Skip to content

Commit

Permalink
Merge pull request #1498 from OctopusDeploy/update-mysql-templates
Browse files Browse the repository at this point in the history 
Adding ability to add additional parameters to connection string and …
  • Loading branch information
@harrisonmeister
harrisonmeister authored Mar 26, 2024
2 parents b4cd060 + 8a4fcca commit 9f78c70
Show file tree
Hide file tree
Showing 3 changed files with 44 additions and 14 deletions.
22 changes: 16 additions & 6 deletions step-templates/mysql-add-database-user-to-role.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,13 @@
"Description": "Adds a database user to a role",
"Author": "twerthi",
"ActionType": "Octopus.Script",
"Version": 6,
"Version": 7,
"CommunityActionTemplateId": null,
"Packages": [],
"Properties": {
"Octopus.Action.Script.ScriptSource": "Inline",
"Octopus.Action.Script.Syntax": "PowerShell",
"Octopus.Action.Script.ScriptBody": "# Define functions\nfunction Get-ModuleInstalled\n{\n # Define parameters\n param(\n $PowerShellModuleName\n )\n\n # Check to see if the module is installed\n if ($null -ne (Get-Module -ListAvailable -Name $PowerShellModuleName))\n {\n # It is installed\n return $true\n }\n else\n {\n # Module not installed\n return $false\n }\n}\n\nfunction Install-PowerShellModule\n{\n # Define parameters\n param(\n $PowerShellModuleName,\n $LocalModulesPath\n )\n\n\t# Check to see if the package provider has been installed\n if ((Get-NugetPackageProviderNotInstalled) -ne $false)\n {\n \t# Display that we need the nuget package provider\n Write-Host \"Nuget package provider not found, installing ...\"\n \n # Install Nuget package provider\n Install-PackageProvider -Name Nuget -Force\n }\n\n\t# Save the module in the temporary location\n Save-Module -Name $PowerShellModuleName -Path $LocalModulesPath -Force\n}\n\nfunction Get-NugetPackageProviderNotInstalled\n{\n\t# See if the nuget package provider has been installed\n return ($null -eq (Get-PackageProvider -ListAvailable -Name Nuget -ErrorAction SilentlyContinue))\n}\n\nfunction Get-UserInRole\n{\n\t# Define parameters\n param ($UserHostname,\n $Username,\n $RoleHostName,\n $RoleName)\n \n\t# Execute query\n $grants = Invoke-SqlQuery \"SHOW GRANTS FOR '$Username'@'$UserHostName';\"\n\n # Loop through Grants\n foreach ($grant in $grants.ItemArray)\n {\n # Check grant\n if ($grant -eq \"GRANT ``$RoleName``@``$RoleHostName`` TO ``$Username``@``$UserHostName``\")\n {\n # They're in the group\n return $true\n }\n }\n\n # Not found\n return $false\n}\n\n# Define PowerShell Modules path\n$LocalModules = (New-Item \"$PSScriptRoot\\Modules\" -ItemType Directory -Force).FullName\n$env:PSModulePath = \"$LocalModules$([System.IO.Path]::PathSeparator)$env:PSModulePath\"\n$PowerShellModuleName = \"SimplySql\"\n\n# Set secure protocols\n[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls11 -bor [System.Net.SecurityProtocolType]::Tls12\n\n# Check to see if SimplySql module is installed\nif ((Get-ModuleInstalled -PowerShellModuleName $PowerShellModuleName) -ne $true)\n{\n # Tell user what we're doing\n Write-Output \"PowerShell module $PowerShellModuleName is not installed, downloading temporary copy ...\"\n\n # Install temporary copy\n Install-PowerShellModule -PowerShellModuleName $PowerShellModuleName -LocalModulesPath $LocalModules\n}\n\n# Display\nWrite-Output \"Importing module $PowerShellModuleName ...\"\n\n# Check to see if it was downloaded\nif ((Test-Path -Path \"$LocalModules\\$PowerShellModuleName\") -eq $true)\n{\n\t# Import from specific location\n $PowerShellModuleName = \"$LocalModules\\$PowerShellModuleName\"\n}\n\n# Declare connection string\n$connectionString = \"Server=$addMySQLServerName;Port=$addMySQLServerPort;\"\n\n# Customize connection string based on authentication method\nswitch ($mySqlAuthenticationMethod) {\n \"awsiam\" {\n # Region is part of the RDS endpoint, extract\n $region = ($addMySQLServerName.Split(\".\"))[2]\n\n Write-Host \"Generating AWS IAM token ...