soutenniza commented 1 year ago

New Platform Operator Onboarding Checklist

Special Notes

Do not create this issue until the System Owner has formally authorized and requested it.
Please only use first names.

In order to get Jason productively contributing to the cloud.gov team, David should help Jason complete a prescribed set of tasks that will bring them up to speed and get them setup with cloud.gov.

Instructions

Try to go through the checklists in order.
If David can’t complete any of the items on their checklist personally, they are responsible for ensuring that someone with the correct access completes that item.

Onboarding Checklist

Required items for all team members

These items help us fulfill security and compliance requirements (including for FedRAMP). If you get stuck, or if these requirements are confusing, ask for help from your buddy or in a cloud.gov channel.

[x] Take judicious notes on what about this onboarding process or cloud.gov is confusing or frustrating. If you notice a problem (especially with things like documentation), you are more than welcome to fix it! At the very least, please share this information with your onboarding buddy (or someone) at some point so we can make the team/platform better. (You can also file issues and pull requests on the template Onboarding checklist.
[x] Be sure to introduce yourself and follow up with your onboarding buddy (they should have reached out to you at this point; if they haven't, please let the team know) and make sure this issue is assigned to them in our Github Project Planning Board. We use this board to organize, prioritize, and track our work.

Pre-requisites

[x] Complete GSA OLU GSA Mandatory Cyber Security and Privacy Training, including accepting the GSA IT Rules of Behavior, which is required before we can give you access to any cloud.gov systems. If you joined GSA more than two months ago, you've already completed this task and can just check the box.

Fulfill security and compliance requirements (including for FedRAMP) - Completed by onboarding buddy

[x] Make sure they're in the list of people working on the project.
[x] Add their name, whether they're Cloud Ops (Platform), and the date they joined the team to the training tracker. Copy the formulas for the due dates from an existing row (grab the "corner" of the cells and pull down).
[x] As they complete training, fill out their completion dates in the training tracker.
[x] Add them to the @cloud-gov-team in Slack’s Team Directory.
[x] Review the recurring cloud.gov meetings that are relevant for them in the team calendar (they will get access to this when added to the cloud.gov Team Google Group).
[x] Add them to the cloud-gov organization in GitHub, and the cloud-gov-team team.

Learn our policies and procedures

For the three trainings list at the top, your onboarding buddy will create a separate ticket to track the trainings once scheduling has been finished. This will help consolidate trainings for multiple new members to the team and prevent them from blocking progress on this onboarding ticket. Once the trainings are scheduled, they can be marked as complete here.

[x] Coordinate with your onboarding buddy to go through Contingency Planning training within 60 days (and annually after that). This will cover the following document, which you should also review before or after training:
- [x] Read the Contingency Plan.
[x] Coordinate with your onboarding buddy to go through Incident Response Training within 60 days of joining the team (and annually after that). This will cover the following document, which you should also review before or after training:
- [x] Read the Incident Response Guide.
[x] Coordinate with your onboarding buddy to go through nonpublic information training within 60 days of joining the team (and annually after that). This will cover the following documents, which you should also review before or after training:
- [ ] Review the cloud.gov open source policy guidance about protecting sensitive information.
- [ ] Read our sharing secret keys policy.
- [ ] Review the TTS requirements for password management.
[x] Read the Continuous Monitoring Strategy, particularly the cloud.gov team responsibilities.
[x] Read the Configuration Management Plan.
[x] Read the cloud.gov Security Policies and Procedures. These documents explain the high-level policies and procedures we must comply with while running cloud.gov, sorted into security control "families" They explain that we follow GSA IT security policy, and they provide a summary of the procedures in our System Security Plan.
[x] Review the System Security Plan (the latest version lives on Google Drive; look for "cloud.gov System Security Plan (SSP)" as a .docx file). Of particular note for onboarding: Section 9 (System Description) and Section 10 (System Environment)

Getting to know cloud.gov

These items will help you come up to speed on cloud.gov and what it is, how it works, why it exists, etc. While you should take the time to go through them, please do not try and tackle it all in one shot! It can become overwhelming very quickly, so your onboarding buddy will walk through this list with you at a high level with you to help manage the work.

