Refactored features based on pairing session.

README.md

@@ -24,11 +24,11 @@ provisioning and deploying new environments.
 Features
 -------
 
-## `external-postgres`
+## `external-postgres` and `external-postgres-vault`
 
 By default an internal (colocoated job) postgres is deployed for use. Optionally
 you may configure to use an external PostgreSQL database by adding the 
-`external-postgres` feature together with the following in vault (no defaults):
+`external-postgres-vault` feature together with the following in vault (no defaults).
 
 ```
 secret/$env/vault/db:scheme
@@ -39,6 +39,13 @@ secret/$env/vault/db:port
 secret/$env/vault/db:sslmode
 secret/$env/vault/db:database
 ```
+
+Note that when you do a `new` environment you will be prompted for these and 
+they will get stored in vault directly so you do not need to set them separately.
+
+If you are using another system to generate them and stick into vault 
+(ex: terraform) then it will be directly consumed.
+
 You can do this using `safe` in a single command like so:
 ```sh
 safe set secret/dev/ocf-scheduler/db \
@@ -51,6 +58,20 @@ safe set secret/dev/ocf-scheduler/db \
   database="scheduler"
 ```
 
+for the `external-postgres` feature (no `-vault`) you can override defaults 
+using the environment file's params object:
+
+```yaml
+params:
+  pg_scheme:   "..."
+  pg_username: "..."
+  pg_password: "..."
+  pg_hostname: "..."
+  pg_port:     "..."
+  pg_sslmode:  "..."
+  pg_database: "..."
+```
+
 ## `cf-route-registrar`
 
 By enabling the `cf-route-registrar` feature the kit will extrac the CF deployment

hooks/addon

@@ -25,18 +25,18 @@ EOF
 cf_login() {
   cf_deployment_env="$(exodus cf_deployment_env)"
   cf_deployment_type="$(exodus cf_deployment_type)"
-  cf_exodus="${GENESIS_EXODUS_MOUNT}${cf_deployment_env}/${cf_deployment_type}"
+  cf_exodus_path="${GENESIS_EXODUS_MOUNT}${cf_deployment_env}/${cf_deployment_type}"
   if ! cf plugins | grep -q '^cf-targets'; then
     describe "#Y{The cf-targets plugin does not seem to be installed}"
         echo "Install it first, via 'genesis do $GENESIS_ENVIRONMENT -- setup-cli'"
         echo "from your $cf_deployment_env environment in your CF deployment repo."
     exit 1
   fi
 
-  system_domain="$(safe get "${cf_exodus}:system_domain")"
+  system_domain="$(safe get "${cf_exodus_path}:system_domain")"
   api_url=https://api.$system_domain
-  username="$(safe get "${cf_exodus}:admin_username")"
-  password="$(safe get "${cf_exodus}:admin_password")"
+  username="$(safe get "${cf_exodus_path}:admin_username")"
+  password="$(safe get "${cf_exodus_path}:admin_password")"
 
   #TODO enfoce ssl validation
   cf api "$api_url" --skip-ssl-validation

hooks/blueprint

@@ -8,13 +8,15 @@ manifests+=( manifests/scheduler.yml manifests/releases/scheduler.yml )
 
 if want_feature "external-postgres" ; then
   manifests+=( manifests/external-postgres.yml )
+elif want_feature "external-postgres-vault" ; then
+  manifests+=( manifests/external-postgres-vault.yml )
 else
   manifests+=( manifests/releases/postgres.yml )
 fi
 
 for want in $GENESIS_REQUESTED_FEATURES; do
   case "$want" in
-    (external-postgres|+internal-postgres) # Covered above
+    (external-postgres*|+internal-postgres) # Covered above
       true
       ;;
     (cf-route-registrar)

kit.yml

@@ -1,21 +1,44 @@
 name:    ocf-scheduler
-version: 0.0.1
+version: 0.0.16
 author:  Wayne E. Seguin <wayneeseguin@starkandwayne.com>
 docs:    https://github.com/cloudfoundry-community/scheduler-boshrelease
 code:    https://github.com/genesis-community/scheduler-genesis-kit
 
-genesis_version_min: 2.8.4
+genesis_version_min: 2.8.5
 
 credentials:
   +internal-postgres:
     role:
       password: random 32 fixed
 
 provided:
-  +external-postgres:
-    role:
+  external-postgres:
+    db:
       keys:
         password:
           prompt: "Password for the external Postgresql Database"
-        username:
+
+  external-postgres-vault: # feature
+    db: # vault suffix path
+      keys: # vault keys hash
+        username: # vault key name & value
           prompt: "Username for the external Postgresql Database"
+          default: "postgres"
+        password:
+          prompt: "Password for the external Postgresql Database"
+        scheme:
+          prompt: "Scheme for the external Postgresql Database"
+          default: "postgres"
+        hostname:
+          prompt: "hostname (or IP) for the external Postgresql Database"
+          default: "127.0.0.1"
+        port:
+          prompt: "Port for the external Postgresql Database"
+          default: "5432"
+        sslmode:
+          prompt: "SSL Mode for the external Postgresql Database (disable/enable)"
+          default: "disable"
+        database:
+          prompt: "Database for the external Postgresql Database"
+          default: "postgres"
+

