mirror of
https://github.com/wahyd4/cert-manager.git
synced 2026-08-13 15:15:55 +10:00
Create devel directory and use it for e2e tests
Signed-off-by: James Munnelly <james@munnelly.eu>
This commit is contained in:
James Munnelly
@@ -50,6 +50,7 @@ filegroup(
|
||||
"//cmd/controller:all-srcs",
|
||||
"//cmd/webhook:all-srcs",
|
||||
"//deploy:all-srcs",
|
||||
"//devel:all-srcs",
|
||||
"//hack:all-srcs",
|
||||
"//pkg/acme:all-srcs",
|
||||
"//pkg/api:all-srcs",
|
||||
|
||||
@@ -86,24 +86,6 @@ $(CMDS):
|
||||
bazel build \
|
||||
//cmd/$@
|
||||
|
||||
e2e_test:
|
||||
mkdir -p "$$(pwd)/_artifacts"
|
||||
bazel build //hack/bin:helm //test/e2e:e2e.test
|
||||
# Run e2e tests
|
||||
KUBECONFIG=$(KUBECONFIG) \
|
||||
bazel run @com_github_onsi_ginkgo//ginkgo -- \
|
||||
-nodes 10 \
|
||||
-flakeAttempts $(FLAKE_ATTEMPTS) \
|
||||
$$(bazel info bazel-genfiles)/test/e2e/e2e.test \
|
||||
-- \
|
||||
--helm-binary-path=$$(bazel info bazel-genfiles)/hack/bin/helm \
|
||||
--repo-root="$$(pwd)" \
|
||||
--report-dir="$${ARTIFACTS:-./_artifacts}" \
|
||||
--ginkgo.skip="$(GINKGO_SKIP)" \
|
||||
--ginkgo.focus="$(GINKGO_FOCUS)" \
|
||||
--skip-globals=$(SKIP_GLOBALS) \
|
||||
--kubectl-path="$(KUBECTL)"
|
||||
|
||||
# Generate targets
|
||||
##################
|
||||
generate:
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [
|
||||
":package-srcs",
|
||||
"//devel/addon/certmanager:all-srcs",
|
||||
"//devel/addon/ingressnginx:all-srcs",
|
||||
"//devel/addon/pebble:all-srcs",
|
||||
"//devel/addon/samplewebhook:all-srcs",
|
||||
"//devel/addon/vault:all-srcs",
|
||||
],
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
+100
@@ -0,0 +1,100 @@
|
||||
# Development tooling
|
||||
|
||||
This directory contains tools and scripts used to create development and
|
||||
testing environments for cert-manager.
|
||||
|
||||
## Tool dependencies
|
||||
|
||||
The scripts in this directory commonly require additional tooling, such as
|
||||
access to `kubectl`, `helm`, `kind` and a bunch of other things.
|
||||
|
||||
If you already have these tools available on your host system, the scripts
|
||||
should just work, so long as the versions you have installed are roughly
|
||||
compatible.
|
||||
|
||||
If you are running into issues with your host-installed tools, Bazel provides
|
||||
versioned access to all of the required tools for the e3e scripts.
|
||||
|
||||
To setup your shell to use the Bazel provided versions of these tools, run the
|
||||
following from the **root of the repository**:
|
||||
|
||||
```console
|
||||
export PATH="$(pwd)/devel/bin:$PATH"
|
||||
```
|
||||
|
||||
## Common usages
|
||||
|
||||
This section describes common usage patterns for development and testing.
|
||||
|
||||
### Creating a kind cluster
|
||||
|
||||
To create a kind cluster that can be used for both development and testing, run
|
||||
`./devel/cluster/create.sh` from the root of the cert-manager repository:
|
||||
|
||||
```console
|
||||
./devel/cluster/create.sh
|
||||
```
|
||||
|
||||
You can change the name of the kind cluster created by setting:
|
||||
|
||||
```console
|
||||
export KIND_CLUSTER_NAME=custom-cluster-name
|
||||
```
|
||||
|
||||
If a cluster with the same name already exists, it will **not** be recreated
|
||||
and instead will be reused.
|
||||
|
||||
### Installing a development build of cert-manager
|
||||
|
||||
Once you have a kind cluster running, you can install a development version of
|
||||
cert-manager by running:
|
||||
|
||||
```console
|
||||
./devel/addon/certmanager/install.sh
|
||||
```
|
||||
|
||||
This will build, load and install cert-manager from source into your kind
|
||||
development cluster.
|
||||
|
||||
Further invocations of the `install.sh` script will rebuild and upgrade the
|
||||
installed version of cert-manager, making it possible to iteratively work on
|
||||
the codebase and test changes.
|
||||
|
||||
### Running end-to-end tests
|
||||
|
||||
Before running the end-to-end tests, you must install some additional
|
||||
components used during the tests into your kind cluster.
|
||||
|
||||
Run the following to setup persistent test instances of Pebble, ingress-nginx,
|
||||
and a sample DNS01 webhook:
|
||||
|
||||
```console
|
||||
./devel/setup-e2e-deps.sh
|
||||
```
|
||||
|
||||
You only need to run this command once for the lifetime of your test cluster.
|
||||
|
||||
If you haven't already, deploy a new test build of cert-manager:
|
||||
|
||||
```console
|
||||
./devel/addon/certmanager/install.sh
|
||||
```
|
||||
|
||||
Finally, run the end-to-test tests using:
|
||||
|
||||
```console
|
||||
./devel/run-e2e.sh
|
||||
```
|
||||
|
||||
You can run this command multiple times against the same cluster without
|
||||
adverse effects.
|
||||
|
||||
### Deleting the test cluster
|
||||
|
||||
Once you have finished with your testing environment, or if you have
|
||||
encountered a strange state you cannot recover from, you can tear down the
|
||||
testing environment by using `kind` directly:
|
||||
|
||||
```console
|
||||
kind delete cluster [--name=$KIND_CLUSTER_NAME]
|
||||
```
|
||||
@@ -0,0 +1,11 @@
|
||||
# End-to-end test addons
|
||||
|
||||
This directory contains code for deploying instances of addons used during
|
||||
end-to-end tests and whilst developing.
|
||||
|
||||
This includes things like [Vault](https://www.vaultproject.io/),
|
||||
[ingress-nginx](https://github.com/kubernetes/ingress-nginx) and
|
||||
[Pebble](https://github.com/letsencrypt/pebble) amongst others.
|
||||
|
||||
These tools are designed to be easily reusable during tests or by developers
|
||||
when testing out new features or writing tests.
