outbit / bandicoot

UI for the Data Center and Cloud.

bandicoot

bandicoot provides a simple UI for orchestrating changes or applying configurations in a datacenter and cloud environment. bandicoot provides a layer on top of Ansible that allows you to easily wrap up automated tasks and provide a simple way to execute them. The role based access control allows you to implement seperations of duties and limit specific actions to be executed by specific roles. The logging feature allows you to track the history of changes in the environment.

Installation

Install bandicoot client only. This is if you already have a dedicated bandicoot api server.

$ pip install bandicoots

Install bandicoot api server.

$ pip install bandicoots
$ sudo bandicoot-api-install

Install and Starting the bandicoot api server using Docker.

$ docker pull outbit/bandicoot
$ docker run -d -p 8088:8088 -p 80:80 -p 443:443 outbit/bandicoot

Usage

Start the API server on your localhost or on a dedicated IP. If your using the Docker container then make sure you have pulled the image and have run the image using the above example.

$ bandicoot-api -s 127.0.0.1 --insecure

Login to the bandicoot shell. On the first login you will be prompted to change the default password. If your using the Docker container you can remove the "--insecure" flag since by default its configured to use ssl. If you are using valid ssl certificates and not self signed certificates you can also remove the “-–no-check-certificates” flag.

$ bandicoot -u superadmin -s 127.0.0.1 --insecure --no-check-certificates
  Password: superadmin
  Changing Password From Default
  Enter New Password: **********
  Enter New Password Again: **********

Example of adding a "hello world" action that prints hello world.

bandicoot> help
  actions [list|del|edit|add]
  users [list|del|edit|add]
  roles [list|del|edit|add]
  secrets [list|del|edit|add|encryptpw]
  plugins [list]
  help [*]
  jobs [list|status|kill]
  schedules [add|edit|list|del]
  inventory [list|del]
  ping
  logs
  help
  stats
  exit

bandicoot> actions add name=helloworld category=/hello action=world plugin=command desc="print hello world" command_run="echo 'hello world'"

bandicoot> help
  actions [list|del|edit|add]
  users [list|del|edit|add]
  roles [list|del|edit|add]
  secrets [list|del|edit|add|encryptpw]
  plugins [list]
  help [*]
  jobs [list|status|kill]
  schedules [add|edit|list|del]
  inventory [list|del]
  ping
  logs
  help
  stats
  hello [world]
  exit

bandicoot> hello world
  hello world
  return code: 0

bandicoot> exit

License

bandicoot is released under the MIT License.

Author

David Whiteside ([email protected])

bandicoot's Issues

change var character set to think about common password characters that might need to be entered

syntax error should not be fatal

do not store sensitive information in audit log.

Such as passwords or secrets.

add option ssl_verify, that can be set from cli and config

Syntax errors should output a message declaring its a syntax error

Currently you get "action not known"

allow options passed to an action

allow options passed to an action, to resolve in the action dict. if an action was defined to use limit={{option.limit}}, this should be definable through options in limit=something.

For example:
outbit> actions add category=/services/webserver action=restart plugin=ansible source_url=”git://...” git_login={{ gitlogin }} git_key={{ gitkey }} playbook=test.yml sudo=yes user={{ login.name }} private-key={{ login.key }} limit={{ option.limit }}

should be usable where the limit is set to testservers
outbit> services webserver restart limit=testservers

jobs should include user who ran it, time it started, time it ended, what action ran and with what options.

Add ssl support

updated readme with license, description, new usage examples, and author.

write and use options_required decorator throughout all plugins

Use options_validator as a reference.

exit is not listed in help output

for every action that has an add, make sure you can edit

Add ability an edit action to every category (users, roles, actions).

action schedules - ability to set a schedule for an action

Make superadmin password change enforced on first login

On the first login with the default password, make it so the user is forced to change the password to something unique.

refactor the api code so its seperates the rest api, plugins, and api-cli

Automate install of api server with outbit-api-install

Automate for Mac, CentOS, and Debian.

write plugin for integration with ansible

write and use options_supported decorator

Use options_validator decorator as an example. This would provide a standard way to error if an unsupported option is provided, not all plugins would implement but its very useful for some.

keep inventory and what was run on the inventory

jobs should be preserved in db

Currently its just in memory it should be preserved in the mongodb

Make coverage of unit tests cover at least 70% of the code

store result of action in audit log.

secrets should have a type=file or type=text

If secret type=file, create a temporary file, set the variable to the temp filename when rendering. decrypt the secret and put it in the file. Delete the temporary file when the plugin is finished.

