gitrgoliveira

#! /usr/bin/env python3
# Retrieve workspace resource counts and output sorted list (most resources first)
# NB: skeleton code ... only checks for basic errors in responses
# Reads inputs from env vars or interactively

import argparse
from getpass import getpass
import os
import requests
import threading

gitrgoliveira

import os
from terrasnek.api import TFC as TFP
# do `pip install terrasnek` before running this script

TFE_TOKEN = os.getenv("TFE_TOKEN", None)
TFE_URL = os.getenv("TFE_URL", "https://app.terraform.io")  # ex: https://app.terraform.io

api = TFP(TFE_TOKEN, url=TFE_URL)

orgs = api.orgs.list()['data']

gitrgoliveira

nomad agent -dev -bind 0.0.0.0  -acl-enabled >nomad-server.log &
sleep 5

nomad acl bootstrap -json > bootstrap.json
export NOMAD_TOKEN=$(jq -r .SecretID bootstrap.json)

# creating a namespace and quota
nomad namespace apply -description "QA instances of webservers" web-qa
nomad quota init
nomad quota apply spec.hcl

gitrgoliveira

vault auth enable jwt
 
vault write auth/jwt/config \
     oidc_discovery_url="https://token.actions.githubusercontent.com" \
     bound_issuer="https://token.actions.githubusercontent.com" \
     default_role="demo"
 
# "user_claim": "workflow" defines the entity alias. 
vault write auth/jwt/role/demo -<<EOF
{

gitrgoliveira

jobs:
 build:
   permissions:
     contents: read
     id-token: write
   runs-on: self-hosted
   steps:
     - uses: actions/checkout@v2
     - name: Import Secrets
       uses: hashicorp/[email protected]

gitrgoliveira

name: ImageBuilder
# Run this workflow every time a new commit pushed to your repository
on: 
  push: 
  workflow_dispatch:

jobs:
  build:
    permissions:
      contents: read

gitrgoliveira

export VAULT_ADDR="https://xxxx:8200"
export VAULT_NAMESPACE="admin"

export VAULT_TOKEN=xxx

tee vault-action.hcl <<EOF
path "kv/data/ci" {
    capabilities = ["read"]
}

gitrgoliveira

#! /bin/bash
#
# `az login` must be run first
#

BOUNDARY_ADDR=https://boundary.ric-lnd.ric.aws.hashidemos.io:9200

if [ -f "boundary_auth_created.json" ]; then
  echo "removing previous OIDC"
  boundary auth-methods delete -id $(jq -r  .item.id boundary_auth_created.json)

gitrgoliveira

#! /bin/bash

# downloading MongoDB
mkdir -p mongodb
mkdir -p mongodb_data
curl -o mongodb/mongodb.tgz https://downloads.mongodb.com/osx/mongodb-macos-x86_64-enterprise-4.2.2.tgz
tar -zxvf mongodb/mongodb.tgz --strip-components=1 -C mongodb

# assuming Vault Enterprise is already installed
# setting it up

gitrgoliveira

#! /bin/bash
#
# based on https://medium.com/google-cloud/vault-auth-and-secrets-on-gcp-51bd7bbaceb
#


################################################################
# setup GCP
################################################################
PROJECT_ID=`gcloud config get-value core/project`