|
||||
@@ -0,0 +1,26 @@
|
||||
load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
|
||||
|
||||
container_bundle(
|
||||
name = "bundle",
|
||||
images = {
|
||||
"{STABLE_DOCKER_REPO}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//cmd/controller:image",
|
||||
"{STABLE_DOCKER_REPO}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//cmd/acmesolver:image",
|
||||
"{STABLE_DOCKER_REPO}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//cmd/webhook:image",
|
||||
"{STABLE_DOCKER_REPO}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//cmd/cainjector:image",
|
||||
},
|
||||
tags = ["manual"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [":package-srcs"],
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
Executable
+63
@@ -0,0 +1,63 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
# Namespace to deploy into
|
||||
NAMESPACE="${NAMESPACE:-cert-manager}"
|
||||
# Release name to use with Helm
|
||||
RELEASE_NAME="${RELEASE_NAME:-cert-manager}"
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/../../lib/lib.sh"
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
|
||||
# Require kubectl & helm available on PATH
|
||||
check_tool kubectl
|
||||
check_tool helm
|
||||
|
||||
# Use the current timestamp as the APP_VERSION so a rolling update will be
|
||||
# triggered on every call to this script.
|
||||
export APP_VERSION="$(date +"%s")"
|
||||
# Build a copy of the cert-manager release images using the :bazel image tag
|
||||
bazel run --stamp=true --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 "//devel/addon/certmanager:bundle"
|
||||
|
||||
# Load all images into the kind cluster
|
||||
kind load docker-image --name "$KIND_CLUSTER_NAME" "quay.io/jetstack/cert-manager-controller:${APP_VERSION}" &
|
||||
kind load docker-image --name "$KIND_CLUSTER_NAME" "quay.io/jetstack/cert-manager-acmesolver:${APP_VERSION}" &
|
||||
kind load docker-image --name "$KIND_CLUSTER_NAME" "quay.io/jetstack/cert-manager-cainjector:${APP_VERSION}" &
|
||||
kind load docker-image --name "$KIND_CLUSTER_NAME" "quay.io/jetstack/cert-manager-webhook:${APP_VERSION}" &
|
||||
|
||||
wait
|
||||
|
||||
# Ensure the pebble namespace exists
|
||||
kubectl get namespace "${NAMESPACE}" || kubectl create namespace "${NAMESPACE}"
|
||||
|
||||
# Install a copy of the CRDs
|
||||
kubectl apply -f "${REPO_ROOT}/deploy/charts/cert-manager/crds/"
|
||||
|
||||
# Upgrade or install Pebble
|
||||
helm upgrade \
|
||||
--install \
|
||||
--wait \
|
||||
--namespace "${NAMESPACE}" \
|
||||
--set image.tag="${APP_VERSION}" \
|
||||
--set cainjector.image.tag="${APP_VERSION}" \
|
||||
--set webhook.image.tag="${APP_VERSION}" \
|
||||
"$RELEASE_NAME" \
|
||||
"$REPO_ROOT/deploy/charts/cert-manager"
|
||||
@@ -0,0 +1,24 @@
|
||||
load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
|
||||
|
||||
container_bundle(
|
||||
name = "bundle",
|
||||
images = {
|
||||
"quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1": "@io_kubernetes_ingress-nginx//image",
|
||||
"k8s.gcr.io/defaultbackend-amd64:bazel": "@io_gcr_k8s_defaultbackend//image",
|
||||
},
|
||||
tags = ["manual"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [":package-srcs"],
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
Executable
+61
@@ -0,0 +1,61 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
# Installs an instance of ingress-nginx using the 'stable' Helm chart.
|
||||
# Configure the cluster to target using the KUBECONFIG environment variable.
|
||||
# Additional parameters can be configured by overriding the variables below.
|
||||
|
||||
# Namespace to deploy into
|
||||
NAMESPACE="${NAMESPACE:-ingress-nginx}"
|
||||
# Release name to use with Helm
|
||||
RELEASE_NAME="${RELEASE_NAME:-ingress-nginx}"
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/../../lib/lib.sh"
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
|
||||
# Require helm available on PATH
|
||||
check_tool kubectl
|
||||
check_tool helm
|
||||
require_image "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1" "//devel/addon/ingressnginx:bundle"
|
||||
require_image "k8s.gcr.io/defaultbackend-amd64:bazel" "//devel/addon/ingressnginx:bundle"
|
||||
|
||||
# Ensure the pebble namespace exists
|
||||
kubectl get namespace "${NAMESPACE}" || kubectl create namespace "${NAMESPACE}"
|
||||
|
||||
helm repo add stable https://kubernetes-charts.storage.googleapis.com
|
||||
|
||||
helm repo update
|
||||
|
||||
# Upgrade or install Pebble
|
||||
helm upgrade \
|
||||
--install \
|
||||
--wait \
|
||||
--version 1.23.0 \
|
||||
--namespace "${NAMESPACE}" \
|
||||
--set controller.image.tag=0.26.1 \
|
||||
--set controller.image.pullPolicy=Never \
|
||||
--set defaultBackend.image.tag=bazel \
|
||||
--set defaultBackend.image.pullPolicy=Never \
|
||||
--set controller.service.clusterIP=10.0.0.15 \
|
||||
--set controller.service.type=ClusterIP \
|
||||
--set controller.config.no-tls-redirect-locations="" \
|
||||
"$RELEASE_NAME" \
|
||||
stable/nginx-ingress
|
||||
@@ -0,0 +1,40 @@
|
||||
load("@io_bazel_rules_go//go:def.bzl", "go_binary")
|
||||
load("@io_bazel_rules_docker//go:image.bzl", "go_image")
|
||||
load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
|
||||
|
||||
# gazelle:ignore
|
||||
|
||||
container_bundle(
|
||||
name = "bundle",
|
||||
images = {
|
||||
"pebble:bazel": ":image",
|
||||
},
|
||||
tags = ["manual"],
|
||||
)
|
||||
|
||||
go_image(
|
||||
name = "image",
|
||||
base = "@static_base//image",
