def move_generated_fields_out_of_projects(input_yaml_path):
"""Move generated_fields out of projects."""
overall = utils.load_config(input_yaml_path)
if GENERATED_FIELDS_NAME in overall:
if is_old_generated_fields_format_exist(overall):
raise utils.InvalidConfigError(
'Generated fields conflict between new and old format.')
return False
convert_old_generated_fields_to_new(overall)
if GENERATED_FIELDS_NAME in overall:
if utils.wait_for_yes_no(
'Move generated_fields out of projects [y/N]?'):
utils.write_yaml_file(overall, input_yaml_path)
return True
return False
def create_stackdriver_account(config):
"""Prompts the user to create a new Stackdriver Account."""
# Creating a Stackdriver account cannot be done automatically, so ask the
# user to create one.
if 'stackdriver_alert_email' not in config.project:
logging.warning(
'No Stackdriver alert email specified, skipping creation '
'of Stackdriver account.')
return
logging.info('Creating Stackdriver account.')
project_id = config.project['project_id']
message = """
------------------------------------------------------------------------------
To create email alerts, this project needs a Stackdriver account.
Create a new Stackdriver account for this project by visiting:
https://console.cloud.google.com/monitoring?project={}
Only add this project, and skip steps for adding additional GCP or AWS
projects. You don't need to install Stackdriver Agents.
IMPORTANT: Wait about 5 minutes for the account to be created.
For more information, see: https://cloud.google.com/monitoring/accounts/
After the account is created, enter [Y] to continue, or enter [N] to skip the
creation of Stackdriver alerts.
------------------------------------------------------------------------------
""".format(project_id)
print(message)
# Keep trying until Stackdriver account is ready, or user skips.
while True:
if not utils.wait_for_yes_no('Account created [y/N]?'):
logging.warning('Skipping creation of Stackdriver Account.')
return
# Verify account was created.
try:
runner.run_gcloud_command(
['alpha', 'monitoring', 'policies', 'list'],
project_id=project_id)
return
except subprocess.CalledProcessError as e:
logging.error('Error reading Stackdriver account %s', e)
print('Could not find Stackdriver account.')
def create_stackdriver_account(config):
"""Prompts the user to create a new Stackdriver Account."""
# Creating a Stackdriver account cannot be done automatically, so ask the
# user to create one.
if 'stackdriver_alert_email' not in config.project:
logging.warning(
'No Stackdriver alert email specified, skipping creation '
'of Stackdriver account.')
return
project_id = config.project['project_id']
if _stackdriver_account_exists(project_id):
logging.info('Stackdriver account already exists')
return
message = """
------------------------------------------------------------------------------
To create email alerts, this project needs a Stackdriver account.
Create a new Stackdriver account for this project by visiting:
https://console.cloud.google.com/monitoring?project={}
Only add this project, and skip steps for adding additional GCP or AWS
projects. You don't need to install Stackdriver Agents.
IMPORTANT: Wait about 5 minutes for the account to be created.
For more information, see: https://cloud.google.com/monitoring/accounts/
After the account is created, enter [Y] to continue, or enter [N] to skip the
creation of Stackdriver alerts.
------------------------------------------------------------------------------
""".format(project_id)
print(message)
# Keep trying until Stackdriver account is ready, or user skips.
while True:
if not utils.wait_for_yes_no('Account created [y/N]?'):
logging.warning('Skipping creation of Stackdriver Account.')
break
if _stackdriver_account_exists(project_id):
break
def main(argv):
del argv # Unused.
if FLAGS.enable_new_style_resources:
logging.info('--enable_new_style_resources is true.')
FLAGS.output_yaml_path = utils.normalize_path(FLAGS.output_yaml_path)
FLAGS.output_cleanup_path = utils.normalize_path(FLAGS.output_cleanup_path)
if FLAGS.output_rules_path:
FLAGS.output_rules_path = utils.normalize_path(FLAGS.output_rules_path)
FLAGS.project_yaml = utils.normalize_path(FLAGS.project_yaml)
if field_generation.move_generated_fields_out_of_projects(FLAGS.project_yaml):
if FLAGS.dry_run:
logging.error(
'Must convert generated fields in nodry_run before running!')
return
elif not utils.wait_for_yes_no(
'Use converted generated fields to continue? [y/N]?'):
return
# Read and parse the project configuration YAML file.
root_config = utils.load_config(FLAGS.project_yaml)
if not root_config:
logging.error('Error loading project YAML.')
return
logging.info('Validating project YAML against schema.')
try:
utils.validate_config_yaml(root_config)
except jsonschema.exceptions.ValidationError as e:
logging.error('Error in YAML config: %s', e)
return
with open(FLAGS.output_cleanup_path, 'w') as f:
f.write(_CLEANUP_HEADER)
want_projects = set(FLAGS.projects)
def want_project(project_config_dict):
if not project_config_dict:
return False
return want_projects == {
'*'
} or project_config_dict['project_id'] in want_projects
projects = []
audit_logs_project = root_config.get('audit_logs_project')
# Always deploy the remote audit logs project first (if present).
if want_project(audit_logs_project):
projects.append(
ProjectConfig(
root=root_config,
project=audit_logs_project,
audit_logs_project=None,
extra_steps=[]))
forseti_config = root_config.get('forseti')
if forseti_config and want_project(forseti_config['project']):
extra_steps = [
Step(
func=install_forseti,
description='Install Forseti',
updatable=False,
),
get_forseti_access_granter_step(
forseti_config['project']['project_id']),
]
if audit_logs_project:
extra_steps.append(
get_forseti_access_granter_step(audit_logs_project['project_id']))
forseti_project_config = ProjectConfig(
root=root_config,
project=forseti_config['project'],
audit_logs_project=audit_logs_project,
extra_steps=extra_steps)
projects.append(forseti_project_config)
for project_config in root_config.get('projects', []):
if not want_project(project_config):
continue
extra_steps = []
if forseti_config:
extra_steps.append(
get_forseti_access_granter_step(project_config['project_id']))
projects.append(
ProjectConfig(
root=root_config,
project=project_config,
audit_logs_project=audit_logs_project,
extra_steps=extra_steps))
validate_project_configs(root_config['overall'], projects)
logging.info('Found %d projects to deploy', len(projects))
for config in projects:
logging.info('Setting up project %s', config.project['project_id'])
if not setup_project(config, FLAGS.project_yaml, FLAGS.output_yaml_path,
FLAGS.output_cleanup_path):
# Don't attempt to deploy additional projects if one project failed.
return
if forseti_config:
if FLAGS.enable_new_style_resources:
call = [
FLAGS.rule_generator_binary,
'--project_yaml_path',
FLAGS.project_yaml,
'--output_path',
FLAGS.output_rules_path or '',
]
logging.info('Running rule generator: %s', call)
subprocess.check_call(call)
else:
rule_generator.run(root_config, output_path=FLAGS.output_rules_path)
logging.info(
'All projects successfully deployed. Please remember to sync '
'any changes written to the config at --output_yaml_path with '
'--project_yaml before running the script again (Note: only applicable '
'if --output_yaml_path != --project_yaml)')