\"\n $addLoginPasswordWithAddRoleRights = (aws rds generate-db-auth-token --hostname $addMySQLServerName --region $region --port $addMySQLServerPort --username $addLoginWithAddRoleRights)\n \n # Append remaining portion of connection string\n $connectionString += \";Uid=$addLoginWithAddRoleRights;Pwd=`\"$addLoginPasswordWithAddRoleRights`\";\"\n\n break\n }\n\n \"usernamepassword\" {\n # Append remaining portion of connection string\n $connectionString += \";Uid=$addLoginWithAddRoleRights;Pwd=`\"$addLoginPasswordWithAddRoleRights`\";\"\n \n break \n }\n\n \"windowsauthentication\" {\n # Append remaining portion of connection string\n $connectionString += \";IntegratedSecurity=yes;Uid=$addLoginWithAddRoleRights;\"\n\n break\n }\n\n \"azuremanagedidentity\" {\n Write-Host \"Generating Azure Managed Identity token ...\"\n $token = Invoke-RestMethod -Method GET -Uri \"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://ossrdbms-aad.database.windows.net\" -Headers @{\"MetaData\" = \"true\" }\n\n $addLoginPasswordWithAddRoleRights = $token.access_token\n\n $connectionString += \";Uid=$addLoginWithAddRoleRights;Pwd=`\"$addLoginPasswordWithAddRoleRights`\";\"\n\n break\n }\n\n \"gcpserviceaccount\" {\n # Define header\n $header = @{ \"Metadata-Flavor\" = \"Google\" }\n\n # Retrieve service accounts\n $serviceAccounts = Invoke-RestMethod -Method Get -Uri \"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/\" -Headers $header\n\n # Results returned in plain text format, get into array and remove empty entries\n $serviceAccounts = $serviceAccounts.Split([Environment]::NewLine, [StringSplitOptions]::RemoveEmptyEntries)\n\n # Retreive the specific service account assigned to the VM\n $serviceAccount = $serviceAccounts | Where-Object { $_.Contains(\"iam.gserviceaccount.com\") }\n\n if ([string]::IsNullOrWhiteSpace(($addLoginWithAddRoleRights))) {\n $addLoginWithAddRoleRights = $serviceAccount.SubString(0, $serviceAccount.IndexOf(\".gserviceaccount.com\"))\n }\n\n Write-Host \"Generating GCP IAM token ...\"\n # Retrieve token for account\n $token = Invoke-RestMethod -Method Get -Uri \"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/$serviceAccount/token\" -Headers $header\n \n $addLoginPasswordWithAddRoleRights = $token.access_token\n $connectionString += \";Uid=$addLoginWithAddRoleRights;Pwd=`\"$addLoginPasswordWithAddRoleRights`\";\"\n\n break\n }\n}\n\n\n# Import the module\nImport-Module -Name $PowerShellModuleName\n\ntry\n{\n if ($addUseSSL -eq \"True\")\n {\n \t# Append to connection string\n $connectionString += \"SslMode=Required;\"\n }\n else\n {\n \t# Disable SSL\n $connectionString += \"SslMode=none;\"\n }\n \n Open-MySqlConnection -ConnectionString $connectionString\n \n\n # See if database exists\n $userInRole = Get-UserInRole -UserHostname $addUserHostname -Username $addUsername -RoleHostName $addRoleHostName -RoleName $addRoleName\n\n if ($userInRole -eq $false)\n {\n # Create database\n Write-Output \"Adding user $addUsername@$addUserHostName to role $addRoleName@$addRoleHostName ...\"\n $executionResults = Invoke-SqlUpdate \"GRANT '$addRoleName'@'$addRoleHostName' TO '$addUsername'@'$addUserHostName';\"\n\n # See if it was created\n $userInRole = Get-UserInRole -UserHostname $addUserHostname -Username $addUsername -RoleHostName $addRoleHostName -RoleName $addRoleName\n \n # Check array\n if ($userInRole -eq $true)\n {\n # Success\n Write-Output \"$addUserName@$addUserHostName added to $addRoleName@$addRoleHostName successfully!\"\n }\n else\n {\n # Failed\n Write-Error \"Failure adding $addUserName@$addUserHostName to $addRoleName@$addRoleHostName!\"\n }\n }\n else\n {\n \t# Display message\n Write-Output \"User $addUsername@$addUserHostName is already in role $addRoleName@$addRoleHostName\"\n }\n}\nfinally\n{\n Close-SqlConnection\n}\n"