|
||||
binary = ":app",
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
|
||||
go_binary(
|
||||
name = "app",
|
||||
embed = ["@org_letsencrypt_pebble//cmd/pebble:go_default_library"],
|
||||
pure = "on",
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [":package-srcs"],
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
@@ -0,0 +1,21 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
description: A Helm chart for Kubernetes
|
||||
name: pebble
|
||||
version: 0.1.1
|
||||
@@ -0,0 +1,16 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "fullname" -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,73 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}
|
||||
labels:
|
||||
app: {{ template "name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
config.json: |
|
||||
{
|
||||
"pebble": {
|
||||
"listenAddress": "0.0.0.0:14000",
|
||||
"certificate": "/config/cert.pem",
|
||||
"privateKey": "/config/key.pem",
|
||||
"httpPort": 80,
|
||||
"tlsPort": 443,
|
||||
"externalAccountBindingRequired": false,
|
||||
"externalAccountMACKeys": {
|
||||
"kid-1": "a2lkLXNlY3JldC0x",
|
||||
"kid-2": "a2lkLXNlY3JldC0y"
|
||||
}
|
||||
}
|
||||
}
|
||||
cert.pem: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDGzCCAgOgAwIBAgIIbEfayDFsBtwwDQYJKoZIhvcNAQELBQAwIDEeMBwGA1UE
|
||||
AxMVbWluaWNhIHJvb3QgY2EgMjRlMmRiMCAXDTE3MTIwNjE5NDIxMFoYDzIxMDcx
|
||||
MjA2MTk0MjEwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEB
|
||||
AQUAA4IBDwAwggEKAoIBAQCbFMW3DXXdErvQf2lCZ0qz0DGEWadDoF0O2neM5mVa
|
||||
VQ7QGW0xc5Qwvn3Tl62C0JtwLpF0pG2BICIN+DHdVaIUwkf77iBS2doH1I3waE1I
|
||||
8GkV9JrYmFY+j0dA1SwBmqUZNXhLNwZGq1a91nFSI59DZNy/JciqxoPX2K++ojU2
|
||||
FPpuXe2t51NmXMsszpa+TDqF/IeskA9A/ws6UIh4Mzhghx7oay2/qqj2IIPjAmJj
|
||||
i73kdUvtEry3wmlkBvtVH50+FscS9WmPC5h3lDTk5nbzSAXKuFusotuqy3XTgY5B
|
||||
PiRAwkZbEY43JNfqenQPHo7mNTt29i+NVVrBsnAa5ovrAgMBAAGjYzBhMA4GA1Ud
|
||||
DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0T
|
||||
AQH/BAIwADAiBgNVHREEGzAZgglsb2NhbGhvc3SCBnBlYmJsZYcEfwAAATANBgkq
|
||||
hkiG9w0BAQsFAAOCAQEAYIkXff8H28KS0KyLHtbbSOGU4sujHHVwiVXSATACsNAE
|
||||
D0Qa8hdtTQ6AUqA6/n8/u1tk0O4rPE/cTpsM3IJFX9S3rZMRsguBP7BSr1Lq/XAB
|
||||
7JP/CNHt+Z9aKCKcg11wIX9/B9F7pyKM3TdKgOpqXGV6TMuLjg5PlYWI/07lVGFW
|
||||
/mSJDRs8bSCFmbRtEqc4lpwlrpz+kTTnX6G7JDLfLWYw/xXVqwFfdengcDTHCc8K
|
||||
wtgGq/Gu6vcoBxIO3jaca+OIkMfxxXmGrcNdseuUCa3RMZ8Qy03DqGu6Y6XQyK4B
|
||||
W8zIG6H9SVKkAznM2yfYhW8v2ktcaZ95/OBHY97ZIw==
|
||||
-----END CERTIFICATE-----
|
||||
key.pem: |
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAmxTFtw113RK70H9pQmdKs9AxhFmnQ6BdDtp3jOZlWlUO0Blt
|
||||
MXOUML5905etgtCbcC6RdKRtgSAiDfgx3VWiFMJH++4gUtnaB9SN8GhNSPBpFfSa
|
||||
2JhWPo9HQNUsAZqlGTV4SzcGRqtWvdZxUiOfQ2TcvyXIqsaD19ivvqI1NhT6bl3t
|
||||
redTZlzLLM6Wvkw6hfyHrJAPQP8LOlCIeDM4YIce6Gstv6qo9iCD4wJiY4u95HVL
|
||||
7RK8t8JpZAb7VR+dPhbHEvVpjwuYd5Q05OZ280gFyrhbrKLbqst104GOQT4kQMJG
|
||||
WxGONyTX6np0Dx6O5jU7dvYvjVVawbJwGuaL6wIDAQABAoIBAGW9W/S6lO+DIcoo
|
||||
PHL+9sg+tq2gb5ZzN3nOI45BfI6lrMEjXTqLG9ZasovFP2TJ3J/dPTnrwZdr8Et/
|
||||
357YViwORVFnKLeSCnMGpFPq6YEHj7mCrq+YSURjlRhYgbVPsi52oMOfhrOIJrEG
|
||||
ZXPAwPRi0Ftqu1omQEqz8qA7JHOkjB2p0i2Xc/uOSJccCmUDMlksRYz8zFe8wHuD
|
||||
XvUL2k23n2pBZ6wiez6Xjr0wUQ4ESI02x7PmYgA3aqF2Q6ECDwHhjVeQmAuypMF6
|
||||
IaTjIJkWdZCW96pPaK1t+5nTNZ+Mg7tpJ/PRE4BkJvqcfHEOOl6wAE8gSk5uVApY
|
||||
ZRKGmGkCgYEAzF9iRXYo7A/UphL11bR0gqxB6qnQl54iLhqS/E6CVNcmwJ2d9pF8
|
||||
5HTfSo1/lOXT3hGV8gizN2S5RmWBrc9HBZ+dNrVo7FYeeBiHu+opbX1X/C1HC0m1
|
||||
wJNsyoXeqD1OFc1WbDpHz5iv4IOXzYdOdKiYEcTv5JkqE7jomqBLQk8CgYEAwkG/
|
||||
rnwr4ThUo/DG5oH+l0LVnHkrJY+BUSI33g3eQ3eM0MSbfJXGT7snh5puJW0oXP7Z
|
||||
Gw88nK3Vnz2nTPesiwtO2OkUVgrIgWryIvKHaqrYnapZHuM+io30jbZOVaVTMR9c
|
||||
X/7/d5/evwXuP7p2DIdZKQKKFgROm1XnhNqVgaUCgYBD/ogHbCR5RVsOVciMbRlG
|
||||
UGEt3YmUp/vfMuAsKUKbT2mJM+dWHVlb+LZBa4pC06QFgfxNJi/aAhzSGvtmBEww
|
||||
xsXbaceauZwxgJfIIUPfNZCMSdQVIVTi2Smcx6UofBz6i/Jw14MEwlvhamaa7qVf
|
||||
kqflYYwelga1wRNCPopLaQKBgQCWsZqZKQqBNMm0Q9yIhN+TR+2d7QFjqeePoRPl
|
||||
1qxNejhq25ojE607vNv1ff9kWUGuoqSZMUC76r6FQba/JoNbefI4otd7x/GzM9uS
|
||||
8MHMJazU4okwROkHYwgLxxkNp6rZuJJYheB4VDTfyyH/ng5lubmY7rdgTQcNyZ5I
|
||||
majRYQKBgAMKJ3RlII0qvAfNFZr4Y2bNIq+60Z+Qu2W5xokIHCFNly3W1XDDKGFe
|
||||
CCPHSvQljinke3P9gPt2HVdXxcnku9VkTti+JygxuLkVg7E0/SWwrWfGsaMJs+84
|
||||
fK+mTZay2d3v24r9WKEKwLykngYPyZw5+BdWU0E+xx5lGUd3U4gG
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,49 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}
|
||||
labels:
|
||||
app: {{ template "name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- -config=/config/config.json
|
||||
- -strict={{ .Values.strict }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 14000
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 1
|
||||
failureThreshold: 10
|
||||
successThreshold: 1
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 12 }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "fullname" . }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: pebble
|
||||
labels:
|
||||
app: {{ template "name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 14000
|
||||
protocol: TCP
|
||||
name: https
|
||||
selector:
|
||||
app: {{ template "name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
@@ -0,0 +1,16 @@
|
||||
replicaCount: 1
|
||||
image:
|
||||
repository: pebble
|
||||
tag: "bazel"
|
||||
pullPolicy: Never
|
||||
service:
|
||||
type: ClusterIP
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 10Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
|
||||
strict: "false"
