Skip to content

Commit ab2154b

Browse files
sshi100sshi100
authored
add dev environment - initial commit (#164)
* add dev environment - initial commit * updated with AWS secretmanager, multiple users creation, sql statements enhancements and so on * enhancement on user_access, Makefile, template etc. * allow developer to list developer group * enhancement with jq instead of sed * few fixes * updated README * exit with 0 when no developers; chmod the script to executible * trigger a terraform validation check * keep use terraform version 0.13.5 to fix error with 0.14.x
1 parent 399362e commit ab2154b

13 files changed

Lines changed: 128 additions & 35 deletions

File tree

‎.github/workflows/terraform.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ jobs:
1313
steps:
1414
- uses: actions/checkout@v2
1515
- uses: hashicorp/setup-terraform@v1
16+
with:
17+
terraform_version: 0.13.5
1618

1719
- name: Install Zero
1820
id: install_zero

‎templates/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ teardown-secrets:
7575
@echo "Deleting secrets is not reversible, are you sure you want to delete the secrets? [y/N]:" ; read ans ; [ $${ans:-N} == "y" ] || exit 1
7676
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='project' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
7777
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='rds' && Value=='$(PROJECT)-$(ENVIRONMENT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
78+
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='rds' && Value=='$(PROJECT)-$(ENVIRONMENT)-devenv']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
7879
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='sendgrid' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
7980
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='cf_keypair' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
8081
aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='wg' && Value=='$(PROJECT)-$(ENVIRONMENT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"

‎templates/scripts/create-db-user.sh‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,34 +13,38 @@ usage () {
1313
# ENVIRONMENT - stage or prod
1414
# NAMESPACE - The target k8s namespace to create and create a secret in
1515
# DATABASE_TYPE - The type of database - mysql, postgres
16-
# DATABASE_NAME - The name of the database to create in the database server
16+
# DATABASE_NAME - The name of the database(s) to create in the database server
1717
# USER_NAME - The name of the user to create and grant access to the database specified above
18-
# CREATE_SECRET - A template file to render to create a secret
18+
# USER_PASSWORD - The password of the user to create and grant access to the database specified above (optional)
19+
# SECRET_NAME - The secret of the database user to get password
20+
# CREATE_SECRET - A template file to render to create a secret (optional)
21+
# CREATE_DB_POD - A template file to render to create a db pod for troubleshooting (optional)
1922
([[ -z "${REGION}" ]] || \
2023
[[ -z "${SEED}" ]] || \
2124
[[ -z "${PROJECT_NAME}" ]] || \
2225
[[ -z "${ENVIRONMENT}" ]] || \
2326
[[ -z "${NAMESPACE}" ]] || \
2427
[[ -z "${DATABASE_TYPE}" ]] || \
2528
[[ -z "${DATABASE_NAME}" ]] || \
26-
[[ -z "${USER_NAME}" ]] || \
27-
[[ -z "${CREATE_SECRET}" ]] ) && \
28-
echo "Some environment variables (REGION, SEED, PROJECT_NAME, ENVIRONMENT, NAMESPACE, DATABASE_TYPE, DATABASE_NAME, USER_NAME, CREATE_SECRET) are not set properly." && usage
29+
[[ -z "${SECRET_NAME}" ]] || \
30+
[[ -z "${USER_NAME}" ]] ) && \
31+
echo "Some environment variables (REGION, SEED, PROJECT_NAME, ENVIRONMENT, NAMESPACE, DATABASE_TYPE, DATABASE_NAME, USER_NAME) are not set properly." && usage
2932

3033
# docker image with postgres + mysql clients
3134
DOCKER_IMAGE_TAG=commitdev/zero-k8s-utilities:0.0.3
3235

3336
# database info preparation
3437
DB_ENDPOINT=database.${PROJECT_NAME}
35-
DB_NAME=$(echo "${DATABASE_NAME}" | tr -dc 'A-Za-z0-9')
38+
DB_NAME_LIST=$(echo ${DATABASE_NAME} | tr -dc 'A-Za-z0-9 ') # used by job
39+
DB_NAME=$(echo ${DB_NAME_LIST} | cut -d" " -f1) # used by db-pod
3640
DB_TYPE=${DATABASE_TYPE}
3741
## get rds master
3842
SECRET_ID=$(aws secretsmanager list-secrets --region ${REGION} --query "SecretList[?Name=='${PROJECT_NAME}-${ENVIRONMENT}-rds-${SEED}'].Name" | jq -r ".[0]")
3943
MASTER_RDS_USERNAME=master_user
4044
MASTER_RDS_PASSWORD=$(aws secretsmanager get-secret-value --region=${REGION} --secret-id=${SECRET_ID} | jq -r ".SecretString")
4145
## get application user/pass
4246
DB_APP_USERNAME=$(echo "${USER_NAME}" | tr -dc 'A-Za-z0-9')
43-
DB_APP_PASSWORD=$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | base64 | head -c 24)
47+
DB_APP_PASSWORD=${USER_PASSWORD:-$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | base64 | head -c 24)}
4448

