demo

#!/bin/sh

KINDCONFIG=kind.kubeconfig
CLUSTER_NAME=vault-demo
INGRESS_PORT_HTTP=81   # must not be used by somebody else
INGRESS_PORT_HTTPS=444 # must not be used by somebody else

_functions() {
  grep '\(^[A-Za-z].*()[ ]*{\|^###*$\)' $0|grep -v '^__'|sed -e 's/^/	/g' -e "s/^###*/\\\n/g" -e 's/()//g'|tr -d '{#'
}


_usage() {
  cat<<EOF
Usage: $0 COMMAND

available commands:
  $(echo "$(_functions)")
EOF
}

compl() {                        # print code for bash completion; execute with eval
  echo "$0"|grep "^\." > /dev/null && local exe=$0 || local exe=$(basename $0)
  local compl_func_name=_$(echo $(basename $0)|tr ' -' '_')
  local func_names=$(_functions|grep -v "compl "|sed 's/ *#.*$//g'|cut -f1 -d" "|tr -d '\n')

  echo "execute this function with 'eval \$(${exe} compl)'" >&2
  echo "$compl_func_name() { COMPREPLY=( \$(compgen -W \"${func_names}\" -- \${COMP_WORDS[COMP_CWORD]}) ); }; complete -F ${compl_func_name} ${exe}"
}

_wait() {
  if [ "$?" = "0" ]
  then
    read -p "💤  "
  fi
}

_download_github_release() {
  local repo; repo=$1
  local artifact_name; artifact_name=$(basename "${repo}")

  local latest_version; latest_version=$(basename "$(curl -fs -o/dev/null -w "%{redirect_url}" "https://github.com/${repo}/releases/latest")")
  local basename; basename=${artifact_name}-$(uname)-$(uname -m|sed 's/x86_64/amd64/')

  (set -x; curl -LO "https://github.com/${repo}/releases/download/${latest_version}/${basename}")
  curl -LO "https://github.com/${repo}/releases/download/${latest_version}/${basename}.sha256sum"
  sha256sum -c "${basename}".sha256sum

  mv "${basename}" "${artifact_name}"
  chmod +x ./"${artifact_name}"
}

_install_kind() {
  test -e ./kind && return
  _download_github_release kubernetes-sigs/kind
}

install_vault() {                # install local vault cli (mac os only) #
  which vault &>/dev/null || brew install vault
}


#####################

launch_kind_cluster() {          # launch kind cluster for experimentation
  set -e
  _install_kind
  KUBECONFIG=${KINDCONFIG} kubectl cluster-info &>/dev/null && return
  cat<<-EOF >kind.conf
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  kubeadmConfigPatches:
  - |
    apiVersion: kubeadm.k8s.io/v1beta2
    kind: InitConfiguration
    nodeRegistration:
      kubeletExtraArgs:
        node-labels: "ingress-ready=true"
        authorization-mode: "AlwaysAllow"
  extraPortMappings:
  - containerPort: 80
    hostPort: ${INGRESS_PORT_HTTP}
  - containerPort: 443
    hostPort: ${INGRESS_PORT_HTTPS}
	EOF

  ./kind create cluster  --name ${CLUSTER_NAME} --kubeconfig ${KINDCONFIG} --config kind.conf

  printf "waiting for node to become ready "
  (set +x
  for _ in $(seq 0 120)
  do
    sleep 1
    printf "."
    kubectl get nodes|grep " Ready " && break
  done
  )
}


delete_kind_cluster() {          # deletes the kind cluster
  ./kind delete cluster --name ${CLUSTER_NAME} --kubeconfig ${KINDCONFIG}
}

load_image() {                   # load docker image into cluster
  local image_name=$1
  : ${image_name:?}
  (set -x; ./kind load docker-image --name ${CLUSTER_NAME} --nodes ${CLUSTER_NAME}-control-plane "${image_name}")
}

pause_kind_cluster() {           # pauses the kind cluster
  docker pause ${CLUSTER_NAME}-control-plane
}

unpause_kind_cluster() {         # pauses the kind cluster
  docker unpause ${CLUSTER_NAME}-control-plane
}

install_ingress_controller() {   # installs and sets up ingress controller
  kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
  kubectl patch deployments -n ingress-nginx nginx-ingress-controller -p '{"spec":{"template":{"spec":{"containers":[{"name":"nginx-ingress-controller","ports":[{"containerPort":80,"hostPort":80},{"containerPort":443,"hostPort":443}]}],"nodeSelector":{"ingress-ready":"true"},"tolerations":[{"key":"node-role.kubernetes.io/master","operator":"Equal","effect":"NoSchedule"}]}}}}'
}

################
install_k8s_pods() {             # installs vault, mariadb and demo app to kubernetes
  (set -x; ls k8s-*.yaml|xargs -n1 kubectl apply -f)
}

init_vault() {                   # init vault
  (set -x; vault operator init |tee keys)
}

unseal_vault() {                 # unseal vault
  local key_no=${1:?pass in the unsealing number -- info will be read from file 'keys'}
  local unsealing_key=$(cat keys |grep "Key ${key_no}:"|cut -f2 -d:)
  : ${unsealing_key:?}