manifests/cf-route-registrar.yml

@@ -12,17 +12,17 @@ addons:
       aliases:
       - domain: nats.service.cf.internal
         targets:
-        - deployment: (( grab meta.cf.deployment_name ))
+        - deployment: (( grab meta.cf_deployment_name ))
           domain: bosh
           instance_group: nats
-          network: (( grab params.cf.core_network ))
+          network: (( grab params.cf_core_network ))
           query: '*'
       - domain: _.nats.service.cf.internal
         targets:
-        - deployment: (( grab meta.cf.deployment_name ))
+        - deployment: (( grab meta.cf_deployment_name ))
           domain: bosh
           instance_group: nats
-          network: (( grab params.cf.core_network ))
+          network: (( grab params.cf_core_network ))
           query: _
 ---
 - type: replace
@@ -33,21 +33,21 @@ addons:
     consumes:
       nats-tls:
         from:       nats-tls
-        deployment: (( grab meta.cf.deployment_name ))
+        deployment: (( grab meta.cf_deployment_name ))
     properties:
       nats:
         tls:
           enabled: true
-          client_cert: (( grab params.nats.client_cert ))
-          client_key:  (( grab params.nats.client_key ))
+          client_cert: (( grab params.nats_client_cert ))
+          client_key:  (( grab params.nats_client_key ))
       route_registrar:
         routes:
         - name: scheduler
           port: 8000 # Scheduler API Port
           registration_interval: 10s
           uris:
-            - (( grab params.scheduler.domain ))
-        host: (( grab params.cf.system_domain ))
+            - (( grab params.scheduler_domain ))
+        host: (( grab params.cf_system_domain ))
 - type: replace
   path: /instance_groups/0/jobs/name=bpm?
   value:

manifests/external-postgres-vault.yml

@@ -0,0 +1,15 @@
+---
+params:
+  pg_scheme:   (( vault meta.vault "/db:scheme"   ))
+  pg_username: (( vault meta.vault "/db:username" ))
+  pg_password: (( vault meta.vault "/db:password" ))
+  pg_hostname: (( vault meta.vault "/db:hostname" ))
+  pg_port:     (( vault meta.vault "/db:port"     ))
+  pg_sslmode:  (( vault meta.vault "/db:sslmode"  ))
+  pg_database: (( vault meta.vault "/db:database" ))
+
+instance_groups:
+- name: scheduler
+  jobs:
+  - (( delete "postgres" ))
+

manifests/external-postgres.yml

@@ -1,13 +1,12 @@
 ---
-meta:
-  pg:
-    scheme:   (( vault meta.vault "/db:scheme"   ))
-    username: (( vault meta.vault "/db:username" ))
-    password: (( vault meta.vault "/db:password" ))
-    hostname: (( vault meta.vault "/db:hostname" ))
-    port:     (( vault meta.vault "/db:port"     ))
-    sslmode:  (( vault meta.vault "/db:sslmode"  ))
-    database: (( vault meta.vault "/db:database" ))
+params:
+  pg_scheme:   (( vault meta.vault "/db:scheme"   ))
+  pg_username: (( vault meta.vault "/db:username" ))
+  pg_password: (( vault meta.vault "/db:password" ))
+  pg_hostname: (( vault meta.vault "/db:hostname" ))
+  pg_port:     (( vault meta.vault "/db:port"     ))
+  pg_sslmode:  (( vault meta.vault "/db:sslmode"  ))
+  pg_database: (( vault meta.vault "/db:database" ))
 
 instance_groups:
 - name: scheduler

manifests/scheduler.yml

@@ -2,38 +2,33 @@
 meta:
   default:
     azs: [z1]
-  pg:
-    scheme:   (( grab params.pg.scheme   || "postgres" ))
-    username: (( grab params.pg.username || "ocf-scheduler" ))
-    password: (( grab params.pg.password || "ocf-scheduler" ))
-    hostname: (( grab params.pg.hostname || "127.0.0.1" ))
-    port:     (( grab params.pg.port     || "5432" ))
-    sslmode:  (( grab params.pg.sslmode  || "disable" ))
-    database: (( grab params.pg.database || "ocf-scheduler" ))
-  cf:
-    exodus: (( concat $GENESIS_EXODUS_MOUNT params.cf.deployment_env "/" params.cf.deployment_type ))
-    deployment_name: (( concat params.cf.deployment_env "-" params.cf.deployment_type ))
-    system_domain: (( vault "secret/exodus/" params.cf.deployment_env "/cf:system_domain" ))
 