"Octopus.Action.Script.ScriptBody": "# Define variables\n$connectionName = \"OctopusDeploy\"\n\n# Define functions\nfunction Get-ModuleInstalled\n{\n # Define parameters\n param(\n $PowerShellModuleName\n )\n\n # Check to see if the module is installed\n if ($null -ne (Get-Module -ListAvailable -Name $PowerShellModuleName))\n {\n # It is installed\n return $true\n }\n else\n {\n # Module not installed\n return $false\n }\n}\n\nfunction Install-PowerShellModule\n{\n # Define parameters\n param(\n $PowerShellModuleName,\n $LocalModulesPath\n )\n\n\t# Check to see if the package provider has been installed\n if ((Get-NugetPackageProviderNotInstalled) -ne $false)\n {\n \t# Display that we need the nuget package provider\n Write-Host \"Nuget package provider not found, installing ...\"\n \n # Install Nuget package provider\n Install-PackageProvider -Name Nuget -Force\n }\n\n\t# Save the module in the temporary location\n Save-Module -Name $PowerShellModuleName -Path $LocalModulesPath -Force\n}\n\nfunction Get-NugetPackageProviderNotInstalled\n{\n\t# See if the nuget package provider has been installed\n return ($null -eq (Get-PackageProvider -ListAvailable -Name Nuget -ErrorAction SilentlyContinue))\n}\n\nfunction Get-UserInRole\n{\n\t# Define parameters\n param ($UserHostname,\n $Username,\n $RoleHostName,\n $RoleName)\n \n\t# Execute query\n $grants = Invoke-SqlQuery \"SHOW GRANTS FOR '$Username'@'$UserHostName';\" -ConnectionName $connectionName\n\n # Loop through Grants\n foreach ($grant in $grants.ItemArray)\n {\n # Check grant\n if ($grant -eq \"GRANT ``$RoleName``@``$RoleHostName`` TO ``$Username``@``$UserHostName``\")\n {\n # They're in the group\n return $true\n }\n }\n\n # Not found\n return $false\n}\n\n# Define PowerShell Modules path\n$LocalModules = (New-Item \"$PSScriptRoot\\Modules\" -ItemType Directory -Force).FullName\n$env:PSModulePath = \"$LocalModules$([System.IO.Path]::PathSeparator)$env:PSModulePath\"\n$PowerShellModuleName = \"SimplySql\"\n\n# Set secure protocols\n[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls11 -bor [System.Net.SecurityProtocolType]::Tls12\n\n# Check to see if SimplySql module is installed\nif ((Get-ModuleInstalled -PowerShellModuleName $PowerShellModuleName) -ne $true)\n{\n # Tell user what we're doing\n Write-Output \"PowerShell module $PowerShellModuleName is not installed, downloading temporary copy ...\"\n\n # Install temporary copy\n Install-PowerShellModule -PowerShellModuleName $PowerShellModuleName -LocalModulesPath $LocalModules\n}\n\n# Display\nWrite-Output \"Importing module $PowerShellModuleName ...\"\n\n# Check to see if it was downloaded\nif ((Test-Path -Path \"$LocalModules\\$PowerShellModuleName\") -eq $true)\n{\n\t# Import from specific location\n $PowerShellModuleName = \"$LocalModules\\$PowerShellModuleName\"\n}\n\n# Declare connection string\n$connectionString = \"Server=$addMySQLServerName;Port=$addMySQLServerPort;\"\n\n# Customize connection string based on authentication method\nswitch ($mySqlAuthenticationMethod) {\n \"awsiam\" {\n # Region is part of the RDS endpoint, extract\n $region = ($addMySQLServerName.Split(\".\"))[2]\n\n Write-Host \"Generating AWS IAM token ...\"\n $addLoginPasswordWithAddRoleRights = (aws rds generate-db-auth-token --hostname $addMySQLServerName --region $region --port $addMySQLServerPort --username $addLoginWithAddRoleRights)\n \n # Append remaining portion of connection string\n $connectionString += \";Uid=$addLoginWithAddRoleRights;Pwd=`\"$addLoginPasswordWithAddRoleRights`\";\"\n\n break\n }\n\n \"usernamepassword\" {\n # Append remaining portion of connection string\n $connectionString += \";Uid=$addLoginWithAddRoleRights;Pwd=`\"$addLoginPasswordWithAddRoleRights`\";\"\n \n break \n }\n\n \"windowsauthentication\" {\n # Append remaining portion of connection string\n $connectionString += \";IntegratedSecurity=yes;Uid=$addLoginWithAddRoleRights;\"\n\n break\n }\n\n \"azuremanagedidentity\" {\n Write-Host \"Generating Azure Managed Identity token ...