devops-rob

Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.azurerm_subscription.current: Refreshing state...
data.azurerm_role_definition.contributor: Refreshing state...
azurerm_resource_group.main: Refreshing state... [id=/subscriptions/00000000-0000-0000-0000-0000000000/resourceGroups/packer-resources]
azurerm_resource_group.demo-packer-rg: Refreshing state... [id=/subscriptions/00000000-0000-0000-0000-0000000000/resourceGroups/demo-packer-rg]
azurerm_virtual_network.main: Refreshing state... [id=/subscriptions/00000000-0000-0000-0000-0000000000/resourceGroups/packer-resources/providers/Microsoft.Network/virtualNetworks/packer-network]
azurerm_public_ip.packer: Refreshing state... [id=/subscriptions/00000000-0000-0000-0000-0000000000/resourceGroups/packer-resources/providers/Microsoft.Network/publicIPAddresses/packer]

devops-rob

{
    "variables": {
        "image_version": "1.0.0",
        "consul_version": "1.2.3",
        "cost_centre": "OII",
        "vm_size": "Standard_D2_v3"
    },
    "builders": [
        {
            "type": "azure-arm",

devops-rob

#!/bin/bash

export CONSUL_HTTP_ADDR=https://10.201.44.11:8501
export CONSUL_CACERT=/etc/consul.d/tls/consul-agent-ca.pem
export CONSUL_CLIENT_CERT=/etc/consul.d/tls/dc1-cli-consul-0.pem
export CONSUL_CLIENT_KEY=/etc/consul.d/tls/dc1-cli-consul-0-key.pem

AGENT_POLICY_NAME="agent-acl-policy"
CLIENT_POLICY_TOKEN="vault-acl-policy"

devops-rob

Keybase proof

I hereby claim:

• I am devops-rob on github.

• I am devopsrob (https://keybase.io/devopsrob) on keybase.

• I have a public key ASBbGv8RQlAmaJ8xIoDtjNtcxKgdCvQuozoR11XAU5jZ_Qo

devops-rob

#!/bin/bash

declare -a packages=("wget" "setroubleshoot-server" "selinux-policy-devel" "unzip" "openssl" "openssl-devel")

function packagereqchecker {
    for app in "${packages[@]}";
    do
        echo $app
        if yum list installed $app 2>&1 > /dev/null;
        then

devops-rob

#!/bin/bash

function packagereqchecker {
    declare -a packages=("wget" "setroubleshoot-server" "selinux-policy-devel" "unzip")

    for app in "${packages[@]}";
    do
        echo $app
        if yum list installed $app 2>&1 > /dev/null;
        then

devops-rob

---
# simple playbook to demonstrate ansible reading a KV secret from hashicorp vault
# the following environment variables need to be set for ansible to authenticate with Vault
# 
# export VAULT_ADDR=http://127.0.0.1:8200
# export VAULT_SKIP_VERIFY=true
# export VAULT_AUTHTYPE=token
#
# A secret will need to be put in the demo/test1 path under the KV secrets engine

devops-rob

#!/bin/bash

export SUBSCRIPTION_ID=

az role definition create --role-definition=<<EOF

{
  "Name": "vault-admin",
  "IsCustom": true,
  "Description": "role for vault to create service principals.",

devops-rob

#!/bin/sh
##
export AZURE_SUBSCRIPTION_ID=
export AZURE_TENANT_ID=
export AZURE_CLIENT_ID=
export AZURE_CLIENT_SECRET=
export ROLE_NAME=spike
##
vault secrets enable azure

devops-rob

listener "tcp" {
    address         = "0.0.0.0:8200"
    tls_disable     = 1 # TLS will need to be enabled for production
    tls_min_version = "tls12"
}
storage "consul" {
    address         = "consul:8500"
    path            = "vault"
    service         = "vault"
    scheme          = "http"