hikerspath

Article: Basic Shared Key Encryption (For Terraform)

Probably one of the more difficult experiences I've encountered with terraform, has been that of secrets management, as sensitive data is a first-class citizen, actually performing said encryption is left to a third-party service, and most of the third-party services one would use don't allow for one particular type of handling. The shared credential has long been the bastard of passwords, because it is typically only used when performing integration work on a request basis. Well, turns out Terraform has you covered there also!

The Function

rsadecrypt is a terraform function that decrypts an RSA-encrypted ciphertext, returning the cleartext.

rsadecrypt(ciphertext, privatekey)

hikerspath

The gist of this is code snippets for drone build pipelines. Nothing uber-secret here and most (if not all) of these are publically available images. If you've never built anything with drone, check out drone.io now, if this is not your first rodeo, enjoy the code.

hikerspath

1. Create Automation Senario

This step will create the automation pipeline in order of operation.

1.1. Webhook Trigger (In Integromat)

In integromat, create a new senario and add a webhook trigger:

1. After creating a senario, click on the ? bubble to define the triggering action.
2. Add a 'Custom webhook' trigger as the first step in the automation pipeline. This will be an INSTANT trigger that will execute whenever integromat receives data.
3. Configure a new inbound webhook called Slack - Outgoing Webhook so you will know what will be sending data inbound.
4. Set 'Max number of results' to 3
5. Copy the actual hook address (EX: https://hook.integromat.com/____hash____) as you will need it in the next step.

hikerspath

# Get Actions Template (For API)
curl -sXGET -H "Authorization: GenieKey $API_OPSGENIE" https://api.opsgenie.com/v2/integrations/__INTEGRATION_ID_TO_COPY__/actions | jq -c '.data | del(._parent)' >integrationActions.json

# Loop ALL Teams
for team in alpha bravo charlie delta epsilon; do

  # Create API
  jsonCreate=$(curl -sXPOST -H "Authorization: GenieKey $API_OPSGENIE" -H 'Content-Type: application/json' https://api.opsgenie.com/v2/integrations \
       -d "{ 
             \"enabled\": true, 

hikerspath

on run {input, parameters}
  set dateString to do shell script "date +'%Y-%m-%d'"
  tell application "System Events"
    keystroke "{panel:title=Observed Behaviour}"
    key code 36
    keystroke "__observed_behaviour__"
    key code 36
    key code 36
    keystroke "{panel}"
    key code 36
    key code 36
	keystroke "{panel:title=Steps to Reproduce}"
    key code 36
    keystroke "- __steps__"
    key code 36
    key code 36
    keystroke "{panel}"
    key code 36
    key code 36
    keystroke "{panel:title=Expected Behaviour}"
    key code 36
    keystroke "__expected_behaviour__"
    key code 36
    key code 36
    keystroke "{panel}"
    key code 36
    key code 36
    keystroke "{panel:title=Reports}"
    key code 36
    keystroke "||Date||Team||Team Member||Details"
    key code 36
    keystroke "|" & dateString & "|__team__|__reporter_name__|__details__"
    key code 36
    key code 36
    keystroke "{panel}"
    key code 36
    key code 36
    keystroke "{panel:title=Notes}"
    key code 36
    keyst

hikerspath

//
// KMS: Password used for RDS Database Setup (ID: alias/infrastructure)
//      aws kms list-aliases
//      aws kms encrypt --key-id __KEY__ --plaintext '__PASSWORD__' --output text --query CiphertextBlob
//      aws kms decrypt --ciphertext-blob fileb:///path/to/file.blob --output text --query Plaintext | base64 -D
//
data "aws_kms_secrets" "service" {
  secret {
    name = "rds_password"
    payload = "___REDACTED_BASE64_BLOB___"

hikerspath

First lets undertand how the command is constructed

$ kubectl run -it --rm --restart=Never --image=mysql:5.6 mysql-client — \
  mysql -h mwmobile.db.main.staging.mobile.meltwater.io -P 3306 -u root -p$PASSWORD
$ kubectl run -it --rm --restart=Never --image=meltwaterfoundation/drone-git bash — \
  bash
#    ^     ^   ^^   ^           ^             ^                               ^
#    |     |   ||   |           |             |                            Pod Name
#    |     |   ||   |           |             +--------------------------- Image

hikerspath

# ------------------------------------------------------------
# Discover Zone Information for DNS Domain
# ------------------------------------------------------------
data "aws_route53_zone" "public" {
  name = "${var.app_dns_domain}"
}

# ------------------------------------------------------------
# ACM Certificate Creation
# ------------------------------------------------------------

hikerspath

1. Create Automation Senario

This step will create the automation pipeline in order of operation.

1.1. Webhook Trigger (In Integromat)

In integromat, create a new senario and add a webhook trigger:

1. After creating a senario, click on the ? bubble to define the triggering action.
2. Add a 'Custom webhook' trigger as the first step in the automation pipeline. This will be an INSTANT trigger that will execute whenever integromat receives data.
3. Configure a new inbound webhook called Slack - Outgoing Webhook so you will know what will be sending data inbound.
4. Set 'Max number of results' to 3
5. Copy the actual hook address (EX: https://hook.integromat.com/____hash____) as you will need it in the next step.

hikerspath

$ kubectl create configmap app-license --from-file=/tmp/license.jwt