Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WinRM? More like "rm windows" #74

Merged
merged 68 commits into from
Dec 8, 2017
Merged
Changes from 1 commit
Commits
Show all changes
68 commits
Select commit Hold shift + click to select a range
1f1fe00
some workarounds for Cygwin ssh difficulties
Aug 29, 2017
8cc3a5d
backport the_goog's abstraction of deploy secret handling to cloud st…
Aug 29, 2017
ae3e15c
add SAN to our internally-signed node certs; bump to v3; add a -winrm…
Aug 29, 2017
47b179e
mu-node-manage -m certs to fill in missing certs (but especially winrm)
Aug 30, 2017
c615c94
new Windows metadata, which in theory enables WinRM certificate auth
Aug 31, 2017
2f802fd
shrink Windows userdata script a smidge
Aug 31, 2017
7f7086c
mu-node-manage: don't touch unrelated autoscale groups when manipulat…
Aug 31, 2017
dcad9e6
better debugging logging around WinRM bits
Aug 31, 2017
a13f9aa
scrub extraneous logic from Windows userdata; fix some edge cases and…
Sep 11, 2017
ce28980
WinRM: workaround for hostname resolution (/etc/hosts, ew); cert auth…
Sep 18, 2017
fa59c11
Merge branch 'master' into winrm_more_like_rm_windows
Sep 19, 2017
5d13fe0
suspect mu-tools windows_users resource has been meddling with sshd d…
Sep 25, 2017
2c1a5d6
Merge branch 'master' into winrm_more_like_rm_windows
Sep 25, 2017
762ff6a
Merge branch 'master' into winrm_more_like_rm_windows
Sep 25, 2017
f84bf91
now do it right, chowderhead
Sep 25, 2017
1408326
WinRM breakthrough: successfully getting a shell with certificate auth
Oct 3, 2017
85ebeea
knife bootstrap working over winrm; Chef runs invoke correctly (but c…
Oct 5, 2017
848a9ae
bump Chef version; start on a non-cygwin opensshd for Windows
Oct 6, 2017
d9c3e39
pull knife-windows from our fork until the Chef people take my pull r…
Oct 10, 2017
6875467
Cygwin install back in play, but not in the critical path (much)
Oct 10, 2017
f75e0a6
Chef Server has *problems*
Oct 11, 2017
dd6135c
split list of localhost firewall holes for Chef server
Oct 11, 2017
626b25a
shuffle windows userdata a bit
Oct 11, 2017
90565df
weird workarounds for bundling a gem from git
Oct 11, 2017
88f62d3
mu-node-manage: gracefully try WinRM to do things, then fail to ssh i…
Oct 12, 2017
23896c4
mu-master cookbook fixlets
Oct 17, 2017
7a20f5a
further Windows bootstrap hokey-pokey
Oct 18, 2017
c533710
comment extraneous install of knife-windows gem
Oct 19, 2017
ee35a64
we're going to try *not* bundling our gems into /opt/opscode and see …
Oct 19, 2017
f1012b9
minor YARD doc updates
Oct 19, 2017
3e56e28
Merge branch 'master' into winrm_more_like_rm_windows
Oct 19, 2017
2b280f4
remove accidental hardcoded mommacat IP from userdata; tweaks to Wind…
jstange Oct 19, 2017
1aa26cb
Merge branch 'winrm_more_like_rm_windows' of github.com:/cloudamatic/…
jstange Oct 19, 2017
83b0b29
more reboot assistance for stuck windows nodes
jstange Oct 19, 2017
4d01bb6
handle windows' stuff sshd service differently if not in a domain
jstange Oct 19, 2017
b453299
catch some aggravating errors
jstange Oct 19, 2017
2b39c11
don't accept dumb values like 'localhost' for public_addr
jstange Oct 19, 2017
97371c2
signing a CSR: scene missing?
jstange Oct 19, 2017
f8f0d8d
parents around args to MU.log so it doesn't think spaces mean more args
jstange Oct 19, 2017
8a38ebb
new win2k12 stock AMIs; cleaner script for old base images
jstange Oct 24, 2017
74051b5
mu-tools windows_users resource: name the temporary password setter r…
Oct 24, 2017
db05d6b
don't log passwords to plain text in windows userdata, fool
Oct 25, 2017
cd03e8b
installer: take a branch argument
Oct 26, 2017
22d8de8
mu-configure: drop out quicker if LDAP setup fails
Oct 26, 2017
61c7306
389ds setup script bug workaroud
Oct 26, 2017
9017f27
more workarounds for new bugs in SSSD and 389DS vendor packages (than…
Oct 26, 2017
ea0d5d6
auto-regenerate expired node SSL certs
Oct 27, 2017
4a22367
windows: existing nodes can try ssh if winrm grooms fail; installer: …
Oct 30, 2017
a544bf2
tighter retry logic for windows in Chef groomer's run method
Oct 30, 2017
5e7230c
init.rb: put the right branch name in this testing branch, eh wot
Oct 31, 2017
28f6bb8
make manual VPC peering connection acceptance a warning so it jumps o…
Nov 1, 2017
e7da04e
we don't need these old knife-windows diffs anymore
Nov 1, 2017
b9a4c72
mu-configure: don't keel over if the user enters a wrong (stub) menu …
Nov 3, 2017
9db9307
VPC manual peering warning: clarify that setting is per-accont
jstange Nov 3, 2017
4b837e4
deploy nits for non-root users
jstange Nov 6, 2017
8b02939
better check for bogus menu options in mu-configure
Nov 7, 2017
cab9c1c
don't blow up when an ungroomed node calls to momma
Nov 8, 2017
6153d20
AWS: always try to rig up ephemeral volumes, if the AMI didn't presen…
jstange Nov 15, 2017
d577f48
see if we can avoid the Chef git resource leaving us on the 'deploy' …
Nov 24, 2017
0b96f4f
testing pre-commit hook to auto-set branch name in installer
Nov 24, 2017
aa42907
be better at paths in pre-commit hook
Nov 24, 2017
7d016f1
cleaner display of branch heads-up in installer stub
Nov 24, 2017
3eb9592
work around dumb Chef git resource checkout behavior
Nov 24, 2017
c10b839
custom DNS records for ALBs don't alias correctly; work around with C…
Nov 28, 2017
96c2054
more aggressive validation of bad inputs in mu-configure
Nov 28, 2017
d13277c
polish for new mu-configure validation behavior
Nov 28, 2017
6d69477
a little more tweaking for mu-configure's new validation pickiness
Nov 30, 2017
7f39312
mu-configure: don't just run as soon as we see a valid config
Dec 1, 2017
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
backport the_goog's abstraction of deploy secret handling to cloud st…
…orage
Mu Master committed Aug 29, 2017

