Interviewee

task1_docker/Dockerfile

@@ -1,6 +1,20 @@
-FROM golang:1.19
+# Build Stage
+FROM golang:1.19 AS build
 WORKDIR /app
-COPY . .
+COPY go.mod ./
 RUN go mod download
-RUN go build -o /hello_world
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o /hello_world
+
+# Production Stage
+FROM scratch
+COPY --from=build /hello_world /hello_world
 ENTRYPOINT ["/hello_world"]
+
+
+#FROM golang:1.19
+#WORKDIR /app
+#COPY . .
+#RUN go mod download
+#RUN go build -o /hello_world
+#ENTRYPOINT ["/hello_world"]

task1_docker/README.md

@@ -2,24 +2,90 @@
 
 ### 1. Optimize Dockerfile (make it more lightweight)
 ```
-Type here what was done...
+To optimize it, it means I have to make the Dockerfile as lightweight
+as possible and the benefits to this is to reduce the attack area and
+improve the security of the overall application. The methods implemented involves:
+
+- Using a specific base image that matches the requirements of the 
+application in production
+
+- when using the COPY command, I made sure I copied the necessary files 
+for the building and running of the application
+
+- Combining the RUN command instead of using multiple RUN commands, 
+becasue these commands add an extra layer to the application
+
+- Finally using a multi-stage build
 
 ```
 
 ### 2. Do a multistage build
 ```
 Type here what was done...
 
+To create a multistage build technically mean creating a more than one 
+build so as to keep the Dockerfile optimized, easy to read and maintain.
+This is so because most times developers uses different Dockerfile for 
+build and production. To achieve this this is what i did:
+The multistage build consist of two stages, where each is defined with
+its own FROM statement
+
+- Build Stage 
+
+In this stage, I use an official Golang image as the base image and 
+give it an alias "build" ('FROM golang:1.19 AS build). 
+I set the  working directory to "./app", copy the go.mod files to 
+the container, and download the Go module dependencies using the "go 
+mod download". 
+I then copy the rest of the application code to the container and build 
+it using the "CGO_ENABLED=0 GOOS=linux go build" command with the 
+necessary flags to produce a statically linked binary executable ('/
+hello_world').
+Finally an optional case of using the strip command. The strip command
+can be used to remove the debug information from the executable, this 
+like i said is optional and not necessary.
+
+- Production Stage
+
+In this stage, I will start with a minimal 'scratch' base image, which
+contains no files or dependencies.
+I copied the '/hello_world' binary executable from the 'build' stage
+using the 'COPY --from=build' command which copies the file from the 
+'build' stage to the current stage.
+Finally, I will set the entry point to '/hello_world', which specifies
+the command to run when the container starts
 ```
 
 ### 3. Build, run and open in browser
 ```
-Type here the command you used to build and run the container...
+To do this we will run the following command
+
+- docker build -t go_app .
+- docker run -p 8060:8060 go_app
+
+To open in browser, I will access http:/localhost:8060/helloworld
 
 ```
 
+![](image.png)
+
+
 ### 4. Tag it with :v1.0.0 and :latest and push the image to your DockerHub or Github Packages repository
 ```
-Type here the public image URL
+For (:v1.0.0):
+- docker build -t galactican/go_app:v1.0.0 .
+- docker push galactican/go_app:v1.0.0
+
+```
+[Docker image for v1.0.0](https://hub.docker.com/layers/galactican/go_app/v1.0.0/images/sha256:4805a5a50105f82ec9563b118757084608a565760e64281bac93f8c3370882cd)
 
 ```
+For (:latest)
+- docker build -t galactican/go_app:latest .
+- docker push galactican/go_app:latest
+
+```
+[Docker image for :latest](https://hub.docker.com/layers/galactican/go_app/latest/images/sha256:4805a5a50105f82ec9563b118757084608a565760e64281bac93f8c3370882cd)
+
+
+![](image2.png)

task2_vault/README.md

@@ -19,14 +19,23 @@
 Look for TODO comment in the tf config. Don't modify existing resources.\
 Check if the container is able to read and print the secret or still produces errors: `docker logs -f service-alpha`.
 ```
-Type here what was done...
 
+I created a new policy called service-alpha-policy as showned in the script. 
+The policy explains that the created secrets engine will have a read permission. 
+Meaning that every key implemented in that directory can be read when they are required
 ```
 
