kmcquade

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict
ProtectHome=read-only
ProtectControlGroups=yes
ProtectKernelModules=yes

kmcquade

sudo su

yum --enablerepo=extras install epel-release
yum -y install patch dkms kernel-devel perl
yum update

reboot

sudo su

kmcquade

# import config.
# You can change the default config with `make cnf="config_special.env" build`
cnf ?= config.env
include $(cnf)
export $(shell sed 's/=.*//' $(cnf))

# import deploy config
# You can change the default deploy config with `make cnf="deploy_special.env" release`
dpl ?= deploy.env
include $(dpl)

kmcquade

To Decrypt Jenkins Passwords

1. Go to the "Configure System" screen.
2. Right click on a password field, Inspect element, then change to "text" instead of "password".
3. Copy that field and then go to the Script Console. Paste the below into the field, replace with your encrypted password, and then hit "run".

encrypted_pw = '{your_encrypted_password_with_brackets_around_it}'
passwd = hudson.util.Secret.decrypt(encrypted_pw)
println(passwd)

kmcquade

#!/usr/bin/env python
#
# copy all SSM parameter store parameters to disk
#
import os, sys, argparse, boto3

parser = argparse.ArgumentParser(description='copy all parameter values to local')
parser.add_argument("--path", dest="path", required=True,
		    help="to copy the keys from", metavar="STRING")
parser.add_argument("--directory", dest="directory", required=True,

kmcquade

#cloud-config
write-files:
  - path: /etc/conf.d/nfs
    permissions: '0644'
    content: |
      OPTS_RPC_MOUNTD=""

coreos:
  units:
    - name: update-engine.service

kmcquade

CloudFormation -> Terraform Import Helpers

I wrote these scripts to help faciliate batch import of our CloudFormation templates into Terraform Configuration.

region-batch.sh

This script is a light wrapper around batch.sh. It simply iterates over the list of regions provided, exports expected variables, creates required directories, and calls batch.sh.

BASE_DIR=/path/to/dir EXCLUDE_REGEX="(some-stack-production|some-stack-staging)" ./region-batch.sh us-east-1 us-west-1

kmcquade

vault_aws_auth

These are python 2 and 3 snippets showing how to generate headers to authenticate with HashiCorp's Vault using the AWS authentication method. There's also a Ruby implementation which uses version 3 of the AWS SDK for Ruby.

The python scripts look for credentials in the default boto3 locations; if you need to supply custom credentials (such as from an AssumeRole call), you would use the botocore.session.set_credentials method before calling create_client.

kmcquade

apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
spec:

kmcquade

#/bin/bash
trap exit INT
INSTANCES=$( aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId[]' | sed -e 's/\[//g' -e 's/\]//g')
SUM=0
echo $INSTANCES
for i in $( echo $INSTANCES | sed -e 's/"//g' -e 's/,//g' -e 's/\[//g' -e 's/\]//g' ) ;do
	echo "---------------------------$i-------------------------------\n"
	 aws ec2 describe-instances --instance-ids $i --query 'Reservations[].Instances[].Tags[?Key==`Name`].Value' --output text 
	 aws ec2 describe-instance-attribute --instance-id $( echo $i |  sed -e 's/"//g'  -e 's/,//' -e 's/\[//g' -e 's/\]//g' ) --attribute userData \
	 	| jq '.UserData.Value' | sed 's/"//g' |  base64 --decode