\"\n $token = Invoke-RestMethod -Method GET -Uri \"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://ossrdbms-aad.database.windows.net\" -Headers @{\"MetaData\" = \"true\" }\n\n $addLoginPasswordWithAddRoleRights = $token.access_token\n\n $connectionString += \";Uid=$addLoginWithAddRoleRights;Pwd=`\"$addLoginPasswordWithAddRoleRights`\";\"\n\n break\n }\n\n \"gcpserviceaccount\" {\n # Define header\n $header = @{ \"Metadata-Flavor\" = \"Google\" }\n\n # Retrieve service accounts\n $serviceAccounts = Invoke-RestMethod -Method Get -Uri \"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/\" -Headers $header\n\n # Results returned in plain text format, get into array and remove empty entries\n $serviceAccounts = $serviceAccounts.Split([Environment]::NewLine, [StringSplitOptions]::RemoveEmptyEntries)\n\n # Retreive the specific service account assigned to the VM\n $serviceAccount = $serviceAccounts | Where-Object { $_.Contains(\"iam.gserviceaccount.com\") }\n\n if ([string]::IsNullOrWhiteSpace(($addLoginWithAddRoleRights))) {\n $addLoginWithAddRoleRights = $serviceAccount.SubString(0, $serviceAccount.IndexOf(\".gserviceaccount.com\"))\n }\n\n Write-Host \"Generating GCP IAM token ...\"\n # Retrieve token for account\n $token = Invoke-RestMethod -Method Get -Uri \"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/$serviceAccount/token\" -Headers $header\n \n $addLoginPasswordWithAddRoleRights = $token.access_token\n $connectionString += \";Uid=$addLoginWithAddRoleRights;Pwd=`\"$addLoginPasswordWithAddRoleRights`\";\"\n\n break\n }\n}\n\n\n# Import the module\nImport-Module -Name $PowerShellModuleName\n\ntry\n{\n if ($addUseSSL -eq \"True\")\n {\n \t# Append to connection string\n $connectionString += \"SslMode=Required;\"\n }\n else\n {\n \t# Disable SSL\n $connectionString += \"SslMode=none;\"\n }\n \n if (![string]::IsNullOrWhitespace($mysqlAdditionalParameters))\n {\n foreach ($parameter in $mysqlAdditionalParameters.Split(\",\"))\n {\n # Check for delimiter\n if (!$connectionString.EndsWith(\";\") -and !$parameter.StartsWith(\";\"))\n {\n # Append delimeter\n $connectionString +=\";\"\n }\n\n $connectionString += $parameter.Trim()\n }\n }\n \n \n Open-MySqlConnection -ConnectionString $connectionString -ConnectionName $connectionName\n \n\n # See if database exists\n $userInRole = Get-UserInRole -UserHostname $addUserHostname -Username $addUsername -RoleHostName $addRoleHostName -RoleName $addRoleName\n\n if ($userInRole -eq $false)\n {\n # Create database\n Write-Output \"Adding user $addUsername@$addUserHostName to role $addRoleName@$addRoleHostName ...\"\n $executionResults = Invoke-SqlUpdate \"GRANT '$addRoleName'@'$addRoleHostName' TO '$addUsername'@'$addUserHostName';\" -ConnectionName $connectionName\n\n # See if it was created\n $userInRole = Get-UserInRole -UserHostname $addUserHostname -Username $addUsername -RoleHostName $addRoleHostName -RoleName $addRoleName\n \n # Check array\n if ($userInRole -eq $true)\n {\n # Success\n Write-Output \"$addUserName@$addUserHostName added to $addRoleName@$addRoleHostName successfully!\"\n }\n else\n {\n # Failed\n Write-Error \"Failure adding $addUserName@$addUserHostName to $addRoleName@$addRoleHostName!\"\n }\n }\n else\n {\n \t# Display message\n Write-Output \"User $addUsername@$addUserHostName is already in role $addRoleName@$addRoleHostName\"\n }\n}\nfinally\n{\n\t# Close connection if open\n if ((Test-SqlConnection -ConnectionName $connectionName) -eq $true)\n {\n \tClose-SqlConnection -ConnectionName $connectionName\n }\n}\n"
},
"Parameters": [
{
Expand Down Expand Up @@ -113,14 +113,24 @@
"Octopus.ControlType": "Select",
"Octopus.SelectOptions": "awsiam|AWS IAM\nusernamepassword|Username/password\nwindowsauthentication|Windows Authentication\nazuremanagedidentity|Azure Managed Identity\ngcpserviceaccount|GCP IAM"
}
},
{
"Id": "a97452b5-f7ef-4b72-ab2f-b440cda16343",
"Name": "mysqlAdditionalParameters",
"Label": "Additional connection string parameters",
"HelpText": "A comma-delimited list of additional parameters to add to the connection string. ex `AllowPublicKeyRetrieval=True`\"",
"DefaultValue": "",
"DisplaySettings": {
"Octopus.ControlType": "SingleLineText"
}
}
],
"StepPackageId": "Octopus.Script",
"LastModifiedBy": "coryreid",
"LastModifiedBy": "twerthi",
"$Meta": {
"ExportedAt": "2022-06-20T15:05:10.618Z",
"OctopusVersion": "2022.3.349-hotfix.1272",
"Type": "ActionTemplate"
"ExportedAt": "2024-03-22T16:19:47.074Z",
"OctopusVersion": "2024.1.12087",
"Type": "ActionTemplate"
},
"Category": "mysql"
}
Loading

0 comments on commit 9f78c70

Please sign in to comment.