Command for encrypting using GCP KMS

.gitignore

@@ -1,3 +1,4 @@
 *.json
 charts
 bin
+.idea

app/cli/cli.go

@@ -5,6 +5,7 @@ import (
 	"github.com/dfernandezm/myiac/app/cluster"
 	"github.com/dfernandezm/myiac/app/deploy"
 	"github.com/dfernandezm/myiac/app/docker"
+	"github.com/dfernandezm/myiac/app/encryption"
 	"github.com/dfernandezm/myiac/app/gcp"
 	props "github.com/dfernandezm/myiac/app/properties"
 	"github.com/dfernandezm/myiac/app/util"
@@ -42,6 +43,8 @@ func BuildCli() {
 	deployApp := deployAppSetup(projectFlag, environmentFlag, propertiesFlag)
 	resizeClusterCmd := resizeClusterCmd(projectFlag, environmentFlag)
 	createSecretCmd := createSecretCmd(projectFlag, environmentFlag)
+	cryptCmd := cryptCmd(projectFlag)
+
 	app.Commands = []cli.Command{
 		setupEnvironment,
 		dockerSetup,
@@ -52,6 +55,7 @@ func BuildCli() {
 		installHelmCmd,
 		resizeClusterCmd,
 		createSecretCmd,
+		cryptCmd,
 	}
 
 	err := app.Run(os.Args)
@@ -60,6 +64,63 @@ func BuildCli() {
 	}
 }
 
+func cryptCmd(projectFlag *cli.StringFlag) cli.Command {
+	modeFlag := &cli.StringFlag{
+		Name: "mode, m",
+		Usage: "encrypt or decrypt",
+	}
+
+	filenameWithTextFlag := &cli.StringFlag{
+		Name: "filename, f",
+		Usage: "Location of file with plainText to encrypt or cipherText to decrypt. " +
+			"The CipherText will be written in a file with the " +
+			"same name ended with .enc, the plainText file will be written with same filename ending .dec",
+	}
+
+	return cli.Command{
+		Name:  "crypt",
+		Usage: "Encrypt or decrypt file contents",
+		Flags: []cli.Flag{
+			projectFlag,
+			modeFlag,
+			filenameWithTextFlag,
+		},
+		Action: func(c *cli.Context) error {
+			fmt.Printf("Validating flags for crypt \n")
+
+			_ = validateStringFlagPresence("project", c)
+			_ = validateStringFlagPresence("mode", c)
+			_ = validateStringFlagPresence("filename", c)
+
+			project := c.String("project")
+			mode := c.String("mode")
+			filename := c.String("filename")
+
+			gcp.SetupEnvironment(project)
+
+			keyRingName := fmt.Sprintf("%s-keyring", project)
+			keyName := fmt.Sprintf("%s-infra-key", project)
+			locationId := "global"
+			kmsEncrypter := gcp.NewKmsEncrypter(project, locationId, keyRingName, keyName)
+			encrypter := encryption.NewEncrypter(kmsEncrypter)
+
+			if mode != "encrypt" && mode != "decrypt" {
+				return cli.NewExitError("mode can only be 'encrypt' or 'decrypt'",-1)
+			}
+
+			if mode == "encrypt" {
+				encrypter.EncryptFileContents(filename)
+			}
+
+			if mode == "decrypt" {
+				encrypter.DecryptFileContents(filename)
+			}
+
+			return nil
+		},
+	}
+}
+
 func resizeClusterCmd(projectFlag *cli.StringFlag, environmentFlag *cli.StringFlag) cli.Command {
 	nodePoolsSizeFlag := &cli.StringFlag{Name: "nodePoolsSize, bp",
 		Usage: "Target size of all node pools"}
@@ -222,7 +283,7 @@ func dockerBuildCmd(projectFlag *cli.StringFlag) cli.Command {
 	appNameFlag := &cli.StringFlag{
 		Name: "app, a",
 		Usage: "The container to build. Should match a repo name in registry " +
-			"and a Helm chart folder naming convention (moneycol-server, moneycol-frontend...)"
+			"and a Helm chart folder naming convention (moneycol-server, moneycol-frontend...)",
 	}
 	buildPathFlag := &cli.StringFlag{Name: "buildPath, bp",
 		Usage: "The location of the Dockerfile"}

app/deploy/helm_test.go

@@ -70,6 +70,10 @@ func (mcr mockCommandRunner) Setup(executable string, args []string) {
 	mcr.arguments = args
 }
 
+func (mcr mockCommandRunner) IgnoreError(ignoreError bool) {
+
+}
+
 // https://quii.gitbook.io/learn-go-with-tests/
 // To run: go test -v
 func TestReleaseDeployed(t *testing.T) {

app/encryption/encrypter.go

@@ -0,0 +1,38 @@
+package encryption
+
+import "github.com/dfernandezm/myiac/app/util"
+
+type Encrypter interface {
+	Encrypt(plainText string) (string, error)
+	Decrypt(cipherText string) (string, error)
+}
+
+type encryptionService struct {
+	encrypter Encrypter
+}
+// NewEncryptionService create a new encrypter
+func NewEncrypter(encrypter Encrypter) *encryptionService {
+	enc := new(encryptionService)
+	enc.encrypter = encrypter
+	return enc
+}
+
+// EncryptFileContents encrypts the text contained in 'filename' and returns cipherText
+// into a file with the same name ended with '.enc'
+func (enc encryptionService) EncryptFileContents(filename string) string {
+	plainText, _ := util.ReadFileToString(filename)
+	cipherText, _ := enc.encrypter.Encrypt(plainText)
+	cipherTextFilename := filename + ".enc"
+	_ = util.WriteStringToFile(cipherText, cipherTextFilename)
+	return cipherTextFilename
+}
+
+// DecryptFileContents decrypts the ciphertext contained in 'filename' and returns the
+// plaintext result into another file with same name ended with '.dec'
+func (enc encryptionService) DecryptFileContents(filename string) string {
+	cipherText, _ := util.ReadFileToString(filename)
+	plainText, _ := enc.encrypter.Decrypt(cipherText)
+	plainTextFilename := filename + ".dec"
+	_ = util.WriteStringToFile(plainText, plainTextFilename)
+	return plainTextFilename
+}

app/gcp/dns_test.go

@@ -1,9 +1,8 @@
 package gcp
 
 import (
-	//"fmt"
-	"testing"
 	"github.com/stretchr/testify/assert"
+	"testing"
 )
 
 func TestCreateGCPDNSService(t *testing.T) {