|
||||
Executable
+50
@@ -0,0 +1,50 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
# Installs an instance of pebble using the Helm chart located in chart/
|
||||
# Configure the cluster to target using the KUBECONFIG environment variable.
|
||||
# Additional parameters can be configured by overriding the variables below.
|
||||
|
||||
# Namespace to deploy into
|
||||
NAMESPACE="${NAMESPACE:-pebble}"
|
||||
# Release name to use with Helm
|
||||
RELEASE_NAME="${RELEASE_NAME:-pebble}"
|
||||
# Image to use - by default uses a Bazel built image
|
||||
IMAGE="${IMAGE:-pebble:bazel}"
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/../../lib/lib.sh"
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
|
||||
# Require helm available on PATH
|
||||
check_tool kubectl
|
||||
check_tool helm
|
||||
require_image "pebble:bazel" "//devel/addon/pebble:bundle"
|
||||
|
||||
# Ensure the pebble namespace exists
|
||||
kubectl get namespace "${NAMESPACE}" || kubectl create namespace "${NAMESPACE}"
|
||||
|
||||
# Upgrade or install Pebble
|
||||
helm upgrade \
|
||||
--install \
|
||||
--wait \
|
||||
--namespace "${NAMESPACE}" \
|
||||
"$RELEASE_NAME" \
|
||||
"$SCRIPT_ROOT/chart"
|
||||
@@ -0,0 +1,26 @@
|
||||
load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
|
||||
|
||||
container_bundle(
|
||||
name = "bundle",
|
||||
images = {
|
||||
"sample-webhook:bazel": "//devel/addon/samplewebhook/sample:image",
|
||||
},
|
||||
tags = ["manual"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [
|
||||
":package-srcs",
|
||||
"//devel/addon/samplewebhook/sample:all-srcs",
|
||||
],
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
@@ -0,0 +1,21 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
appVersion: "1.0"
|
||||
description: A Helm chart for Kubernetes
|
||||
name: example-webhook
|
||||
version: 0.1.0
|
||||
@@ -0,0 +1,48 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "example-webhook.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "example-webhook.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "example-webhook.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "example-webhook.selfSignedIssuer" -}}
|
||||
{{ printf "%s-selfsign" (include "example-webhook.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "example-webhook.rootCAIssuer" -}}
|
||||
{{ printf "%s-ca" (include "example-webhook.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "example-webhook.rootCACertificate" -}}
|
||||
{{ printf "%s-ca" (include "example-webhook.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "example-webhook.servingCertificate" -}}
|
||||
{{ printf "%s-webhook-tls" (include "example-webhook.fullname" .) }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: apiregistration.k8s.io/v1beta1
|
||||
kind: APIService
|
||||
metadata:
|
||||
name: v1alpha1.{{ .Values.groupName }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "example-webhook.servingCertificate" . }}"
|
||||
spec:
|
||||
group: {{ .Values.groupName }}
|
||||
groupPriorityMinimum: 1000
|
||||
versionPriority: 15
|
||||
service:
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
version: v1alpha1
|
||||
@@ -0,0 +1,68 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "example-webhook.fullname" . }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- --tls-cert-file=/tls/tls.crt
|
||||
- --tls-private-key-file=/tls/tls.key
|
||||
env:
|
||||
- name: GROUP_NAME
|
||||
value: {{ .Values.groupName | quote }}
|
||||
ports:
|
||||
- name: https
|
||||
containerPort: 443
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
path: /healthz
|
||||
port: https
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
path: /healthz
|
||||
port: https
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /tls
|
||||
readOnly: true
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 12 }}
|
||||
volumes:
|
||||
- name: certs
|
||||
secret:
|
||||
secretName: {{ include "example-webhook.servingCertificate" . }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,76 @@
|
||||
---
|
||||
# Create a selfsigned Issuer, in order to create a root CA certificate for
|
||||
# signing webhook serving certificates
|
||||
apiVersion: cert-manager.io/v1alpha2
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ include "example-webhook.selfSignedIssuer" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
selfSigned: {}
|
||||
|
||||
---
|
||||
|
||||
# Generate a CA Certificate used to sign certificates for the webhook
|
||||
apiVersion: cert-manager.io/v1alpha2
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "example-webhook.rootCACertificate" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
secretName: {{ include "example-webhook.rootCACertificate" . }}
|
||||
duration: 43800h # 5y
|
||||
issuerRef:
|
||||
name: {{ include "example-webhook.selfSignedIssuer" . }}
|
||||
commonName: "ca.example-webhook.cert-manager"
|
||||
isCA: true
|
||||
|
||||
---
|
||||
|
||||
# Create an Issuer that uses the above generated CA certificate to issue certs
|
||||
apiVersion: cert-manager.io/v1alpha2
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ include "example-webhook.rootCAIssuer" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
ca:
|
||||
secretName: {{ include "example-webhook.rootCACertificate" . }}
|
||||
|
||||
---
|
||||
|
||||
# Finally, generate a serving certificate for the webhook to use
|
||||
apiVersion: cert-manager.io/v1alpha2
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "example-webhook.servingCertificate" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
secretName: {{ include "example-webhook.servingCertificate" . }}
|
||||
duration: 8760h # 1y
|
||||
issuerRef:
|
||||
name: {{ include "example-webhook.rootCAIssuer" . }}
|
||||
dnsNames:
|
||||
- {{ include "example-webhook.fullname" . }}
|
||||
- {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }}
|
||||
- {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
|
||||
@@ -0,0 +1,111 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
---
|
||||
# Grant the webhook permission to read the ConfigMap containing the Kubernetes
|
||||
# apiserver's requestheader-ca-certificate.
|
||||
# This ConfigMap is automatically created by the Kubernetes apiserver.
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
# Once we no longer have to support Kubernetes versions lower than 1.17, we
|
||||
# can remove this custom defined Role in favour of the system-provisioned
|
||||
# extension-apiserver-authentication-reader Role resource in kube-system.
|
||||
# See https://github.com/kubernetes/kubernetes/issues/86359 for more details.
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader
|
||||
namespace: kube-system
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- extension-apiserver-authentication
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
# apiserver gets the auth-delegator role to delegate auth decisions to
|
||||
# the core apiserver
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:auth-delegator
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:auth-delegator
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
# Grant cert-manager permission to validate using our apiserver
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:domain-solver
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- {{ .Values.groupName }}
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- 'create'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:domain-solver
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "example-webhook.fullname" . }}:domain-solver
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: {{ .Values.certManager.serviceAccountName }}
|
||||
namespace: {{ .Values.certManager.namespace }}
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
name: https
|
||||
selector:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
@@ -0,0 +1,43 @@
|
||||
# The GroupName here is used to identify your company or business unit that
|
||||
# created this webhook.
|
||||
# For example, this may be "acme.mycompany.com".
|
||||
# This name will need to be referenced in each Issuer's `webhook` stanza to
|
||||
# inform cert-manager of where to send ChallengePayload resources in order to
|
||||
# solve the DNS01 challenge.
|
||||
# This group name should be **unique**, hence using your own company's domain
|
||||
# here is recommended.
|
||||
groupName: acme.testing.cert-manager.io
|
||||
|
||||
certManager:
|
||||
namespace: cert-manager
|
||||
serviceAccountName: cert-manager
|
||||
|
||||
image:
|
||||
repository: sample-webhook
|
||||
tag: bazel
|
||||
pullPolicy: Never
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
Executable
+49
@@ -0,0 +1,49 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
# Installs an instance of the sample-webhook using the Helm chart located in
|
||||
# chart/.
|
||||
# Configure the cluster to target using the KUBECONFIG environment variable.
|
||||
# Additional parameters can be configured by overriding the variables below.
|
||||
|
||||
# Namespace to deploy into
|
||||
NAMESPACE="${NAMESPACE:-sample-webhook}"
|
||||
# Release name to use with Helm
|
||||
RELEASE_NAME="${RELEASE_NAME:-sample-webhook}"
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/../../lib/lib.sh"
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
|
||||
# Require helm available on PATH
|
||||
check_tool kubectl
|
||||
check_tool helm
|
||||
require_image "sample-webhook:bazel" "//devel/addon/samplewebhook:bundle"
|
||||
|
||||
# Ensure the pebble namespace exists
|
||||
kubectl get namespace "${NAMESPACE}" || kubectl create namespace "${NAMESPACE}"
|
||||
|
||||
# Upgrade or install Pebble
|
||||
helm upgrade \
|
||||
--install \
|
||||
--wait \
|
||||
--namespace "${NAMESPACE}" \
|
||||
"$RELEASE_NAME" \
|
||||
"$SCRIPT_ROOT/chart"
|
||||
@@ -0,0 +1,43 @@
|
||||
load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
|
||||
load("@io_bazel_rules_docker//go:image.bzl", "go_image")
|
||||
|
||||
go_image(
|
||||
name = "image",
|
||||
base = "@static_base//image",
|
||||
binary = ":sample",
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
|
||||
go_library(
|
||||
name = "go_default_library",
|
||||
srcs = ["main.go"],
|
||||
importpath = "github.com/jetstack/cert-manager/devel/addon/samplewebhook/sample",
|
||||
visibility = ["//visibility:private"],
|
||||
deps = [
|
||||
"//pkg/acme/webhook/apis/acme/v1alpha1:go_default_library",
|
||||
"//pkg/acme/webhook/cmd:go_default_library",
|
||||
"@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1:go_default_library",
|
||||
"@io_k8s_client_go//rest:go_default_library",
|
||||
],
|
||||
)
|
||||
|
||||
go_binary(
|
||||
name = "sample",
|
||||
embed = [":go_default_library"],
|
||||
pure = "on",
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [":package-srcs"],
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
@@ -0,0 +1,163 @@
|
||||
/*
|
||||
Copyright 2019 The Jetstack cert-manager contributors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
|
||||
//"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/rest"
|
||||
|
||||
"github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1"
|
||||
"github.com/jetstack/cert-manager/pkg/acme/webhook/cmd"
|
||||
)
|
||||
|
||||
var GroupName = os.Getenv("GROUP_NAME")
|
||||
|
||||
func main() {
|
||||
if GroupName == "" {
|
||||
panic("GROUP_NAME must be specified")
|
||||
}
|
||||
|
||||
// This will register our custom DNS provider with the webhook serving
|
||||
// library, making it available as an API under the provided GroupName.
