zydronium/manage.get.gov
1
0
Fork 0
mirror of https://github.com/cisagov/manage.get.gov.git synced 2025-07-21 10:16:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

add script for rotating cloud.gov secrets and runbook for description of script (#43)

Browse source 
* add script for rotating secrets and runbook for description of script

* add a note about why we rotate

* fix gh auth login if statement

* Update scripts/rotate_cloud_secrets.sh

Co-authored-by: Seamus Johnston <seamus.johnston@gsa.gov>

* add some comments about cf versions

Co-authored-by: Seamus Johnston <seamus.johnston@gsa.gov>
This commit is contained in:
Logan McDonald 2022-08-12 16:27:17 -04:00 • committed by GitHub
parent 2fa2f33c3b
commit 0f5f6e24a8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 55 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

38
scripts/rotate_cloud_secrets.sh Executable file
View file

@ -0,0 +1,38 @@
# NOTE: This script does not work with cf v8. We recommend using cf v7 for all cloud.gov commands.
if [ ! $(command -v gh) ] || [ ! $(command -v jq) ] || [ ! $(command -v cf) ]; then
echo "jq, cf, and gh packages must be installed. Please install via your preferred manager."
exit 1
fi
cf spaces
read -p "Are you logged in to the dotgov-poc CF space above? (y/n) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]
then
cf login -a https://api.fr.cloud.gov --sso
fi
gh auth status
read -p "Are you logged into a Github account with access to cisagov/dotgov? (y/n) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]
then
gh auth login
fi
echo "Great, removing and replacing Github CD account..."
cf delete-service-key github-cd-account github-cd-key
cf create-service-key github-cd-account github-cd-key
cf service-key github-cd-account github-cd-key
read -p "Please confirm we should set the above username and key to Github secrets. (y/n) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]
then
exit 1
fi
cf service-key github-cd-account github-cd-key | sed 1,2d | jq -r '[.username, .password]|@tsv' |
while read -r username password; do
gh secret --repo cisagov/dotgov set CF_USERNAME --body $username
gh secret --repo cisagov/dotgov set CF_PASSWORD --body $password
done