TJM

## Providers
terraform {
  required_providers {
    shell = {
      source  = "scottwinkler/shell"
      version = "~> 1.7"
    }
  }
}

TJM

#!/bin/bash
set -e

############################################################################
# shell script for applying license bucket and licenses to an Artifactory  #
# deployment.                                                              #
#                                                                          #
# Author: Andrew Milam <andrew.milam@davita.com>                           #
#                                                                          #
# WARNING: This script is designed as a terraform shell_script resource!   #

TJM

# External Service Monitoring

# ESM Consul Policy
# - https://github.com/hashicorp/consul-esm#consul-acl-policies
# NOTE: This could be more restrictive - this one is wide open
resource "consul_acl_policy" "esm" {
  name  = "consul-esm"
  rules = <<-RULE
    agent_prefix "" {
      policy = "read"

TJM

// getInterfaceValue will return an interface{} with an appropriate type for the puppetType
//  NOTE: This is *very* basic and will revert to just returning the string value by default.
func getInterfaceValue(puppetType string, val string) (retVal interface{}) {
	var err error
	if val == "" {
		return nil // Don't set a parameter that is "" (empty)
	}
	// Handle Optional[WHATEVER]
	if strings.HasPrefix(puppetType, "Optional[") {
		puppetType = strings.TrimPrefix(puppetType, "Optional[")

TJM

• Download Enterprise Consul: https://releases.hashicorp.com/consul/ (we have tried 1.9.6 - 1.10.1) (make sure to get the +ent version) for your specific OS. We are testing on "darwin" (OSX) but the production environment will be linux.
• Unzip into a "consul" working directory locally
• Create a license.txt file with the consul enterprise license.
• Create an empty data directory
• Create a config.d directory with a single file (acl.hcl) with the following contents:

acl = {
  enabled = true

TJM

# Wrapper for patchy:patching Plan for running 'patching' one node at a time, rather than all at once
plan patchy::cluster_patching (
  TargetSpec $targets,
  Optional[Enum['always', 'never', 'patched', 'smart']] $reboot = 'patched',
  Optional[String] $yum_params = undef,
  Optional[String] $dpkg_params = undef,
  Optional[String] $zypper_params = undef,
  Optional[Integer] $patch_task_timeout = 3600,
  Optional[Integer] $health_check_runinterval = 1800,
  Optional[Integer] $reboot_wait_time = 600,

TJM

---

- name: yum_check
  command:
    cmd: /bin/yum check-upgrade
    warn: no
  register: yum_update
  ignore_errors: true
  failed_when: yum_update.rc == 1

TJM

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: artifactory-pg-backup
  namespace: artifactory
spec:
  schedule: "30 */4 * * *"
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  startingDeadlineSeconds: 100

TJM

Keybase proof

I hereby claim:

• I am tjm on github.
• I am tommythekid (https://keybase.io/tommythekid) on keybase.
• I have a public key ASDcDg1N76jG7QoRdmzFEPr1HUGKcX5tea4v5-o1R-r-VQo

To claim this, I am signing this object:

TJM

#!/bin/bash -eu
#
# This script is designed to be run as a cron job periodically to
# clean up the Orphaned Pods. Use at your own risk!
#

## Settings (can be passed as environment variables)
LOGFILE=${LOGFILE:-/var/log/messages} # what log file to process
KUBELET_PODS_DIR=${KUBELET_DIR:-/var/lib/kubelet/pods} # where to find pods to remove
DEBUG=${DEBUG:-0} # more debug output