 ### 2. Split the terraform config into 2 modules.
 One for building/deploying the service, another for managing vault resources.\
 Use variables.
 ```
-Type here what was done...
+
+I splitted the configuration into two modules, where one of the modules 'service-alpha' is
+responsible for building and deploying the service alpha container
+
+The other module 'vault-resources' is responsible for managing resources meant by vault  which
+may include 'vault_generic_secret, vault_auth_backend, vault_policy, and vault_userpass_user'
+
+Both of these modules can then be used within the 'main.tf' and reference appropriately 
 
 ```

task2_vault/tf/main.tf

@@ -1,3 +1,16 @@
+# This is the main terraform script used for implemeneting the module created
+
+module "service-alpha" {
+  source = "./service-alpha"
+}
+
+module "vault" {
+  source = "./vault"
+}
+
+
+
+/**
 terraform {
   required_version = ">= 1.1.0"
 
@@ -47,10 +60,24 @@ resource "vault_auth_backend" "userpass" {
 
 # TODO: Add missing users and policies
 
+# policy for the service-alpha container
+resource "vault_policy" "service-alpha-policy" {
+  name        = "service-alpha-policy"
+  policy      = <<EOT
+path "secret/alpha" {
+  capabilities = ["read"]
+}
+EOT
+}
 
-
-
-
+# user with the above policy
+resource "vault_userpass_user" "service-account" {
+  username = "interviewee"
+  password = "pass99"
+  policies = [
+    vault_policy.service-alpha-policy.name
+  ]
+}
 
 ###############################
 # Build and run service-alpha
@@ -79,3 +106,5 @@ resource "docker_container" "service-alpha" {
     name = "task2_vault_net_a"
   }
 }
+
+**/

task2_vault/tf/service-alpha.tf

@@ -0,0 +1,39 @@
+# This module is responsible for building and deploying the service-alpha container.
+
+terraform {
+  required_version = ">= 1.1.0"
+
+  required_providers {
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "3.0.2"
+    }
+  }
+}
+
+# Build and run service-alpha
+resource "docker_image" "service-alpha" {
+  name = "service-alpha"
+
+  build {
+    context = "../services/alpha"
+    tag     = ["service-alpha"]
+  }
+  triggers = {
+    dir_sha1 = sha1(join("", [for f in fileset(path.module, "../services/alpha/*") : filesha1(f)]))
+  }
+}
+
+resource "docker_container" "service-alpha" {
+  image = docker_image.service-alpha.image_id
+  name  = "service-alpha"
+
+  env = [
+    "VAULT_ADDR=http://vault:8200",
+    "VAULT_USERNAME=service-account-1",
+    "VAULT_PASSWORD=pass99",
+  ]
+  networks_advanced {
+    name = "task2_vault_net_a"
+  }
+}

task2_vault/tf/vault-resources.tf

@@ -0,0 +1,54 @@
+# This module is reponsible for managing service in vault that is required by service-alpha
+
+terraform {
+  required_version = ">= 1.1.0"
+
+  required_providers {
+    vault = {
+      version = "3.14.0"
+    }
+  }
+}
+
+# Connect to vault server
+# (deployed by docker-compose)
+provider "vault" {
+  address = "http://localhost:8200"
+  token   = "f23612cf-824d-4206-9e94-e31a6dc8ee8d"
+}
+
+# This secret must be read by the service
+resource "vault_generic_secret" "alpha" {
+  path      = "secret/alpha"
+  data_json = <<EOT
+{
+  "smiling_face": "( ͡° ͜ʖ ͡°)",
+  "bear": "ʕ•ᴥ•ʔ"
+}
+EOT
+}
+
+# Enable user-pass auth method
+resource "vault_auth_backend" "userpass" {
+  type = "userpass"
+}
+
+# policy for the service-alpha container
+resource "vault_policy" "service-alpha-policy" {
+  name        = "service-alpha-policy"
+  policy      = <<EOT
+path "secret/alpha" {
+  capabilities = ["read"]
+}
+EOT
+}
+
+# user with the above policy
+resource "vault_userpass_user" "service-account" {
+  username = "service-account-1"
+  password = "pass99"
+  policies = [
+    vault_policy.service-alpha-policy.name
+  ]
+}
+