4549
# get correct dsn string for db type
4650
if [[ "${DB_TYPE}" == "postgres" ]]; then
@@ -72,3 +76,4 @@ then
7276
else
7377
echo "Failed to create application database user, please see 'kubectl logs -n db-ops -l job-name=db-create-users-$NAMESPACE-${JOB_ID}'"
7478
fi
79+

‎templates/scripts/create-dev-env.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/sh
2+
3+
PROJECT=<% .Name %>
4+
AWS_DEFAULT_REGION=<% index .Params `region` %>
5+
RANDOM_SEED="<% index .Params `randomSeed` %>"
6+
ENVIRONMENT=stage # only apply to Staging environment
7+
8+
DEV_DB_LIST=$(aws iam get-group --group-name ${PROJECT}-developer-${ENVIRONMENT} | jq -r '"dev" + .Users[].UserName' | tr '\n' ' ')
9+
if [[ -z "${DEV_DB_LIST}" ]]; then
10+
echo "$0: No developers available yet, skip."
11+
exit 0
12+
fi
13+
14+
DEV_DB_SECRET_NAME=${PROJECT}-${ENVIRONMENT}-rds-${RANDOM_SEED}-devenv
15+
aws secretsmanager describe-secret --region ${AWS_DEFAULT_REGION} --secret-id ${DEV_DB_SECRET_NAME} > /dev/null 2>&1
16+
if [[ $? -eq 0 ]]; then
17+
DEV_DB_SECRET=$(aws secretsmanager get-secret-value --region=${AWS_DEFAULT_REGION} --secret-id ${DEV_DB_SECRET_NAME} | jq -r ".SecretString")
18+
REGION=${AWS_DEFAULT_REGION} \
19+
SEED=${RANDOM_SEED} \
20+
PROJECT_NAME=${PROJECT} \
21+
ENVIRONMENT=${ENVIRONMENT} \
22+
NAMESPACE=${PROJECT} \
23+
DATABASE_TYPE=<% index .Params `database` %> \
24+
DATABASE_NAME="${DEV_DB_LIST}" \
25+
SECRET_NAME=devenv${PROJECT} \
26+
USER_NAME=dev${PROJECT} \
27+
USER_PASSWORD=${DEV_DB_SECRET} \
28+
CREATE_SECRET=secret-application.yml.tpl \
29+
sh ./create-db-user.sh
30+
fi

‎templates/scripts/db-ops/job-create-db-mysql.yml.tpl‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,8 @@ type: Opaque
1313
stringData:
1414
RDS_MASTER_PASSWORD: $MASTER_RDS_PASSWORD
1515
create-user.sql: |
16-
CREATE DATABASE IF NOT EXISTS $DB_NAME;
17-
DROP USER IF EXISTS '$DB_APP_USERNAME';
18-
CREATE USER '$DB_APP_USERNAME' IDENTIFIED BY '$DB_APP_PASSWORD';
19-
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_APP_USERNAME';
16+
CREATE DATABASE IF NOT EXISTS {{ VAR_DB }};
17+
GRANT ALL PRIVILEGES ON {{ VAR_DB }}.* TO '$DB_APP_USERNAME' IDENTIFIED BY '$DB_APP_PASSWORD';
2018

2119
---
2220
apiVersion: v1
@@ -38,14 +36,15 @@ spec:
3836
image: $DOCKER_IMAGE_TAG
3937
command:
4038
- sh
41-
args:
42-
- '-c'
43-
- mysql -u$MASTER_RDS_USERNAME -h $DB_ENDPOINT mysql < /db-ops/create-user.sql
39+
- -c
40+
- |
41+
for db in $DB_NAME_LIST; do
42+
[[ echo \"show databases;\" | mysql -u$MASTER_RDS_USERNAME -h $DB_ENDPOINT | grep \$db ]] || \
43+
cat /db-ops/create-user.sql | \
44+
sed \"s/{{ VAR_DB }}/\$db/g\" | \
45+
mysql -u$MASTER_RDS_USERNAME -h $DB_ENDPOINT
46+
done
4447
env:
45-
- name: DB_ENDPOINT
46-
value: $DB_ENDPOINT
47-
- name: DB_NAME
48-
value: $DB_NAME
4948
- name: MYSQL_PWD
5049
valueFrom:
5150
secretKeyRef:
@@ -98,10 +97,10 @@ spec:
9897
- name: DB_USERNAME
9998
valueFrom:
10099
secretKeyRef:
101-
name: $PROJECT_NAME
100+
name: $SECRET_NAME
102101
key: DATABASE_USERNAME
103102
- name: DB_PASSWORD
104103
valueFrom:
105104
secretKeyRef:
106-
name: $PROJECT_NAME
105+
name: $SECRET_NAME
107106
key: DATABASE_PASSWORD