|
||||
// You can register multiple DNS provider implementations with a single
|
||||
// webhook, where the Name() method will be used to disambiguate between
|
||||
// the different implementations.
|
||||
cmd.RunWebhookServer(GroupName,
|
||||
&customDNSProviderSolver{},
|
||||
)
|
||||
}
|
||||
|
||||
// customDNSProviderSolver implements the provider-specific logic needed to
|
||||
// 'present' an ACME challenge TXT record for your own DNS provider.
|
||||
// To do so, it must implement the `github.com/jetstack/cert-manager/pkg/acme/webhook.Solver`
|
||||
// interface.
|
||||
type customDNSProviderSolver struct {
|
||||
// If a Kubernetes 'clientset' is needed, you must:
|
||||
// 1. uncomment the additional `client` field in this structure below
|
||||
// 2. uncomment the "k8s.io/client-go/kubernetes" import at the top of the file
|
||||
// 3. uncomment the relevant code in the Initialize method below
|
||||
// 4. ensure your webhook's service account has the required RBAC role
|
||||
// assigned to it for interacting with the Kubernetes APIs you need.
|
||||
//client kubernetes.Clientset
|
||||
}
|
||||
|
||||
// customDNSProviderConfig is a structure that is used to decode into when
|
||||
// solving a DNS01 challenge.
|
||||
// This information is provided by cert-manager, and may be a reference to
|
||||
// additional configuration that's needed to solve the challenge for this
|
||||
// particular certificate or issuer.
|
||||
// This typically includes references to Secret resources containing DNS
|
||||
// provider credentials, in cases where a 'multi-tenant' DNS solver is being
|
||||
// created.
|
||||
// If you do *not* require per-issuer or per-certificate configuration to be
|
||||
// provided to your webhook, you can skip decoding altogether in favour of
|
||||
// using CLI flags or similar to provide configuration.
|
||||
// You should not include sensitive information here. If credentials need to
|
||||
// be used by your provider here, you should reference a Kubernetes Secret
|
||||
// resource and fetch these credentials using a Kubernetes clientset.
|
||||
type customDNSProviderConfig struct {
|
||||
// Change the two fields below according to the format of the configuration
|
||||
// to be decoded.
|
||||
// These fields will be set by users in the
|
||||
// `issuer.spec.acme.dns01.providers.webhook.config` field.
|
||||
|
||||
//Email string `json:"email"`
|
||||
//APIKeySecretRef cmmeta.SecretKeySelector `json:"apiKeySecretRef"`
|
||||
}
|
||||
|
||||
// Name is used as the name for this DNS solver when referencing it on the ACME
|
||||
// Issuer resource.
|
||||
// This should be unique **within the group name**, i.e. you can have two
|
||||
// solvers configured with the same Name() **so long as they do not co-exist
|
||||
// within a single webhook deployment**.
|
||||
// For example, `cloudflare` may be used as the name of a solver.
|
||||
func (c *customDNSProviderSolver) Name() string {
|
||||
return "my-custom-solver"
|
||||
}
|
||||
|
||||
// Present is responsible for actually presenting the DNS record with the
|
||||
// DNS provider.
|
||||
// This method should tolerate being called multiple times with the same value.
|
||||
// cert-manager itself will later perform a self check to ensure that the
|
||||
// solver has correctly configured the DNS provider.
|
||||
func (c *customDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error {
|
||||
cfg, err := loadConfig(ch.Config)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// TODO: do something more useful with the decoded configuration
|
||||
fmt.Printf("Decoded configuration %v", cfg)
|
||||
|
||||
// TODO: add code that sets a record in the DNS provider's console
|
||||
return nil
|
||||
}
|
||||
|
||||
// CleanUp should delete the relevant TXT record from the DNS provider console.
|
||||
// If multiple TXT records exist with the same record name (e.g.
|
||||
// _acme-challenge.example.com) then **only** the record with the same `key`
|
||||
// value provided on the ChallengeRequest should be cleaned up.
|
||||
// This is in order to facilitate multiple DNS validations for the same domain
|
||||
// concurrently.
|
||||
func (c *customDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error {
|
||||
// TODO: add code that deletes a record from the DNS provider's console
|
||||
return nil
|
||||
}
|
||||
|
||||
// Initialize will be called when the webhook first starts.
|
||||
// This method can be used to instantiate the webhook, i.e. initialising
|
||||
// connections or warming up caches.
|
||||
// Typically, the kubeClientConfig parameter is used to build a Kubernetes
|
||||
// client that can be used to fetch resources from the Kubernetes API, e.g.
|
||||
// Secret resources containing credentials used to authenticate with DNS
|
||||
// provider accounts.
|
||||
// The stopCh can be used to handle early termination of the webhook, in cases
|
||||
// where a SIGTERM or similar signal is sent to the webhook process.
|
||||
func (c *customDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error {
|
||||
///// UNCOMMENT THE BELOW CODE TO MAKE A KUBERNETES CLIENTSET AVAILABLE TO
|
||||
///// YOUR CUSTOM DNS PROVIDER
|
||||
|
||||
//cl, err := kubernetes.NewForConfig(kubeClientConfig)
|
||||
//if err != nil {
|
||||
// return err
|
||||
//}
|
||||
//
|
||||
//c.client = cl
|
||||
|
||||
///// END OF CODE TO MAKE KUBERNETES CLIENTSET AVAILABLE
|
||||
return nil
|
||||
}
|
||||
|
||||
// loadConfig is a small helper function that decodes JSON configuration into
|
||||
// the typed config struct.
|
||||
func loadConfig(cfgJSON *extapi.JSON) (customDNSProviderConfig, error) {
|
||||
cfg := customDNSProviderConfig{}
|
||||
// handle the 'base case' where no configuration has been provided
|
||||
if cfgJSON == nil {
|
||||
return cfg, nil
|
||||
}
|
||||
if err := json.Unmarshal(cfgJSON.Raw, &cfg); err != nil {
|
||||
return cfg, fmt.Errorf("error decoding solver config: %v", err)
|
||||
}
|
||||
|
||||
return cfg, nil
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
|
||||
|
||||
container_bundle(
|
||||
name = "bundle",
|
||||
images = {
|
||||
"vault:bazel": "@com_hashicorp_vault//image",
|
||||
},
|
||||
tags = ["manual"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "package-srcs",
|
||||
srcs = glob(["**"]),
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:private"],
|
||||
)
|
||||
|
||||
filegroup(
|
||||
name = "all-srcs",
|
||||
srcs = [":package-srcs"],
|
||||
tags = ["automanaged"],
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
Executable
+39
@@ -0,0 +1,39 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
# Installs an instance of Vault using the Helm chart located in chart/
|
||||
# Configure the cluster to target using the KUBECONFIG environment variable.
|
||||
# Additional parameters can be configured by overriding the variables below.
|
||||
|
||||
# Namespace to deploy into
|
||||
NAMESPACE="${NAMESPACE:-vault}"
|
||||
# Release name to use with Helm
|
||||
RELEASE_NAME="${RELEASE_NAME:-vault}"
|
||||
# Image to use - by default uses a Bazel built image
|
||||
IMAGE="${IMAGE:-vault:bazel}"
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/../../lib/lib.sh"
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
|
||||
# Require helm available on PATH
|
||||
check_tool kubectl
|
||||
check_tool helm
|
||||
require_image "vault:bazel" "//devel/addon/vault:bundle"
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/bash
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2019 The Jetstack cert-manager contributors.
