Accounts Setup

Overview

This guide covers all required credentials and configurations needed for development. These credentials enable access to:

  • VA Nexus Repository (dependencies)

  • BitBucket Repository (code)

  • Docker Trust Registry (container images)

  • Maven builds and deployments

Early Onboarding Accounts

  1. Access your Apothesource Gmail account (the initial invite is sent to your personal email).

  2. Complete all required onboarding documents. These are sent via email prior to your start date. For any questions, reference the VA Document Process Details Document (attached to the email). Once submitted, processing generally takes about a week.

  3. Contact Amy Calvert with any questions, unless otherwise specified below.

Once your Gmail account is active, you will be granted access to the following tools:

Slack

Slack is used for general communication. A description of the channels you have been invited to will be sent to you once you have joined.

Quickbooks Time / TSheets

Quickbooks Time / TSheets hosts time-tracking. Log actual hours and ask for pre-approval for more than 40 hours a week.

Do not place any comments in the notes section, as these have to be manually deleted when turned into accounting.
Google Calendar

You will receive an invite during onboarding for:

Google Drive

  • Your personal folder will be shared with you prior to your first day. This is where you store any onboarding documents required during the process.

  • Miscellaneous folders (e.g., Employee Resources, etc.).

Later Onboarding Accounts

These accounts take time to set up because they depend on having a PIV and having the necessary tickets completed.

VA Nexus DTR

VA Nexus DTR (see wiki page) hosts the sandbox environment and DTR (Docker Trusted Registry). The password for this site is used in your settings.xml file and is your sandbox Jenkins credentials.

For account issues, contact Jonathan Williams.
MAE (Mobile Application Environment)

The MAE on the VA network hosts:

Sandbox

The Sandbox Jenkins server builds images from the code in MAE Stash and pushes the images to the VA Nexus DTR (dtr.mapsandbox.net). The Sandbox Kubernetes cluster also hosts test environments. Sandbox is an ephemeral environment used only for building images — no services are left running and no integration happens in this environment.

You can access the dashboard using the kubeconfig file or using the URLs below. kubectl can also be used with a kubeconfig. The example below grants developer-level access with the public and private keys. Admin-level access is also available.