‎templates/scripts/db-ops/job-create-db-postgres.yml.tpl‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,10 @@ type: Opaque
1313
stringData:
1414
RDS_MASTER_PASSWORD: $MASTER_RDS_PASSWORD
1515
create-user.sql: |
16-
SELECT 'CREATE DATABASE $DB_NAME' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '$DB_NAME');\gexec
17-
SELECT 'REVOKE ALL PRIVILEGES ON DATABASE $DB_NAME FROM $DB_APP_USERNAME;' WHERE EXISTS (SELECT FROM pg_roles WHERE rolname = '$DB_APP_USERNAME');\gexec
18-
SELECT 'DROP USER $DB_APP_USERNAME;' WHERE EXISTS (SELECT FROM pg_user WHERE usename = '$DB_APP_USERNAME');\gexec
19-
CREATE USER $DB_APP_USERNAME WITH ENCRYPTED PASSWORD '$DB_APP_PASSWORD';
20-
GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_APP_USERNAME;
16+
SELECT 'CREATE DATABASE {{ VAR_DB }}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '{{ VAR_DB }}');\gexec
17+
SELECT 'CREATE USER $DB_APP_USERNAME' WHERE NOT EXISTS (SELECT FROM pg_user WHERE usename = '$DB_APP_USERNAME');\gexec
18+
ALTER USER $DB_APP_USERNAME WITH ENCRYPTED PASSWORD '$DB_APP_PASSWORD';
19+
GRANT ALL PRIVILEGES ON DATABASE {{ VAR_DB }} TO $DB_APP_USERNAME;
2120

2221
---
2322
apiVersion: v1
@@ -39,9 +38,14 @@ spec:
3938
image: $DOCKER_IMAGE_TAG
4039
command:
4140
- sh
42-
args:
43-
- '-c'
44-
- psql -U$MASTER_RDS_USERNAME -h $DB_ENDPOINT postgres -v ON_ERROR_STOP=1 -a -f/db-ops/create-user.sql > /dev/null
41+
- -c
42+
- |
43+
for db in $DB_NAME_LIST; do
44+
[[ echo '\l' | psql -U$MASTER_RDS_USERNAME -h $DB_ENDPOINT postgres | grep \$db ]] || \
45+
cat /db-ops/create-user.sql | \
46+
sed \"s/{{ VAR_DB }}/\$db/g\" | \
47+
psql -U$MASTER_RDS_USERNAME -h $DB_ENDPOINT postgres -v ON_ERROR_STOP=1 > /dev/null
48+
done
4549
env:
4650
- name: PGPASSWORD
4751
valueFrom:
@@ -95,10 +99,10 @@ spec:
9599
- name: DB_USERNAME
96100
valueFrom:
97101
secretKeyRef:
98-
name: $PROJECT_NAME
102+
name: $SECRET_NAME
99103
key: DATABASE_USERNAME
100104
- name: DB_PASSWORD
101105
valueFrom:
102106
secretKeyRef:
103-
name: $PROJECT_NAME
107+
name: $SECRET_NAME
104108
key: DATABASE_PASSWORD

‎templates/scripts/db-ops/secret-application.yml.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: v1
33
kind: Secret
44
metadata:
5-
name: $PROJECT_NAME
5+
name: $SECRET_NAME
66
namespace: $NAMESPACE
77
type: Opaque
88
stringData:

‎templates/scripts/db-ops/secret-user-auth.yml.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: v1
33
kind: Secret
44
metadata:
5-
name: $PROJECT_NAME
5+
name: $SECRET_NAME
66
namespace: $NAMESPACE
77
type: Opaque
88
stringData:

‎templates/scripts/post-apply.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,13 @@ if [[ $? -ne 0 ]]; then
1414
NAMESPACE=${PROJECT} \
1515
DATABASE_TYPE=<% index .Params `database` %> \
1616
DATABASE_NAME=${PROJECT} \
17+
SECRET_NAME=${PROJECT} \
1718
USER_NAME=${PROJECT} \
1819
CREATE_SECRET=secret-application.yml.tpl \
1920
sh ./create-db-user.sh
2021
fi
22+
23+
# Create dev environment on Staging for developers
24+
if [[ ${ENVIRONMENT} == "stage" ]]; then
25+
sh ./create-dev-env.sh
26+
fi

‎templates/scripts/pre-k8s.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ if [[ $? -ne 0 ]]; then
4040
NAMESPACE=user-auth \
4141
DATABASE_TYPE=<% index .Params `database` %> \
4242
DATABASE_NAME=user_auth \
43+
SECRET_NAME=${PROJECT} \
4344
USER_NAME=kratos \
4445
CREATE_SECRET=secret-user-auth.yml.tpl \
4546
<%- if ne (index .Params `sendgridApiKey`) "" %>

0 commit comments

Comments
 (0)