adam buxton abuxton

Keybase proof

I hereby claim:

I am abuxton on github.
I am abuxton (https://keybase.io/abuxton) on keybase.
I have a public key ASAFYuAD6GPJP0XJGZRrVdXjfKyr_JZlOL17gGe1Ze620Qo

To claim this, I am signing this object:

My vaut config:

{
  "ui": true,
  "pid_file": "/run/vault/vault.pid",
  "storage": {
    "consul": {

Example Jenkins integration for Vault

This snippet provides an example Jenkinsfile that performs an AppRole authentication using curl utility. The objective is to allow Jenkins to Authenticate to Vault, then use a temporary token to retrieve a secret. It does not rely on a plugin and therefore offers more flexibility.

AppRole authentication relies on a ROLE_ID and SECRET_ID to login and retrieve a Vault token. There are two ways to provide the SECRET_ID to Jenkins. Both of these are expanded upon below.

Pre-created SECRET_ID as a Jenkins secret. An out-of-band workflow will need to refresh the SECRET_ID periodically so Jenkins continues to perform AppRole logins successfully.
Alternative AppRole design: Give Jenkins the ability to refresh the SECRET_ID by itself.

1. Pre-created Secret ID

Rsync

Common arguments

-v verbose

-h humanise the output by implementing binary multipliers instead of byte values etc.

-P display progress and allow resumption of interrupted transfers

-n do a dry run for testing

	#!/bin/bash
	echo '
	node_prefix "" {
	policy = "write"
	}
	service_prefix "" {
	policy = "read"
	}
	agent_prefix "" {
	policy = "write"

	#!/bin/bash
	AWS_REGION="eu-west-2"
	consul tls ca create
	consul tls cert create -server -dc=$AWS_REGION
	consul tls cert create -client -dc=$AWS_REGION
	mv consul-agent-ca.pem consul_ca.pem
	mv consul-agent-ca-key.pem consul_ca_key.pem
	mv $AWS_REGION-server-consul-0.pem consul_server_crt.pem
	mv $AWS_REGION-server-consul-0-key.pem consul_server_key.pem
	cat $AWS_REGION-client-consul-0.pem consul_ca.pem > vault_crt.pem

	cat << EOF > /tmp/bootstrap_tokens.sh
	#!/bin/bash
	export CONSUL_HTTP_TOKEN=${master_token}
	export CONSUL_HTTP_ADDR=http://127.0.0.1:7500
	echo "Creating Consul ACL policies......"
	if ! consul kv get acl_bootstrap 2>/dev/null; then
	consul kv put acl_bootstrap 1
	echo '
	node_prefix "" {
	policy = "write"

	#!/bin/bash

	# start vault
	VAULT_UI=true vault server -dev -dev-root-token-id=root -dev-listen-address=127.0.0.1:8200

	# login as root - DO NOT DO THIS IN PRODUCTION
	vault login root

	# write some secrets
	vault kv put secret/test color=blue number=eleventeen

	pipeline {
	agent any
	stages {
	stage('Integration Tests') {
	steps {
	script {
	def ROLE_ID = "REPLACE_WITH_ID"
	def SECRET_ID = "REPLACE_WITH_ID"

	/* sh '''