Resources on cloud.gov:

[x] View the video: A Technical Overview of cloud.gov
[x] Read the team onboarding document for more context about cloud.gov.
[x] Bookmark the pertinent links listed here.
[x] Read through the Overview section of our site for a broader understanding of cloud.gov, especially how we present it to potential customers and users.
[x] Read the Delivery Process document to learn about how we work.
[x] Read our service disruption guide to learn how we handle customer-facing service disruptions.

Resources on CloudFoundry/BOSH:

[x] Look at Opensourced content for cloud foundry training classes: zero to hero (beginner), bosh/operator, and microservices
[x] Here is some training materials: GitHub - CloudCredo/training-operating-the-foundry: Training materials for Operating a Platform: BOSH and Everything Else
[x] Very thorough documentation on BOSH: Ultimate Guide to BOSH
[x] BOSH 101 presentation recording and slides

Getting hands-on with cloud.gov:

[x] Sign up for a cloud.gov sandbox using your GSA email address and start experimenting to get familiar with the basics of the PaaS from a user's perspective.
- This is also required in order to make you a platform admin once you've completed the Cybersecurity and Privacy training.

Add yourself to team resources:

[x] Add the cloud.gov Google Drive folder to your Google Drive -- that's where we put cloud.gov docs. If you create or move a doc there, it'll get the right access permissions for team members to be able to view and edit it.
[x] Subscribe to the cloud.gov team calendar (click the + in the bottom right) so you know when assorted team meetings are happening in the various squads. Tip: When you plan Out of Office time, make a calendar event for that on the cloud.gov calendar so that your teammates know you'll be away

Slack channels

Your onboarding buddy will add you to these Slack channels:

[x] #cloud-gov - bots post announcements here
[x] #cg-aws-security - private channel where bots post security notices
[x] #cg-aws-status - bots post announcements about AWS service outages/incidents
[ ] #cg-billing - private business development channel (if applicable)
[ ] #cg-business - business development (if applicable)
[x] #cg-compliance - compliance-related information and discussion
[x] #cg-offtopic - off-topic team sharing
[x] #cg-ops-banter - private channel for operations/engineering banter
[x] #cg-platform - platform operations
[x] #cg-platform-news - bots post platform alerts (mostly CI job notifications)
[x] #cg-general - program-level information and discusion
[x] #cg-support - support requests and assistance within TTS
[x] #cg-supportstream - stream of activity on Zendesk tickets
[x] #cg-incidents - private channel for incident response
[x] #cg-priv-all - private channel for in-team discussion
[ ] #cg-priv-gov (Federal employees only) - may contain discussion of contracting-related or other private, federal-employee-only comms

Once you're added to these channels, you probably want to mute these channels until you're on a support rotation:

[x] #cg-support
[x] #cg-supportstream
[x] #cg-platform-news

Platform-Ops-specific items

Machine admin rights

In order to install development tools on your Mac, you will need to request local admin rights by submitting a ServiceDesk ticket using this justification. If you're unable to create a ticket for yourself, your onboarding buddy can create one for you.

Cloud Operations account management

Note: These are all contingent on completing the GSA Mandatory Cyber Security and Privacy Training first. AWS user names should be identical across accounts so that permissions can be correctly managed by Terraform.

[x] Create AWS Accounts by following these instructions. These accounts should be setup as read-only at the start, and once the 3 mandatory cloud.gov trainings are complete they will be switched to full admin accounts and added to the audit input file:
- [x] AWS Commercial accounts
- [x] AWS GovCloud accounts
[x] Add them to Nessus Manager via the GUI
[x] Make them an admin of the platform.
[x] Add them to the platform-ops team in GitHub.
[x] Add them as an admin on the cg-django-uaa docs
[x] Add them to the cloud.gov team Google Group so they can participate in team-wide internal communication.
[x] Add them to our dockerhub org and ensure we're not over our license count
[x] Add them as an agent to the cloud.gov support Zendesk (Ask a cloud.gov member with admin access to Zendesk to add them).
[x] Business Unit Only - Add them to the cloud.gov inquiries Google Group so they can keep apprised of prospective new clients.

Your onboarding buddy will create a separate ticket tied to this one to track the AWS accounts being granted full admin access.