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
@@ -14,11 +14,13 @@
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/lib.sh"
|
||||
if ! command -v bazel &>/dev/null; then
|
||||
echo "Install bazel at https://bazel.build" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
"${KIND}" delete cluster --name="${KIND_CLUSTER_NAME}"
|
||||
bazel run //hack/bin:helm -- "$@"
|
||||
Executable
+26
@@ -0,0 +1,26 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
if ! command -v bazel &>/dev/null; then
|
||||
echo "Install bazel at https://bazel.build" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
bazel run //hack/bin:kind -- "$@"
|
||||
Executable
+26
@@ -0,0 +1,26 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
if ! command -v bazel &>/dev/null; then
|
||||
echo "Install bazel at https://bazel.build" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
bazel run //hack/bin:kubectl -- "$@"
|
||||
Executable
+40
@@ -0,0 +1,40 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
# This script will build an entirely new testing environment using kind.
|
||||
# This is inteded to be run in a CI environment and *not* for development.
|
||||
# It is not optimised for quick, iterative development.
|
||||
|
||||
SCRIPT_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" > /dev/null && pwd )"
|
||||
export REPO_ROOT="${SCRIPT_ROOT}/.."
|
||||
# Configure PATH to use bazel provided e2e tools
|
||||
export PATH="${SCRIPT_ROOT}/bin:$PATH"
|
||||
|
||||
echo "Ensuring a kind cluster exists..."
|
||||
"${SCRIPT_ROOT}/cluster/create.sh"
|
||||
|
||||
echo "Ensuring all e2e test dependencies are installed..."
|
||||
"${SCRIPT_ROOT}/setup-e2e-deps.sh"
|
||||
|
||||
echo "Running e2e test suite..."
|
||||
# Skip Venafi end-to-end tests in CI
|
||||
FLAKE_ATTEMPTS=2 "${SCRIPT_ROOT}/run-e2e.sh" \
|
||||
--ginkgo.skip=Venafi \
|
||||
"$@"
|
||||
@@ -0,0 +1,22 @@
|
||||
# this config file is similar to the default, except we set the cluster's
|
||||
# service cidr range to be 10.0.0.0/16.
|
||||
# we do this because we need a fixed/predictable clusterIP of 10.0.0.15 for the
|
||||
# nginx-ingress service, in order to perform HTTP01 validations during tests.
|
||||
|
||||
apiVersion: kind.sigs.k8s.io/v1alpha3
|
||||
kind: Cluster
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
# config generated by kind
|
||||
apiVersion: kubeadm.k8s.io/v1alpha2
|
||||
kind: MasterConfiguration
|
||||
metadata:
|
||||
name: config
|
||||
networking:
|
||||
serviceSubnet: 10.0.0.0/16
|
||||
kubeletConfiguration:
|
||||
baseConfig:
|
||||
clusterDNS:
|
||||
- 10.0.0.10
|
||||
nodes:
|
||||
- role: control-plane
|
||||
@@ -0,0 +1,18 @@
|
||||
# this config file is similar to the default, except we set the cluster's
|
||||
# service cidr range to be 10.0.0.0/16.
|
||||
# we do this because we need a fixed/predictable clusterIP of 10.0.0.15 for the
|
||||
# nginx-ingress service, in order to perform HTTP01 validations during tests.
|
||||
|
||||
apiVersion: kind.sigs.k8s.io/v1alpha3
|
||||
kind: Cluster
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
# config generated by kind
|
||||
apiVersion: kubeadm.k8s.io/v1alpha3
|
||||
kind: ClusterConfiguration
|
||||
metadata:
|
||||
name: config
|
||||
networking:
|
||||
serviceSubnet: 10.0.0.0/16
|
||||
nodes:
|
||||
- role: control-plane
|
||||
@@ -0,0 +1,18 @@
|
||||
# this config file is similar to the default, except we set the cluster's
|
||||
# service cidr range to be 10.0.0.0/16.
|
||||
# we do this because we need a fixed/predictable clusterIP of 10.0.0.15 for the
|
||||
# nginx-ingress service, in order to perform HTTP01 validations during tests.
|
||||
|
||||
apiVersion: kind.sigs.k8s.io/v1alpha3
|
||||
kind: Cluster
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
# config generated by kind
|
||||
apiVersion: kubeadm.k8s.io/v1beta1
|
||||
kind: ClusterConfiguration
|
||||
metadata:
|
||||
name: config
|
||||
networking:
|
||||
serviceSubnet: 10.0.0.0/16
|
||||
nodes:
