

      "format": "text"

  }

}

EOF

      echo

      echo "== Processing secret and policy for ${project_category}/${project}"

      vault kv put secret/${project_category}/${project}/PLACEHOLDER  @/tmp/PLACEHOLDER

      provision -c always_update -C put_policy -u put_policy -p sys/policy/${project_category} ${TMPDIR}/policy-generated/${project_category}/${project}-*.{hcl,json}

done

provision-userpass.sh

deleted100755 → 0
+0 −38
Original line number Diff line number Diff line 
#!/bin/bash



# THIS SCRIPT provision userpass authentication by generating random password and encrypt it with user's pubkey.

# Only used now for vault admin to "Break Glass" when ldap authenticatin does not work.

THIS_DIR=$(dirname $0)

source $THIS_DIR/utils/provision-func.sh



bash_defaults



data_dir=$1



# if VAULT_TOKEN is not set, use user token (we set since we use curl, not vault CLI)

if ! is_set VAULT_TOKEN; then

  if [ -f ~/.vault-token ]; then

    export VAULT_TOKEN=$(cat ~/.vault-token)

  else

    >&2 echo 'ERROR: either VAULT_TOKEN must be set or ~/.vault-token must exist'

    >&2 echo 'on your local machine you can do `vault auth -method ldap`'

    false

  fi

fi



pushd $data_dir > /dev/null

users_data_dir="auth/userpass/users"

# Set up userpass users

for user_dir in $users_data_dir/*; do

  user=$( basename $user_dir )

  if [[ -f $user_dir/$user.json ]] && [[ -f $user_dir/policies.json ]] && [[ -f $user_dir/_pgp_key.asc ]]; then

    echo 

    echo "== provision_user with $user_dir/$user.json"

    provision_user $user_dir/$user.json

  else

    echo "$user_dir/$user.json, or $user_dir/policies.json, or $user_dir/_pgp_key.asc."

    echo "Skipping $user provisioning."

  fi

done



popd > /dev/null
 
 No newline at end of file