-params:
-  cf:
-    deployment_env:  (( grab genesis.env )) # assume the same env name as cf env
-    deployment_type: cf # for crazy people using an non-"cf" cf deployment name
-    core_network:    (( vault meta.cf.exodus ":core_network" ))
-    system_domain:   (( vault meta.cf.exodus ":system_domain" ))
-    system_org:      (( vault meta.cf.exodus ":system_org" ))
-    system_space:    (( vault meta.cf.exodus ":system_space" ))
-    username:        (( vault meta.cf.exodus ":admin_username" ))
-    password:        (( vault meta.cf.exodus ":admin_password" ))
-  network:           (( grab params.cf.core_network ))
-  nats:
-    client_cert: (( vault meta.cf.exodus ":nats_client_cert" ))
-    client_key:  (( vault meta.cf.exodus ":nats_client_key" ))
-  uaa:
-    client_id:     (( vault meta.cf.exodus ":app_scheduler_client" ))
-    client_secret: (( vault meta.cf.exodus ":app_scheduler_secret" ))
-  scheduler:
-    domain:  (( concat "scheduler." meta.cf.system_domain ))
+  cf_exodus_path: (( concat $GENESIS_EXODUS_MOUNT params.cf_deployment_env "/" params.cf_deployment_type ))
+  cf_deployment_name: (( concat params.cf_deployment_env "-" params.cf_deployment_type ))
+  cf_system_domain: (( vault "secret/exodus/" params.cf_deployment_env "/cf:system_domain" ))
+
+params: # NOTE: Contract with kit & genesis is that params are flat for kits.
+  cf_deployment_env:  (( grab genesis.env )) # assume the same env name as cf env
+  cf_deployment_type: cf # for crazy people using an non-"cf" cf deployment name
+  cf_core_network:    (( vault meta.cf_exodus_path ":core_network" ))
+  cf_system_domain:   (( vault meta.cf_exodus_path ":system_domain" ))
+  cf_system_org:      (( vault meta.cf_exodus_path ":system_org" ))
+  cf_system_space:    (( vault meta.cf_exodus_path ":system_space" ))
+  cf_username:        (( vault meta.cf_exodus_path ":admin_username" ))
+  cf_password:        (( vault meta.cf_exodus_path ":admin_password" ))
+  network:            (( grab params.cf_core_network ))
+  nats_client_cert:   (( vault meta.cf_exodus_path ":nats_client_cert" ))
+  nats_client_key:    (( vault meta.cf_exodus_path ":nats_client_key" ))
+  uaa_client_id:      (( vault meta.cf_exodus_path ":app_scheduler_client" ))
+  uaa_client_secret:  (( vault meta.cf_exodus_path ":app_scheduler_secret" ))
+  scheduler_domain:   (( concat "scheduler." meta.cf_system_domain ))
+  pg_scheme:   "postgres" 
+  pg_username: "ocf-scheduler" 
+  pg_password: "ocf-scheduler" 
+  pg_hostname: "127.0.0.1" 
+  pg_port:     "5432" 
+  pg_sslmode:  "disable" 
+  pg_database: "ocf-scheduler" 
 
 instance_groups:
 - name:      scheduler
@@ -54,23 +49,23 @@ instance_groups:
     properties:
       scheduler:
         uaa:
-          client_id: (( grab params.uaa.client_id ))
-          client_secret: (( grab params.uaa.client_secret ))
-          endpoint: (( concat "https://uaa."  params.cf.system_domain ))
+          client_id: (( grab params.uaa_client_id ))
+          client_secret: (( grab params.uaa_client_secret ))
+          endpoint: (( concat "https://uaa."  params.cf_system_domain ))
         cf:
-          api: (( concat "https://api." params.cf.system_domain ))
+          api: (( concat "https://api." params.cf_system_domain ))
         postgres:
-          uri: (( concat "postgres://" meta.pg.username ":" meta.pg.password "@" meta.pg.hostname ":" meta.pg.port "/" meta.pg.database "?sslmode=" meta.pg.sslmode ))
+          uri: (( concat "postgres://" params.pg_username ":" params.pg_password "@" params.pg_hostname ":" params.pg_port "/" params.pg_database "?sslmode=" params.pg_sslmode ))
 
   - name: postgres
     properties:
       databases:
         roles:
-        - name:     (( grab meta.pg.username ))
-          password: (( grab meta.pg.password ))
+        - name:     (( grab params.pg_username ))
+          password: (( grab params.pg_password ))
         databases: 
-        - name: (( grab meta.pg.database ))
-        port:   (( grab meta.pg.port ))
+        - name: (( grab params.pg_database ))
+        port:   (( grab params.pg_port ))
     provides:
       postgres:
         as: scheduler-postgres
@@ -90,11 +85,11 @@ instance_groups:
     release: ocf-scheduler
     properties:
       cf:
-        username:     (( grab params.cf.username ))
-        password:     (( grab params.cf.password ))
-        api:          (( concat "https://api." params.cf.system_domain ))
-        organization: (( grab params.cf.system_org ))
-        space:        (( grab params.cf.system_space ))
+        username:     (( grab params.cf_username ))
+        password:     (( grab params.cf_password ))
+        api:          (( concat "https://api." params.cf_system_domain ))
+        organization: (( grab params.cf_system_org ))
+        space:        (( grab params.cf_system_space ))
 
 name: scheduler