  (set -x; vault operator unseal ${unsealing_key})
}

set_vault_env() {                # get and export vault token and vault addr
  local token=$(cat keys|grep "Token:"|cut -f2 -d:)
  : ${token}
  set -x
  echo "export VAULT_TOKEN='${token}'"
  echo "export VAULT_ADDR='${VAULT_ADDR}'"
}

enable_audit_log() {             # enables audit log for vault
  (set -x; vault audit enable file file_path=/tmp/audit.log)
}

enable_kv_secret_backend() {     # enables kv secret backend
  (set -x; vault secrets enable -version=2 kv)
}

create_vault_user() {            # create username/password auth with foo/bar user
  (set -x; vault auth enable userpass)
  _wait
  (set -x; vault write auth/userpass/users/foo \
    password=bar \
    "policies=testdb-ro,kv-foo"
  )
  _wait
  (set -x
  vault login -method=userpass \
    username=foo \
    password=bar
  )
}

enable_mariadb() {                 # enables mariadb secrets engine and configuration
  (set -x; vault secrets enable -path mariadb database)
  _wait

  (set -x
  vault write mariadb/config/testdb \
    plugin_name=mysql-database-plugin \
    connection_url="{{username}}:{{password}}@tcp(mariadb:3306)/" \
    allowed_roles="testdb-ro,testdb-rw" \
    username="root" \
    password="mypass"
  )

  _wait
  (set -x
  vault write mariadb/roles/testdb-ro \
    db_name=testdb \
    creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';GRANT SELECT ON *.* TO '{{name}}'@'%';" \
    default_ttl="10s" \
    max_ttl="10s"
  )

  _wait
  (set -x
  vault write mariadb/roles/testdb-rw \
    db_name=testdb \
    creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';GRANT ALL ON *.* TO '{{name}}'@'%';" \
    default_ttl="10s" \
    max_ttl="10s"
  )

  _wait
  (set -x
  vault read mariadb/creds/testdb-rw
  )
  kubectl exec deploy/mariadb -- \
    /bin/sh -c "echo 'create table testdb (foo INT);insert into testdb (foo) values (23);insert into testdb (foo) values (42);select * from testdb;'|mariadb -uroot -pmypass -Dtestdb"
}

enable_postgres() {                 # enables mariadb secrets engine and configuration
  (set -x; vault secrets enable -path postgres database)
  _wait

  (set -x
  vault write postgres/config/testdb \
    plugin_name=postgresql-database-plugin \
    connection_url="postgresql://{{username}}:{{password}}@postgres:5432" \
    allowed_roles="testdb-ro,testdb-rw" \
    username="postgres" \
    password="mypass"
  )

  vault write postgres/roles/my-role \
    db_name="my-postgresql-database" \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
        GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
    default_ttl="1h" \
    max_ttl="24h"

  _wait
  (set -x
  vault write postgres/roles/testdb-ro \
    db_name=testdb \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
        GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
    default_ttl="10s" \
    max_ttl="10s"
  )

  _wait
  (set -x
  vault write postgres/roles/testdb-rw \
    db_name=testdb \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
        GRANT ALL ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
    default_ttl="10s" \
    max_ttl="10s"
  )

  _wait
  (set -x
  vault read postgres/creds/testdb-rw
  )
  kubectl exec deploy/postgres -- \
    /bin/sh -c "echo 'create table \"testdb\" (foo int);insert into testdb (foo) values (23);insert into testdb (foo) values (42);select * from testdb;'|psql -Upostgres"
}

enable_mongodb() {                 # enables mongodb secrets engine and configuration
  (set -x; vault secrets enable -path mongodb database)
  _wait

  (set -x
  vault write mongodb/config/mongodb \
    plugin_name=mongodb-database-plugin \
    connection_url="mongodb://{{username}}:{{password}}@mongodb:27017/admin?tls=false" \
    allowed_roles="mongo-rw" \
    username="mongouser" \
    password="mongopass"
  )

  vault write mongodb/roles/mongo-rw \
    db_name=mongodb \
    creation_statements='{ "db": "admin", "roles": [{ "role": "readWrite" }, {"role": "read", "db": "foo"}] }' \
    default_ttl="1h" \
    max_ttl="24h"


  _wait
  (set -x
  vault read mongodb/creds/mongo-rw
  )
}

enable_k8s_auth() {              # enables kubernetes authentication
  (set -x; kubectl apply -f vault-sa.yaml)
  _wait

  (set -x; vault auth enable kubernetes)
  _wait

  local ca=$(kubectl get secret vault-auth-secret -ojsonpath="{.data.ca}"|base64 --decode)
  local token=$(kubectl get secret vault-auth-secret -ojsonpath="{.data.token}"|base64 --decode)

  (set -x
  vault write auth/kubernetes/config \
    "token_reviewer_jwt=${token}" \
    "kubernetes_host=https://kubernetes" \
    "kubernetes_ca_cert=${ca}"
  )
  _wait

  (set -x
  vault write auth/kubernetes/role/test \
    bound_service_account_names="default,demo-app-sa" \
    bound_service_account_namespaces=default \
    policies=testdb-ro \
    ttl=1h
  )
}

###########

if [ -z "$1" ] || ! echo $(_functions)|grep $1 >/dev/null
then
  _usage
  exit 1
fi

export VAULT_ADDR=${VAULT_ADDR:=http://localhost:8200}
test -e ${KINDCONFIG} && export KUBECONFIG=${KINDCONFIG}

"$@"