Ricardo Oliveira gitrgoliveira

## whatranwhen.py
#! /usr/bin/env python3
# Retrieve workspace resource counts and output sorted list (most resources first)
# NB: skeleton code ... only checks for basic errors in responses
# Reads inputs from env vars or interactively

import argparse
from getpass import getpass
import os
import requests
import threading

## tfe_counter.py
import os
from terrasnek.api import TFC as TFP
# do `pip install terrasnek` before running this script

TFE_TOKEN = os.getenv("TFE_TOKEN", None)
TFE_URL = os.getenv("TFE_URL", "https://app.terraform.io")  # ex: https://app.terraform.io

api = TFP(TFE_TOKEN, url=TFE_URL)

orgs = api.orgs.list()['data']

## nomad_sentinel_demo.sh
nomad agent -dev -bind 0.0.0.0  -acl-enabled >nomad-server.log &
sleep 5

nomad acl bootstrap -json > bootstrap.json
export NOMAD_TOKEN=$(jq -r .SecretID bootstrap.json)

# creating a namespace and quota
nomad namespace apply -description "QA instances of webservers" web-qa
nomad quota init
nomad quota apply spec.hcl

## vault_setup.sh
vault auth enable jwt

vault write auth/jwt/config \
     oidc_discovery_url="https://token.actions.githubusercontent.com" \
     bound_issuer="https://token.actions.githubusercontent.com" \
     default_role="demo"

# "user_claim": "workflow" defines the entity alias.
vault write auth/jwt/role/demo -<<EOF
{

## github_actions_snippet.yaml
jobs:
 build:
   permissions:
     contents: read
     id-token: write
   runs-on: self-hosted
   steps:
     - uses: actions/checkout@v2
     - name: Import Secrets
       uses: hashicorp/vault-action@v2.4.0

## vault_github_action.yml
name: ImageBuilder
# Run this workflow every time a new commit pushed to your repository
on:
  push:
  workflow_dispatch:

jobs:
  build:
    permissions:
      contents: read

## vault_gh_setup.sh
export VAULT_ADDR="https://xxxx:8200"
export VAULT_NAMESPACE="admin"

export VAULT_TOKEN=xxx

tee vault-action.hcl <<EOF
path "kv/data/ci" {
    capabilities = ["read"]
}

## boundary-AzureAD.sh
#! /bin/bash
#
# `az login` must be run first
#

BOUNDARY_ADDR=https://boundary.ric-lnd.ric.aws.hashidemos.io:9200

if [ -f "boundary_auth_created.json" ]; then
  echo "removing previous OIDC"
  boundary auth-methods delete -id $(jq -r  .item.id boundary_auth_created.json)

## demo-tde.sh
#! /bin/bash

# downloading MongoDB
mkdir -p mongodb
mkdir -p mongodb_data
curl -o mongodb/mongodb.tgz https://downloads.mongodb.com/osx/mongodb-macos-x86_64-enterprise-4.2.2.tgz
tar -zxvf mongodb/mongodb.tgz --strip-components=1 -C mongodb

# assuming Vault Enterprise is already installed
# setting it up

## gcp_demo.sh
#! /bin/bash
#
# based on https://medium.com/google-cloud/vault-auth-and-secrets-on-gcp-51bd7bbaceb
#


################################################################
# setup GCP
################################################################
PROJECT_ID=`gcloud config get-value core/project`
	#! /usr/bin/env python3
	# Retrieve workspace resource counts and output sorted list (most resources first)
	# NB: skeleton code ... only checks for basic errors in responses
	# Reads inputs from env vars or interactively

	import argparse
	from getpass import getpass
	import os
	import requests
	import threading
	import os
	from terrasnek.api import TFC as TFP
	# do `pip install terrasnek` before running this script

	TFE_TOKEN = os.getenv("TFE_TOKEN", None)
	TFE_URL = os.getenv("TFE_URL", "https://app.terraform.io") # ex: https://app.terraform.io

	api = TFP(TFE_TOKEN, url=TFE_URL)

	orgs = api.orgs.list()['data']
	nomad agent -dev -bind 0.0.0.0 -acl-enabled >nomad-server.log &
	sleep 5

	nomad acl bootstrap -json > bootstrap.json
	export NOMAD_TOKEN=$(jq -r .SecretID bootstrap.json)

	# creating a namespace and quota
	nomad namespace apply -description "QA instances of webservers" web-qa
	nomad quota init
	nomad quota apply spec.hcl
	vault auth enable jwt

	vault write auth/jwt/config \
	oidc_discovery_url="https://token.actions.githubusercontent.com" \
	bound_issuer="https://token.actions.githubusercontent.com" \
	default_role="demo"

	# "user_claim": "workflow" defines the entity alias.
	vault write auth/jwt/role/demo -<<EOF
	{
	jobs:
	build:
	permissions:
	contents: read
	id-token: write
	runs-on: self-hosted
	steps:
	- uses: actions/checkout@v2
	- name: Import Secrets
	uses: hashicorp/vault-action@v2.4.0
	name: ImageBuilder
	# Run this workflow every time a new commit pushed to your repository
	on:
	push:
	workflow_dispatch:

	jobs:
	build:
	permissions:
	contents: read
	export VAULT_ADDR="https://xxxx:8200"
	export VAULT_NAMESPACE="admin"

	export VAULT_TOKEN=xxx

	tee vault-action.hcl <<EOF
	path "kv/data/ci" {
	capabilities = ["read"]
	}
	#! /bin/bash
	#
	# `az login` must be run first
	#

	BOUNDARY_ADDR=https://boundary.ric-lnd.ric.aws.hashidemos.io:9200

	if [ -f "boundary_auth_created.json" ]; then
	echo "removing previous OIDC"
	boundary auth-methods delete -id $(jq -r .item.id boundary_auth_created.json)
	#! /bin/bash

	# downloading MongoDB
	mkdir -p mongodb
	mkdir -p mongodb_data
	curl -o mongodb/mongodb.tgz https://downloads.mongodb.com/osx/mongodb-macos-x86_64-enterprise-4.2.2.tgz
	tar -zxvf mongodb/mongodb.tgz --strip-components=1 -C mongodb

	# assuming Vault Enterprise is already installed
	# setting it up
	#! /bin/bash
	#
	# based on https://medium.com/google-cloud/vault-auth-and-secrets-on-gcp-51bd7bbaceb
	#


	################################################################
	# setup GCP
	################################################################
	PROJECT_ID=`gcloud config get-value core/project`