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURvRENDQW9pZ0F3SUJBZ0lVUkt3OWFrOHNlZVJXRlBRMkR4MlcrbnFwRHV3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2FERUxNQWtHQTFVRUJoTUNWVk14RHpBTkJnTlZCQWdUQms5eVpXZHZiakVSTUE4R0ExVUVCeE1JVUc5eQpkR3hoYm1ReEV6QVJCZ05WQkFvVENrdDFZbVZ5Ym1WMFpYTXhDekFKQmdOVkJBc1RBa05CTVJNd0VRWURWUVFECkV3cExkV0psY201bGRHVnpNQjRYRFRFNE1USXhOREUzTWpnd01Gb1hEVEl6TVRJeE16RTNNamd3TUZvd2FERUwKTUFrR0ExVUVCaE1DVlZNeER6QU5CZ05WQkFnVEJrOXlaV2R2YmpFUk1BOEdBMVVFQnhNSVVHOXlkR3hoYm1ReApFekFSQmdOVkJBb1RDa3QxWW1WeWJtVjBaWE14Q3pBSkJnTlZCQXNUQWtOQk1STXdFUVlEVlFRREV3cExkV0psCmNtNWxkR1Z6TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF4YUFPRUlMUld4Y2wKTk9XWXBNTkoydzZLb293cEtiWjhsc3ZDSXFtZ3FXVUZkRHY0cWZDMTJTYTZUck52ZU5FSHlza1h1OExSUjdjTAprbFhQdnFUWW1RQlFFMWwwcGhicHhnLy9jMkk4SUU1OUlkUjRhN3ZHOWtmakRMeCswK3Axc0xQblBZcVNYVUNxCk14cnJBdzNHK0dQTGV2T1pKV2szM3VEZm9nQk52bEZqd2FQZjNlWEFZWjl2V3R6VC9jc1c2WTVSdzkxbCtFL0cKQU1VK0RWaWkvUlE3VjZSVXhpSG1kOVc5TFNjNnhaNFRrUWNUZnlJaEJHbHpSbUlhT3lpWm9xNy9FRWlSaFpZNwp0L0tkN2lnUklReXhneGFQU0s3ckNoTlc0bDByYk4rNXM0YldvR2JlZ1RtdjFzdjBhM01GZ0VvL0dUZS9hRVR2CmVhU2ltSG5WQVFJREFRQUJvMEl3UURBT0JnTlZIUThCQWY4RUJBTUNBUVl3RHdZRFZSMFRBUUgvQkFVd0F3RUIKL3pBZEJnTlZIUTRFRmdRVU5HdHRkNlhSUGJoQnM0TXZPU0twNjI3RzNrMHdEUVlKS29aSWh2Y05BUUVMQlFBRApnZ0VCQUFwQWpjRXprUFhUNkx5NDlwNU5BZGhGM2hnc1R1UnBlTW9Ka0NRRXdhR3d2dHVuK3F2NkdYTmVIa3E2CjBhVGFLRjJpQ0g2alFtZXpSc2ovQVppSFJJWGUwb2Jhb2RINVpzcnlvOTBvNGtZUEFzOUlzUEwxOWxaNUpwOC8KRE5EMnFrKzRRRk1McU8yZ0QrVlU5U3dhWmJQbFdaN2ZmaFNGQk1ieDhLWHR4SVBTVHh5MjJ5ZVRCUFZoeW1DOQpmb2lxcUpxQnJMUytVNEtKeFpSK3RsZEpHMko5aUdDVkZEK09pRG5qSzg4bmU2ZXdwSHZNMXZYeS9Zc2gzMlJCCmxjcTdzZ0ZxU2xWazltME9zUmg2RXlWam8vVkIrTDRFOG00U1A1eHF2Mm14M0s2SzdNMVFEMFlRSWsxbzZYMUwKRzI1QkNQb2FOVkk5dGRTK0NhRGY2bW15TUxnPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    #server: https://sandbox-2-kube-api-588901878.us-gov-west-1.elb.amazonaws.com:6443
    server: https://sandbox-kube-api-1804029434.us-gov-west-1.elb.amazonaws.com:6443
  name: map-sandbox
contexts:
- context:
    cluster: map-sandbox
    user: map-sandbox
  name: map-sandbox
current-context: map-sandbox
kind: Config
preferences: {}
users:
- name: map-sandbox
  user:
    client-certificate: /path/to/.ssh/developer.pem
    client-key: /path/to/.ssh/developer-key.pem
    kubectl --kubeconfig=sandboxcfg proxy --port=8801 & sleep 1;
    open 'http://localhost:8801/api/v1/namespaces/kube-system/services/http:kubernetes-dashboard:/proxy/#!/workload?namespace=ckm';

Sandbox, like all environments, switches in blue-green deployments. The API endpoint switches between the two listed servers, depending on the blue-green state.

If using admin-idp, the test user is mockuser01 / pass.

The Consul changes to sandbox are managed using git2consul.

Sandbox URLs

VA Network Remote Access

You must use a valid PIV Card to access the VA network for SQA and PROD environments. Any .med.va.gov or .apps.va.gov sites are behind the firewall. Temporary PIV exemptions may also be granted.

You can access the VA network two ways — via Citrix Access Gateway (CAG) or Azure Virtual Desktop (AVD):

Once you have configured your network access, keep a copy of the SRE bookmarks file in your shared drive. This will never be deleted, whereas every other setting you change may disappear due to the nature of the remote desktop environment. This file contains links to the SRE tools, accessed through AdminIDP for both the SQA and PROD environments. It also has a link to the VA PPG Slack; logging into this can be useful to copy/paste long stack traces so you can see them on your local machine.

