From ce2061ad677fb3d51a5b2c18361f22e0aa72c079 Mon Sep 17 00:00:00 2001 From: Meir Gabay Date: Sat, 24 Apr 2021 00:10:00 +0300 Subject: [PATCH 1/7] updated gitignore --- .gitignore | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 2abbfe87..2ade2779 100644 --- a/.gitignore +++ b/.gitignore @@ -15,4 +15,11 @@ # vendor/ # Custom -iamlive \ No newline at end of file +iamlive + +# Ignore hidden files +.* +!ignore +!.gon-*.json +!.github/ +!.goreleaser.yml From b14b7ee4b6ebfd43c4f730cda8eced2884fe3230 Mon Sep 17 00:00:00 2001 From: Meir Gabay Date: Sat, 24 Apr 2021 00:10:28 +0300 Subject: [PATCH 2/7] added Dockerfile --- Dockerfile | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 Dockerfile diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 00000000..307192b1 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,38 @@ +ARG GO_VERSION=1.16.3 +ARG REPO_NAME="" +ARG APP_NAME="iamlive" +ARG APP_PATH="/go/src/iamlive" + + +# Dev +FROM golang:${GO_VERSION}-alpine AS dev +RUN apk add --update git +ARG APP_NAME +ARG APP_PATH +ENV APP_NAME="${APP_NAME}" \ + APP_PATH="${APP_PATH}" \ + GOOS="linux" +WORKDIR "${APP_PATH}" +COPY . "${APP_PATH}" +ENTRYPOINT ["sh"] + + +# Build +FROM dev as build +RUN go install +ENTRYPOINT [ "sh" ] + +# App +FROM alpine:3.12 AS app +RUN apk --update upgrade && \ + apk add --update ca-certificates && \ + update-ca-certificates +WORKDIR "/app/" +COPY --from=build "/go/bin/iamlive" ./iamlive +RUN addgroup -S "appgroup" && adduser -S "appuser" -G "appgroup" && \ + chown -R "appuser:appgroup" . + +USER "appuser" +EXPOSE 10080 +ENTRYPOINT ["./iamlive"] +CMD "" From 7b213d3aec52a7d2e6710f9511208f77280419fd Mon Sep 17 00:00:00 2001 From: Meir Gabay Date: Sat, 24 Apr 2021 00:11:58 +0300 Subject: [PATCH 3/7] updated ignore files --- .dockerignore | 10 ++++++++++ .gitignore | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 00000000..cca570cd --- /dev/null +++ b/.dockerignore @@ -0,0 +1,10 @@ +** +!LICENSE +!service/ +!vendor/ +!.gon-*.json +!map.json +!iam_definition.json +!*.go +!*.mod +!*.sum diff --git a/.gitignore b/.gitignore index 2ade2779..5f3c704e 100644 --- a/.gitignore +++ b/.gitignore @@ -19,7 +19,7 @@ iamlive # Ignore hidden files .* -!ignore +!.*ignore* !.gon-*.json !.github/ !.goreleaser.yml From 438403bc16930b71491b2dafdffc453f6406df63 Mon Sep 17 00:00:00 2001 From: Meir Gabay Date: Sat, 24 Apr 2021 00:23:37 +0300 Subject: [PATCH 4/7] updated docs about Docker --- README.md | 94 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+) diff --git a/README.md b/README.md index caa2fb8a..2e3cdd0f 100644 --- a/README.md +++ b/README.md @@ -145,6 +145,100 @@ export HTTP_PROXY=http://127.0.0.1:10080 export HTTPS_PROXY=http://127.0.0.1:10080 ``` +#### Docker + +Build Docker image from source + +```bash +docker build -t iamlive . +``` + +Run Docker container in Proxy Mode + +```bash +docker run \ + -p 80:10080 \ + -p 443:10080 \ + --name iamlive \ + -it iamlive \ + --mode proxy \ + --bind-addr 0.0.0.0:10080 \ + --force-wildcard-resource \ + --output-file "/app/iamlive.log" +# Runs in the background ... +``` + +Instruct tools that use AWS SDK, such as [aws-cli](https://aws.amazon.com/cli/) and [terraform](https://www.terraform.io/docs/cli/commands/index.html), to use the local proxy server - `iamlive` Docker container. + +```bash +export AWS_ACCESS_KEY_ID="AKIA_DUMMY_USER_ACCESS_KEY_ID" +export AWS_SECRET_ACCESS_KEY="DUMMY_USER_SECRET_ACCESS_KEY" + +export HTTP_PROXY=http://127.0.0.1:80 \ + HTTPS_PROXY=http://127.0.0.1:443 \ + AWS_CA_BUNDLE="${HOME}/.iamlive/ca.pem" +``` + +Copy the Certificate Authority Certificate (`ca.pem`) that was generated by the `iamlive` Docker container, to your local machine (Host). + +```bash +docker cp iamlive:/home/appuser/.iamlive/ ~/ +``` + +Test the local proxy server by invoking some `aws` command + +```bash +aws s3 ls +# Output +# An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied +``` + +Check the logs of the `iamlive` container, should look like this + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "s3:ListAllMyBuckets" + ], + "Resource": "*" + } + ] +} +``` + +It's important to mention that terraform init