This is to support the ability to run the following:
outbit> actions add category=/testing/ action=ssh plugin=command command_run=”ssh -i {{secret.sshkey}} {{ option.host }}” desc="testing"

Make role permissions work

Add the ability for role permissions to be modified.
Add the ability to add users to a role.
Add the ability to add actions to a role.
Configure a default role that is a super role, that has permission to everything.
Make it so roles are enforced.

remove debug output for unknown keystroke

actions add and edit should validate characters for a category and action name

[a-zA-Z0-9_-/]+ is only supported for the category. and [a-zA-Z0-9_-]+ for the action.

-David

empty line as input causes exception

add ability to specify ssl key location via command line or config on apiserver

password allowed in .outbit.conf.

Add support to "ctrl-r" and search for last command

Its a standard bashism

ldap integration

outbit should integrate with ldap for authentication

Make plugins loadable from external python files

Look in ./lib/outbit/modules/ and user defined locations in the configuration file or a param through commandline.

-David

use options_validator decorator on more plugins

Not all plugins should allow the full range of values the lexer allows, each plugin should do some of its own validation.

Add support to "up arrow" the last command(s)

Standard feature for CLI

add ability to define secrets and use secrets in variables in outbit

you should be able to use secret variables throughout the outbit cli.
you should be able to define secrets as being a file or just text used inline.
if its a file it will write it to a temporary file when the plugin is executed and the variable will resolve to its path.
if its text, i will use jinja2 to parse the options string to the plugin and it will fill in the secret variables with the actual secret.
secrets will be integrated with roles so they can be shared with specific users.
secrets should be encrypted at rest in the mongodb database.

Add ability to configure outbit using a .yml file

search path ./.outbit.conf,~/.outbit.conf,/etc/outbit.conf

refactor the cli code so it separates the LALR parsing and interactive cli

set mongodb to use auth and encryption

mongodb traffic should be encrypted and should use authentication.

category=/ breaks the lexer

category=/ should be ok

cli - after using up and down arrow the backspace doesnt work

Ability To View Stats

Histogram for the below:
Jobs run per user.
Changes run per system.
Jobs run over time.

outbit> stats
0 10 20 30 40 50
user1 *******
user2 **********
user3 *****************

outbit> stats type=users
0 10 20 30 40 50
user1 *******
user2 **********
user3 *****************

outbit> stats type=system
0 10 20 30 40 50
server1 *******
server2 **********
server3 ***

outbit> stats type=jobs
0 10 20 30 40 50
07/2016 *******
08/2016 **********

option=/ does not tokenize correctly

outbit> roles edit name=super users=superadmin actions=/
action not found

might need to change:
t_OPTIONVAL =r'/[a-zA-Z0-9_/-]+'
to
t_OPTIONVAL =r'/[a-zA-Z0-9_/-]*' or r'[a-zA-Z0-9_/-]+'

empty commands are saved to history. Do not log or store empty commands in history.

true/false not working when parsing yaml configs

for example:
is_secure: True

doesnt work

action execution should be queued and non-blocking

Should be able to check status of queued actions.

ability to use outbit cli non-interactively

For example:
outbit 'help'
...
..

outbit 'testing ls; testing pwd'
...
..

pypi update version to only support 2.6 and 2.7.

At its current state it does not support python3. Unit tests only work for python 2.7, however it seems to work on 2.6 as well.

cli - add ability to use left and right arrow keys to change cursor position

write docs on outbit.readthedocs.io

trailing slash in category or missing leading / should be ok

actions add category=testing/
actions edit category=/testing/
actions edit category=testing

The above should be ok, currently it breaks things.

If no leading /, add one. If trailing slash exists, remove it. Should be a simple fix. in actions add and actions edit.