|
||||
- role: control-plane
|
||||
@@ -0,0 +1,18 @@
|
||||
# this config file is similar to the default, except we set the cluster's
|
||||
# service cidr range to be 10.0.0.0/16.
|
||||
# we do this because we need a fixed/predictable clusterIP of 10.0.0.15 for the
|
||||
# nginx-ingress service, in order to perform HTTP01 validations during tests.
|
||||
|
||||
apiVersion: kind.sigs.k8s.io/v1alpha3
|
||||
kind: Cluster
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
# config generated by kind
|
||||
apiVersion: kubeadm.k8s.io/v1beta2
|
||||
kind: ClusterConfiguration
|
||||
metadata:
|
||||
name: config
|
||||
networking:
|
||||
serviceSubnet: 10.0.0.0/16
|
||||
nodes:
|
||||
- role: control-plane
|
||||
Executable
+83
@@ -0,0 +1,83 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/../lib/lib.sh"
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
|
||||
# Require helm available on PATH
|
||||
check_tool kind
|
||||
|
||||
export KIND_IMAGE_REPO="kindest/node"
|
||||
# Default Kubernetes version to use to 1.17
|
||||
export K8S_VERSION=${K8S_VERSION:-1.17}
|
||||
|
||||
# Compute the details of the kind image to use
|
||||
export KIND_IMAGE_SHA=""
|
||||
export KIND_IMAGE_CONFIG=""
|
||||
if [[ "$K8S_VERSION" =~ 1\.11 ]]; then
|
||||
# v1.11.10 @ sha256:e6f3dade95b7cb74081c5b9f3291aaaa6026a90a977e0b990778b6adc9ea6248
|
||||
KIND_IMAGE_SHA="sha256:e6f3dade95b7cb74081c5b9f3291aaaa6026a90a977e0b990778b6adc9ea6248"
|
||||
KIND_IMAGE_CONFIG="v1alpha2"
|
||||
elif [[ "$K8S_VERSION" =~ 1\.12 ]]; then
|
||||
# v1.12.10 @ sha256:68a6581f64b54994b824708286fafc37f1227b7b54cbb8865182ce1e036ed1cc
|
||||
KIND_IMAGE_SHA="sha256:68a6581f64b54994b824708286fafc37f1227b7b54cbb8865182ce1e036ed1cc"
|
||||
KIND_IMAGE_CONFIG="v1alpha3"
|
||||
elif [[ "$K8S_VERSION" =~ 1\.13 ]] ; then
|
||||
# v1.13.12 @sha256:5e8ae1a4e39f3d151d420ef912e18368745a2ede6d20ea87506920cd947a7e3a
|
||||
KIND_IMAGE_SHA="sha256:5e8ae1a4e39f3d151d420ef912e18368745a2ede6d20ea87506920cd947a7e3a"
|
||||
KIND_IMAGE_CONFIG="v1beta1"
|
||||
elif [[ "$K8S_VERSION" =~ 1\.14 ]] ; then
|
||||
# v1.14.10 @ sha256:81ae5a3237c779efc4dda43cc81c696f88a194abcc4f8fa34f86cf674aa14977
|
||||
KIND_IMAGE_SHA="sha256:81ae5a3237c779efc4dda43cc81c696f88a194abcc4f8fa34f86cf674aa14977"
|
||||
KIND_IMAGE_CONFIG="v1beta1"
|
||||
elif [[ "$K8S_VERSION" =~ 1\.15 ]] ; then
|
||||
# v1.15.7 @ sha256:e2df133f80ef633c53c0200114fce2ed5e1f6947477dbc83261a6a921169488d
|
||||
KIND_IMAGE_SHA="sha256:e2df133f80ef633c53c0200114fce2ed5e1f6947477dbc83261a6a921169488d"
|
||||
KIND_IMAGE_CONFIG="v1beta2"
|
||||
elif [[ "$K8S_VERSION" =~ 1\.16 ]] ; then
|
||||
# v1.16.4 @ sha256:b91a2c2317a000f3a783489dfb755064177dbc3a0b2f4147d50f04825d016f55
|
||||
KIND_IMAGE_SHA="sha256:b91a2c2317a000f3a783489dfb755064177dbc3a0b2f4147d50f04825d016f55"
|
||||
KIND_IMAGE_CONFIG="v1beta2"
|
||||
elif [[ "$K8S_VERSION" =~ 1\.17 ]] ; then
|
||||
# v1.17.0 @ sha256:9512edae126da271b66b990b6fff768fbb7cd786c7d39e86bdf55906352fdf62
|
||||
KIND_IMAGE_SHA="sha256:9512edae126da271b66b990b6fff768fbb7cd786c7d39e86bdf55906352fdf62"
|
||||
KIND_IMAGE_CONFIG="v1beta2"
|
||||
else
|
||||
echo "Unrecognised Kubernetes version '${K8S_VERSION}'! Aborting..."
|
||||
exit 1
|
||||
fi
|
||||
export KIND_IMAGE="${KIND_IMAGE_REPO}@${KIND_IMAGE_SHA}"
|
||||
echo "kind image details:"
|
||||
echo " repo: ${KIND_IMAGE_REPO}"
|
||||
echo " sha256: ${KIND_IMAGE_SHA}"
|
||||
echo " version: ${K8S_VERSION}"
|
||||
echo " config: ${KIND_IMAGE_CONFIG}"
|
||||
|
||||
if kind get clusters | grep "^$KIND_CLUSTER_NAME\$" &>/dev/null; then
|
||||
echo "Existing cluster '$KIND_CLUSTER_NAME' found, skipping creating cluster..."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Create the kind cluster
|
||||
kind create cluster \
|
||||
--config "${SCRIPT_ROOT}/config/${KIND_IMAGE_CONFIG}.yaml" \
|
||||
--image "${KIND_IMAGE}" \
|
||||
--name "${KIND_CLUSTER_NAME}"
|
||||
@@ -0,0 +1,68 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
export REPO_ROOT="$SCRIPT_ROOT/../.."
|
||||
|
||||
export SKIP_BUILD_ADDON_IMAGES="${SKIP_BUILD_ADDON_IMAGES:-}"
|
||||
export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-kind}"
|
||||
|
||||
# check_tool ensures that the tool with the given name is available, or advises
|
||||
# users to setup their PATH for the test/e3e/bin directory if not.
|
||||
check_tool() {
|
||||
tool="$1"
|
||||
if ! command -v "$tool" &>/dev/null; then
|
||||
echo "Install $tool or run: export PATH=\"$REPO_ROOT/devel/bin:\$PATH\"" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# check_bazel ensures that bazel is installed/available.
|
||||
check_bazel() {
|
||||
if ! command -v bazel &>/dev/null; then
|
||||
echo "Install bazel at https://bazel.build" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# require_image will attempt to ensure that the named docker image exists
|
||||
# within the kind cluster with name $KIND_CLUSTER_NAME.
|
||||
# If $SKIP_BUILD_ADDON_IMAGES is 'true', the image will not be built and a
|
||||
# warning message will be printed instead.
|
||||
require_image() {
|
||||
IMAGE_NAME="$1"
|
||||
BAZEL_TARGET="$2"
|
||||
# Skip building and loading the image if SKIP_BUILD_ADDON_IMAGES=true
|
||||
if [ "${SKIP_BUILD_ADDON_IMAGES:-}" == "true" ]; then
|
||||
echo "Skipping building and loading image '$IMAGE_NAME' because SKIP_BUILD_ADDON_IMAGES=true"
|
||||
return
|
||||
fi
|
||||
|
||||
# Ensure bazel is available
|
||||
check_bazel
|
||||
# Ensure kind is available
|
||||
check_tool kind
|
||||
|
||||
# Build and export the docker image
|
||||
bazel run --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 "${BAZEL_TARGET}"
|
||||
|
||||
# Load the image into the kind cluster
|
||||
kind load docker-image --name "$KIND_CLUSTER_NAME" "$IMAGE_NAME"
|
||||
}
|
||||
Executable
+42
@@ -0,0 +1,42 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
# This script will run the end-to-end test suite against an already configured
|
||||
# kind cluster.
|
||||
# If a cluster does not already exist, create one with 'cluster/create.sh'.
|
||||
|
||||
export SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/lib/lib.sh"
|
||||
|
||||
check_bazel
|
||||
|
||||
mkdir -p "${REPO_ROOT}/_artifacts"
|
||||
bazel build //hack/bin:helm //test/e2e:e2e.test
|
||||
# Set KUBECONFIG environment variable if not already set
|
||||
export KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}"
|
||||
# Run e2e tests
|
||||
bazel run @com_github_onsi_ginkgo//ginkgo -- \
|
||||
-nodes 10 \
|
||||
-flakeAttempts ${FLAKE_ATTEMPTS:-1} \
|
||||
$(bazel info bazel-genfiles)/test/e2e/e2e.test \
|
||||
-- \
|
||||
--repo-root="${REPO_ROOT}" \
|
||||
--report-dir="${ARTIFACTS:-$REPO_ROOT/_artifacts}" \
|
||||
"$@"
|
||||
Executable
+43
@@ -0,0 +1,43 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2020 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o nounset
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
# This script will load end-to-end test dependencies into the kind cluster, as
|
||||
# well as installing all 'global' components such as cert-manager itself,
|
||||
# pebble, ingress-nginx etc.
|
||||
# If you are running the *full* test suite, you should be sure to run this
|
||||
# script beforehand.
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")
|
||||
export REPO_ROOT="${REPO_ROOT:-$SCRIPT_ROOT/..}"
|
||||
|
||||
echo "Installing cert-manager into the kind cluster..."
|
||||
"${SCRIPT_ROOT}/addon/certmanager/install.sh"
|
||||
|
||||
echo "Installing sample-webhook into the kind cluster..."