SRE Bookmarks

SQA / Staging

The Staging Jenkins server is accessible only on the VA network. This environment is where developers for other teams often start integrating with our services.

The admin-idp URLs in SQA can be used with test accounts or your MAP AD Credentials. MAP AD credentials are usually in the format VACO<name>.

AppDynamics in SQA: our SQA goes to AppD Preprod. If you are accessing AppD, you need to complete the SSOi process in PreProd to create your account. This gives your PIV access to PreProd, where AppD lives.

Be sure to select the correct PIV cert when logging into AppD. Google Chrome may not display an option to select your cert.

SQA URLs:

PROD / Production

The production environment is more restrictive than staging, but some dev tools are visible:

If you cannot access these URLs, create an ECCB ticket to request them.

CodeRepo, JIRA, and Wiki

Configuring Macbook Pro and Touch ID as a Two-Factor Hardware Device

Currently, this only works with Google Chrome or Mozilla Firefox. It should also work with other Chromium-based browsers, although it has only been tested with Brave. Unfortunately, this does not work with Safari.

The following steps must be done separately for CodeRepo, JIRA, and the Wiki. These steps also assume you have set up Touch ID on your laptop with your fingerprint.

Setup steps (this example is for CodeRepo):

  1. Log in to CodeRepo with your username and password: https://coderepo.mobilehealth.va.gov/login

  2. Click on your profile at the top right and select "2FA Configuration", or go to https://coderepo.mobilehealth.va.gov/plugins/servlet/authplugin/tfaconfiguration

  3. Under "Register U2F Hardware Security Keys", click "Add U2F Device".

  4. Enter a device name, e.g. Apothesource MBPro.

  5. When prompted to enter a passkey for coderepo.mobilehealth.va.gov, click "Continue".

  6. At the "Use Password" (your laptop password) or Touch ID prompt, place your finger on Touch ID.

  7. Your laptop should now be added as a hardware device.

You may instead use a hardware security key, such as a Thetis Pro FIDO2 Security Key, that you push a button on to authenticate. Follow similar steps as above but push the button on the key. This works well for anyone who keeps their laptop closed/docked.

Test it out:

  1. The next time you log in (and after the 2-hour expiration), you’ll be prompted for Two-Factor Authentication.

  2. Click "Remember Me" and hit submit.

  3. You’ll be prompted again by your browser to "Use Password" or use Touch ID. Place your finger on Touch ID.

  4. You should now be logged in using your laptop + Touch ID as your Two-Factor Authentication method.

Repeat these steps for your accounts with JIRA and the Wiki.

Accounts Used for Development

Amy Calvert will request access for your VA Crowd Account once you have received your PIV.

A minimum of two accounts are required for a working local development environment.

Account URL Description ENV Variable POC

VA Crowd Account

https://crowd.mobilehealth.va.gov/crowd/console/login.action

Account for VA MAE internal resources

VA_NEXUS_USER / VA_NEXUS_PWD

Ryan or Michael (need PIV first)

VA Nexus DTR

dtr.mapsandbox.net

Sandbox DTR (Docker Trusted Registry)

DTR_USER / DTR_PWD

Amy (check your spam folder)

The VA now requires Bitbucket, Confluence, and JIRA access to have two-factor authentication (2FA) enabled.

Encrypting Passwords

Password encryption is not necessary if you generate and use tokens for all of your development accounts.

If you decide to use your account password values, then each account password environment variable must be properly encrypted.

If you need to determine escape characters for your password, use the echo command. If the password is escaped correctly, it will echo correctly:

$ echo P4\$\$W0RD\!

Create a Master Password

$ mvn --encrypt-master-password
Master password:

Place the master password in your ~/.m2/settings-security.xml if it is not already there.

Encrypt Account Passwords

For each account password, encrypt it and put these in your environment settings (~/.zshrc or similar).

$ mvn --encrypt-password
Password: