Class: Conjur::Conjurize::Script

Inherits:
Object
  • Object
show all
Defined in:
lib/conjur/conjurize/script.rb

Overview

generates a shell script to conjurize a host

Constant Summary collapse

COOKBOOK_RELEASES_URL = 
"https://api.github.com/repos/conjur-cookbooks/conjur/releases".freeze
HEADER = 
<<-HEADER.freeze
#!/bin/sh
set -e

# Implementation note: 'tee' is used as a sudo-friendly 'cat' to populate a file with the contents provided below.
HEADER

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(options) ⇒ Script

Returns a new instance of Script.



25
26
27
 
# File 'lib/conjur/conjurize/script.rb', line 25

def initialize options
  @options = options
end

Instance Attribute Details

#options ⇒ Object (readonly)

Returns the value of attribute options.



29
30
31
 
# File 'lib/conjur/conjurize/script.rb', line 29

def options
  @options
end

Class Method Details

.generate(configuration, options) ⇒ Object 



56
57
58
 
# File 'lib/conjur/conjurize/script.rb', line 56

def self.generate configuration, options
  new(options).generate configuration
end

.identity(configuration) ⇒ Object 



99
100
101
102
103
104
105
 
# File 'lib/conjur/conjurize/script.rb', line 99

def self.identity configuration
  """
    machine #{configuration['appliance_url']}/authn
    login host/#{configuration['id']}
    password #{configuration['api_key']}
  """
end

.latest_conjur_cookbook_release ⇒ Object 



10
11
12
13
14
15
16
 
# File 'lib/conjur/conjurize/script.rb', line 10

def self.latest_conjur_cookbook_release
  json = JSON.parse open(COOKBOOK_RELEASES_URL).read
  tarballs = json[0]["assets"].select do |asset|
    asset["name"] =~ /conjur-v\d.\d.\d.tar.gz/
  end
  tarballs.first["browser_download_url"]
end

.rc(configuration) ⇒ Object 



89
90
91
92
93
94
95
96
97
 
# File 'lib/conjur/conjurize/script.rb', line 89

def self.rc configuration
  [
    "account: #{configuration['account']}",
    "appliance_url: #{configuration['appliance_url']}",
    "cert_file: /etc/conjur-#{configuration['account']}.pem",
    "netrc_path: /etc/conjur.identity",
    "plugins: []"
  ].join "\n"
end

Instance Method Details

#chef_executable ⇒ Object 



68
69
70
 
# File 'lib/conjur/conjurize/script.rb', line 68

def chef_executable
  options[:"chef-executable"] || "chef-solo"
end

#chef_script ⇒ Object 



80
81
82
83
84
85
86
87
 
# File 'lib/conjur/conjurize/script.rb', line 80

def chef_script
  @chef_script ||= [
    ("curl -L https://www.opscode.com/chef/install.sh | " + sudo["bash"] \
      if install_chef?),
    (sudo["#{chef_executable} -r #{conjur_cookbook_url} " \
        "-o #{conjur_run_list}"] if run_chef?)
  ].join "\n"
end

#configure_conjur(configuration) ⇒ Object 



107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/conjur/conjurize/script.rb', line 107

def configure_conjur configuration
  [
    write_file("/etc/conjur.conf", Script.rc(configuration)),
    write_file(
      "/etc/conjur-#{configuration['account']}.pem",
      configuration["certificate"]
    ),
    write_file(
      "/etc/conjur.identity",
      Script.identity(configuration),
      mode: 0600
    )
  ].join "\n"
end

#conjur_cookbook_url ⇒ Object 



72
73
74
 
# File 'lib/conjur/conjurize/script.rb', line 72

def conjur_cookbook_url
  options[:"conjur-cookbook-url"] || Script.latest_conjur_cookbook_release
end

#conjur_run_list ⇒ Object 



76
77
78
 
# File 'lib/conjur/conjurize/script.rb', line 76

def conjur_run_list
  options[:"conjur-run-list"] || "conjur"
end

#generate(configuration) ⇒ Object 



122
123
124
125
126
127
128
129
130
131
 
# File 'lib/conjur/conjurize/script.rb', line 122

def generate configuration
  fail "No 'id' field in host JSON" unless configuration["id"]
  fail "No 'api_key' field in host JSON" unless configuration["api_key"]

  [
    HEADER,
    configure_conjur(configuration),
    chef_script
  ].join("\n")
end

#install_chef? ⇒ Boolean

Returns:

  • (Boolean) 


60
61
62
 
# File 'lib/conjur/conjurize/script.rb', line 60

def install_chef?
  run_chef? && !options[:"chef-executable"]
end

#run_chef? ⇒ Boolean

Returns:

  • (Boolean) 


64
65
66
 
# File 'lib/conjur/conjurize/script.rb', line 64

def run_chef?
  options.values_at(:ssh, :"conjur-run-list").any?
end

#set_mode(path, mode) ⇒ Object 



48
49
50
51
52
53
54
 
# File 'lib/conjur/conjurize/script.rb', line 48

def set_mode path, mode
  mode = mode.to_s(8) if mode.respond_to? :to_int
  [
    [sudo["touch"], path].join(" "),
    [sudo["chmod"], mode, path].join(" ")
  ].join("\n")
end

#sudo ⇒ Object 



31
32
33
 
# File 'lib/conjur/conjurize/script.rb', line 31

def sudo
  @sudo ||= options["sudo"] ? ->(x) { "sudo -n #{x}" } : ->(x) { x }
end

#write_file(path, content, options = {}) ⇒ Object

Generate a piece of shell to write to a file

Parameters:

  • path (String) —

    absolute path to write to

  • content (String) —

    contents to write

  • options (Hash) (defaults to: {}) —

    a customizable set of options

Options Hash (options):

  • :mode (String, Fixnum) —

    mode to apply to the file



39
40
41
42
43
44
45
46
 
# File 'lib/conjur/conjurize/script.rb', line 39

def write_file path, content, options = {}
  [
    ((mode = options[:mode]) && set_mode(path, mode)),
    [sudo["tee"], path, "> /dev/null << EOF"].join(" "),
    content.strip,
    "EOF\n"
  ].compact.join("\n")
end