cannot be proxied via `iamlive` since it attempts to access [registry.terraform.io](registry.terraform.io), and it's not covered by `iamlive`. So first, unset the proxy settings, and then execute terraform init. Following that, execute `terraform apply` and check the logs of the `iamlive` container. + +```bash +unset HTTP_PROXY HTTPS_PROXY AWS_CA_BUNDLE +terraform init +# Terraform has been successfully initialized! + + +export AWS_ACCESS_KEY_ID="AKIA_DUMMY_USER_ACCESS_KEY_ID" +export AWS_SECRET_ACCESS_KEY="DUMMY_USER_SECRET_ACCESS_KEY" + +export HTTP_PROXY=http://127.0.0.1:80 \ + HTTPS_PROXY=http://127.0.0.1:443 \ + AWS_CA_BUNDLE="${HOME}/.iamlive/ca.pem" + +# In terraform-iamlive dir +terraform apply +``` + +To stop the `iamlive` Docker container hit `CTRL+C`. The `ca.pem` is preserved because the Docker container has stopped but wasn't removed. To re-run `iamlive` Docker container, execute the following command + +```bash +# Hit CTRL+C To stop the container + +docker start -i iamlive +# Keep it running in the background +``` + + #### SDKs To enable CSM in the various AWS SDKs, you can run the following in the window executing your application prior to it starting: From 0aac4b82cda7be0981766d77e0d618c3bda54501 Mon Sep 17 00:00:00 2001 From: Meir Gabay Date: Sat, 24 Apr 2021 00:28:18 +0300 Subject: [PATCH 5/7] updated docs --- README.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/README.md b/README.md index 2e3cdd0f..81567257 100644 --- a/README.md +++ b/README.md @@ -171,9 +171,6 @@ docker run \ Instruct tools that use AWS SDK, such as [aws-cli](https://aws.amazon.com/cli/) and [terraform](https://www.terraform.io/docs/cli/commands/index.html), to use the local proxy server - `iamlive` Docker container. ```bash -export AWS_ACCESS_KEY_ID="AKIA_DUMMY_USER_ACCESS_KEY_ID" -export AWS_SECRET_ACCESS_KEY="DUMMY_USER_SECRET_ACCESS_KEY" - export HTTP_PROXY=http://127.0.0.1:80 \ HTTPS_PROXY=http://127.0.0.1:443 \ AWS_CA_BUNDLE="${HOME}/.iamlive/ca.pem" @@ -217,10 +214,7 @@ unset HTTP_PROXY HTTPS_PROXY AWS_CA_BUNDLE terraform init # Terraform has been successfully initialized! - -export AWS_ACCESS_KEY_ID="AKIA_DUMMY_USER_ACCESS_KEY_ID" -export AWS_SECRET_ACCESS_KEY="DUMMY_USER_SECRET_ACCESS_KEY" - +# Instruct CLIs to use iamlive local proxy server export HTTP_PROXY=http://127.0.0.1:80 \ HTTPS_PROXY=http://127.0.0.1:443 \ AWS_CA_BUNDLE="${HOME}/.iamlive/ca.pem" From 1d1684ed14bc4622c179bc4ecb56f3fde19dc500 Mon Sep 17 00:00:00 2001 From: Meir Gabay Date: Sat, 24 Apr 2021 00:32:33 +0300 Subject: [PATCH 6/7] updated docs --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 81567257..b7c90a80 100644 --- a/README.md +++ b/README.md @@ -160,7 +160,7 @@ docker run \ -p 80:10080 \ -p 443:10080 \ --name iamlive \ - -it iamlive \ + -t iamlive \ --mode proxy \ --bind-addr 0.0.0.0:10080 \ --force-wildcard-resource \ @@ -207,7 +207,7 @@ Check the logs of the `iamlive` container, should look like this } ``` -It's important to mention that terraform init cannot be proxied via `iamlive` since it attempts to access [registry.terraform.io](registry.terraform.io), and it's not covered by `iamlive`. So first, unset the proxy settings, and then execute terraform init. Following that, execute `terraform apply` and check the logs of the `iamlive` container. +It's important to mention that `terraform init` cannot be proxied via `iamlive` since it attempts to access [registry.terraform.io](registry.terraform.io), and it's not covered by `iamlive`. So first, unset the proxy settings, and then execute `terraform init`. Following that, execute `terraform apply` and check the logs of the `iamlive` container. ```bash unset HTTP_PROXY HTTPS_PROXY AWS_CA_BUNDLE From 36986f7690dc273fc156a780d9f0405dbec8e238 Mon Sep 17 00:00:00 2001 From: Meir Gabay Date: Sat, 24 Apr 2021 14:54:38 +0300 Subject: [PATCH 7/7] final update to docs --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b7c90a80..ad1a6db7 100644 --- a/README.md +++ b/README.md @@ -160,7 +160,7 @@ docker run \ -p 80:10080 \ -p 443:10080 \ --name iamlive \ - -t iamlive \ + -it iamlive \ --mode proxy \ --bind-addr 0.0.0.0:10080 \ --force-wildcard-resource \