From 3a516d92aa8f08976ddfcc4ab986205d17339659 Mon Sep 17 00:00:00 2001
From: Mike Malone <mjmalone@gmail.com>
Date: Wed, 6 Feb 2019 13:56:33 -0800
Subject: [PATCH] check for permissions init autocert deploy script

---
 autocert/init/autocert.sh | 80 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 75 insertions(+), 5 deletions(-)

diff --git a/autocert/init/autocert.sh b/autocert/init/autocert.sh
index f6dbb560..31f31790 100755
--- a/autocert/init/autocert.sh
+++ b/autocert/init/autocert.sh
@@ -1,16 +1,83 @@
 #!/bin/bash
 
 #set -x
-set -e
 
-echo "Welcome to Autocert configuration. Press any key to begin."
+echo "Welcome to Autocert configuration. Press return to begin."
 read ANYKEY
 
+
 STEPPATH=/home/step/.step
 
 CA_PASSWORD=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32 ; echo '')
 AUTOCERT_PASSWORD=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32 ; echo '')
 
+echo -e "\e[1mChecking cluster permissions...\e[0m"
+
+function permission_error {
+  # TODO: Figure out the actual service account instead of assuming default.
+  echo
+  echo -e "\033[0;31mPERMISSION ERROR\033[0m"
+  echo "Set permissions by running the following command, then try again:"
+  echo -e "\e[1m"
+  echo "    kubectl create clusterrolebinding autocert-init-binding \\"
+  echo "      --clusterrole cluster-admin \\"
+  echo "      --user \"system:serviceaccount:default:default\""
+  echo -e "\e[0m"
+  echo "Once setup is complete you can remove this binding by running:"
+  echo -e "\e[1m"
+  echo "    kubectl delete clusterrolebinding autocert-init-binding"
+  echo -e "\e[0m"
+
+  exit 1
+}
+
+echo -n "Checking for permission to create step namespace: "
+kubectl auth can-i create namespaces
+if [ $? -ne 0 ]; then
+    permission_error "create step namespace"
+fi
+
+echo -n "Checking for permission to create configmaps in step namespace: "
+kubectl auth can-i create configmaps --namespace step
+if [ $? -ne 0 ]; then
+    permission_error "create configmaps"
+fi
+
+echo -n "Checking for permission to create secrets in step namespace: "
+kubectl auth can-i create secrets --namespace step
+if [ $? -ne 0 ]; then
+    permission_error "create secrets"
+fi
+
+echo -n "Checking for permission to create deployments in step namespace: "
+kubectl auth can-i create deployments --namespace step
+if [ $? -ne 0 ]; then
+    permission_error "create deployments"
+fi
+
+echo -n "Checking for permission to create services in step namespace: "
+kubectl auth can-i create services --namespace step
+if [ $? -ne 0 ]; then
+    permission_error "create services"
+fi
+
+echo -n "Checking for permission to create cluster role: "
+kubectl auth can-i create clusterrole
+if [ $? -ne 0 ]; then
+    permission_error "create cluster roles"
+fi
+
+echo -n "Checking for permission to create cluster role binding:"
+kubectl auth can-i create clusterrolebinding
+if [ $? -ne 0 ]; then
+    permission_error "create cluster role bindings"
+    exit 1
+fi
+
+# Setting this here on purpose, after the above section which explicitly checks
+# for and handles exit errors.
+set -e
+
 step ca init \
   --name "$CA_NAME" \
   --dns "$CA_DNS" \
@@ -84,11 +151,14 @@ webhooks:
         autocert.step.sm: enabled
 EOF
 
+FINGERPRINT=$(step certificate fingerprint $(step path)/certs/root_ca.crt)
+
 echo
 echo -e "\e[1mAutocert installed!\e[0m"
 echo
-echo "Store these passwords somewhere safe:"
-echo "  CA & admin provisioner password: $CA_PASSWORD"
-echo "  Autocert password: $AUTOCERT_PASSWORD"
+echo "Store this information somewhere safe:"
+echo "  CA & admin provisioner password: ${CA_PASSWORD}"
+echo "  Autocert password: ${AUTOCERT_PASSWORD}"
+echo "  CA Fingerprint: ${FINGERPRINT}"
 echo