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
commit 8cc3a5db2b7d51bf6a61fcd7e38bba34401fcc33
17 changes: 17 additions & 0 deletions modules/mu/clouds/aws.rb
Original file line number Diff line number Diff line change
@@ -38,6 +38,23 @@ def self.listAZs(region = MU.curRegion)
return zones
end

# Plant a Mu deploy secret into a storage bucket somewhere for so our kittens can consume it
# @param deploy_id [String]: The deploy for which we're writing the secret
# @param value [String]: The contents of the secret
def self.writeDeploySecret(deploy_id, value)
name = deploy_id+"-secret"
begin
MU.log "Writing #{name} to S3 bucket #{MU.adminBucketName}"
MU::Cloud::AWS.s3(MU.myRegion).put_object(
acl: "private",
bucket: MU.adminBucketName,
key: name,
body: value
)
rescue Aws::S3::Errors => e
raise DeployInitializeError, "Got #{e.inspect} trying to write #{name} to #{MU.adminBucketName}"
end
end

# List the Amazon Web Services region names available to this account. The
# region that is local to this Mu server will be listed first.
12 changes: 3 additions & 9 deletions modules/mu/mommacat.rb
Original file line number Diff line number Diff line change
@@ -226,15 +226,9 @@ def initialize(deploy_id,
MU.log "Creating deploy secret for #{MU.deploy_id}"
@deploy_secret = Password.random(256)
if !@original_config['scrub_mu_isms']
begin
MU::Cloud::AWS.s3(MU.myRegion).put_object(
acl: "private",
bucket: MU.adminBucketName,
key: "#{@deploy_id}-secret",
body: "#{@deploy_secret}"
)
rescue Aws::S3::Errors::PermanentRedirect => e
raise DeployInitializeError, "Got #{e.inspect} trying to write #{@deploy_id}-secret to #{MU.adminBucketName}"
# TODO there's a nicer way to do this than hardcoding strings
if @clouds["AWS"] and @clouds["AWS"] > 0
MU::Cloud::AWS.writeDeploySecret(@deploy_id, @deploy_secret)
end
end
if set_context_to_me