Additional compliance setup/review

[x] Install caulking git leak prevention by following the README
[x] Verify caulking by running make audit and pasting a screenshot as a comment on this GitHub issue
[x] Set GPG signing set up for GitHub (instructions here) and paste the output of git config commit.gpgsign as a comment on this GitHub issue
[x] Run this script to upload your GPG key to an S3 bucket containing the trusted keys for our team

Install a development environment for cloud.gov

Note: Make sure you have followed the instructions at the top of this section to get local admin rights on your machine before moving forward

[x] Install Homebrew (brew)
[x] Install CloudFoundry for mac per their docs:
- brew tap cloudfoundry/tap
- brew install cf-cli@7
- brew install openssl
[x] Verify CloudFoundry Installation via the CLI (once an existing cloud.gov teammate has made your cloud.gov admin account)
- cf login -a api.fr.cloud.gov --sso
- cf orgs
- As a cloud.gov team member, you should have a very giant list of organizations
- If you have none or one (e.g. sandbox) org, please reach out to your onboarding buddy
[x] Install the Bosh CLI using their instructions for MacOS
- brew install cloudfoundry/tap/bosh-cli
- [x] Verify the installation by running bosh -v in the command line
[x] Install Terraform and other tools per cg-provision
- brew install terraform
- brew install awscli
- brew install jq
- [x] Verify Terraform installed and is in your path: run terraform and helper text should display
- [x] Verify AWS CLI installed and is in your path: run aws and helper text should display
[x] Install and configure aws-vault by following our directions
[x] Install the Concourse fly CLI
- brew install fly
- [x] Verify by running fly -h in your command line
- This may fail due to app security policy on your mac rejecting apps from unidentified developers. To fix it (replace <VERSION> with your installed version of fly):
  
  xattr -d com.apple.quarantine /usr/local/Caskroom/fly/<VERSION>/fly
[x] Install cloud.gov dev tools by cloning the cg-scripts repo: run git clone https://github.com/cloud-gov/cg-scripts.git in your command line

Figure out your first tasks

Please work with your onboarding buddy to determine a platform component to work on first. Once you've identified the component you're going to focus on, your onboarding buddy will introduce you to someone who can onboard you to that project in specific. For the next few sprints, work on features, bugs, and improvements on this component. Reach out to your onboarding buddy or anyone else on the team if you need any help. Here are some easily-separated pieces to consider:

S3 broker (Golang, Open Service Broker API)
Aws broker (Golang, Open Service Broker API)
Domain brokers and friends (New stuff is all python + Open Service Broker API):
- External-domain broker
- legacy domain broker
- cdn broker
Logging stack (BOSH, ELK)
Prometheus (BOSH)
Stratos (golang + js)
uaa-extras (python + OIDC)
shibboleth (Java, OIDC)

Compliance items

These are items that are only necessary for someone stepping into a compliance role, but you can still subscribe to the alerts and mailing lists if you're interested:

[x] Subscribe to US-CERT alerts: https://us-cert.cisa.gov/mailing-lists-and-feeds
[x] Subscribe to FedRAMP mailing lists: https://public.govdelivery.com/accounts/USGSA/subscriber/topics?qsp=USGSA_2224
[x] Read Compliance Lead documents at root of the Google Drive Security and Compliance folder

pburkholder commented 1 year ago

Authorized by Ashley M at: https://groups.google.com/a/gsa.gov/g/cloud-gov-compliance/c/FoM-ukdjSks

JasonTheMain commented 1 year ago

1.99.0 2022-05-24 jasonagambino / Tue Nov 1 09:06:58 EDT 2022 ./test/bats/bin/bats -p caulked.bats caulked.bats ✓ leak prevention allows plain text, check 'git config --global -l' on failure ✓ leak prevention catches unstaged aws secrets in test repo ✓ leak prevention catches aws secrets in test repo ✓ leak prevention catches aws accesskey in test repo

leak prevention catches aws accounts numbers in test repo (skipped) ✓ leak prevention catches normal email addresses in test repo ✓ leak prevention catches Slack api token in test repo ✓ leak prevention catches IPv4 address in test repo ✓ repos have hooks.gitleaks set to true ✓ repos are using precommit hooks with gitleaks ✓ the ~/.aws directory is free of AWS keys ✓ git configuration uses a @gsa.gov email ✓ it catches yaml with deploy password ✓ it catches yaml with Slack webhook ✓ it catches yaml with encryption key ✓ it catches yaml with auth pass

16 tests, 0 failures, 1 skipped