|
||||
"${SCRIPT_ROOT}/addon/samplewebhook/install.sh"
|
||||
|
||||
echo "Installing pebble into the kind cluster..."
|
||||
"${SCRIPT_ROOT}/addon/pebble/install.sh"
|
||||
|
||||
echo "Installing ingress-nginx into the kind cluster..."
|
||||
"${SCRIPT_ROOT}/addon/ingressnginx/install.sh"
|
||||
|
||||
echo "Loading vault into the kind cluster..."
|
||||
"${SCRIPT_ROOT}/addon/vault/install.sh"
|
||||
+8
-70
@@ -109,8 +109,8 @@ def install_helm():
|
||||
## the version numbers in these rules.
|
||||
http_archive(
|
||||
name = "helm_darwin",
|
||||
sha256 = "f51830036f746b7f758a40bf49e02527cc5a9f1b78c5809023e570d318eaff5c",
|
||||
urls = ["https://get.helm.sh/helm-v2.15.1-darwin-amd64.tar.gz"],
|
||||
sha256 = "05c7748da0ea8d5f85576491cd3c615f94063f20986fd82a0f5658ddc286cdb1",
|
||||
urls = ["https://get.helm.sh/helm-v3.0.2-darwin-amd64.tar.gz"],
|
||||
build_file_content =
|
||||
"""
|
||||
filegroup(
|
||||
@@ -125,8 +125,8 @@ filegroup(
|
||||
|
||||
http_archive(
|
||||
name = "helm_linux",
|
||||
sha256 = "b4d366bd6625477b2954941aeb7b601946aa4226af6728e3a84eac4e62a84042",
|
||||
urls = ["https://get.helm.sh/helm-v2.15.1-linux-amd64.tar.gz"],
|
||||
sha256 = "c6b7aa7e4ffc66e8abb4be328f71d48c643cb8f398d95c74d075cfb348710e1d",
|
||||
urls = ["https://get.helm.sh/helm-v3.0.2-linux-amd64.tar.gz"],
|
||||
build_file_content =
|
||||
"""
|
||||
filegroup(
|
||||
@@ -141,20 +141,6 @@ filegroup(
|
||||
|
||||
# Define rules for different kubectl versions
|
||||
def install_kubectl():
|
||||
http_file(
|
||||
name = "kubectl_1_11_darwin",
|
||||
executable = 1,
|
||||
sha256 = "cf1feeac2fdedfb069131e7d62735b99b49ec43bf0d7565a30379c35056906c4",
|
||||
urls = ["https://storage.googleapis.com/kubernetes-release/release/v1.11.3/bin/darwin/amd64/kubectl"],
|
||||
)
|
||||
|
||||
http_file(
|
||||
name = "kubectl_1_11_linux",
|
||||
executable = 1,
|
||||
sha256 = "0d4c70484e90d4310f03f997b4432e0a97a7f5b5be5c31d281f3d05919f8b46c",
|
||||
urls = ["https://storage.googleapis.com/kubernetes-release/release/v1.11.3/bin/linux/amd64/kubectl"],
|
||||
)
|
||||
|
||||
http_file(
|
||||
name = "kubectl_1_12_darwin",
|
||||
executable = 1,
|
||||
@@ -231,61 +217,13 @@ def install_kind():
|
||||
http_file(
|
||||
name = "kind_darwin",
|
||||
executable = 1,
|
||||
sha256 = "023f1886207132dcfc62139a86f09488a79210732b00c9ec6431d6f6b7e9d2d3",
|
||||
urls = ["https://github.com/kubernetes-sigs/kind/releases/download/v0.4.0/kind-darwin-amd64"],
|
||||
sha256 = "11b8a7fda7c9d6230f0f28ffe57831a7227c0655dfb8d38e838e8f03db6612de",
|
||||
urls = ["https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-darwin-amd64"],
|
||||
)
|
||||
|
||||
http_file(
|
||||
name = "kind_linux",
|
||||
executable = 1,
|
||||
sha256 = "a97f7d6d97bc0e261ea85433ca564269f117baf0fae051f16b296d2d7541f8dd",
|
||||
urls = ["https://github.com/kubernetes-sigs/kind/releases/download/v0.4.0/kind-linux-amd64"],
|
||||
)
|
||||
|
||||
container_pull(
|
||||
name = "kind-1.11",
|
||||
registry = "index.docker.io",
|
||||
repository = "kindest/node",
|
||||
tag = "v1.11.10",
|
||||
digest = "sha256:176845d919899daef63d0dbd1cf62f79902c38b8d2a86e5fa041e491ab795d33",
|
||||
)
|
||||
|
||||
container_pull(
|
||||
name = "kind-1.12",
|
||||
registry = "index.docker.io",
|
||||
repository = "kindest/node",
|
||||
tag = "v1.12.9",
|
||||
digest = "sha256:bcb79eb3cd6550c1ba9584ce57c832dcd6e442913678d2785307a7ad9addc029",
|
||||
)
|
||||
|
||||
container_pull(
|
||||
name = "kind-1.13",
|
||||
registry = "index.docker.io",
|
||||
repository = "kindest/node",
|
||||
tag = "v1.13.7",
|
||||
digest = "sha256:f3f1cfc2318d1eb88d91253a9c5fa45f6e9121b6b1e65aea6c7ef59f1549aaaf",
|
||||
)
|
||||
|
||||
container_pull(
|
||||
name = "kind-1.14",
|
||||
registry = "index.docker.io",
|
||||
repository = "kindest/node",
|
||||
tag = "v1.14.3",
|
||||
digest = "sha256:583166c121482848cd6509fbac525dd62d503c52a84ff45c338ee7e8b5cfe114",
|
||||
)
|
||||
|
||||
container_pull(
|
||||
name = "kind-1.15",
|
||||
registry = "index.docker.io",
|
||||
repository = "kindest/node",
|
||||
tag = "v1.15.0",
|
||||
digest = "sha256:b4d092fd2b507843dd096fe6c85d06a27a0cbd740a0b32a880fe61aba24bb478",
|
||||
)
|
||||
|
||||
container_pull(
|
||||
name = "kind-1.16",
|
||||
registry = "eu.gcr.io",
|
||||
repository = "jetstack-build-infra-images/kind-node",
|
||||
tag = "1.16.0-alpha.1",
|
||||
digest = "sha256:b9775b688fda2e6434cda1b9016baf876f381a8325961f59b9ae238166259885",
|
||||
sha256 = "0e07d5a9d5b8bf410a1ad8a7c8c9c2ea2a4b19eda50f1c629f1afadb7c80fae7",
|
||||
urls = ["https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-linux-amd64"],
|
||||
)
|
||||
|
||||
@@ -1,60 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
# build_images will build Docker images for all of cert-manager's components.
|
||||
# It will transfer them to the 'kind' docker container so they are available
|
||||
# in a testing environment.
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/lib.sh"
|
||||
|
||||
build_images() {
|
||||
# Build cert-manager binaries & docker image
|
||||
# Set --stamp=true when running a build to workaround issues introduced
|
||||
# in bazelbuild/rules_go#2110. For more information, see: https://github.com/bazelbuild/rules_go/pull/2110#issuecomment-508713878
|
||||
# We should be able to remove the `--stamp=true` arg once this has been fixed!
|
||||
APP_VERSION="${DOCKER_TAG}" \
|
||||
DOCKER_REPO="${DOCKER_REPO}" \
|
||||
DOCKER_TAG="${DOCKER_TAG}" \
|
||||
bazel run --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 --stamp=true //test/e2e:images
|
||||
|
||||
echo "All images built"
|
||||
|
||||
for IMG in \
|
||||
"${DOCKER_REPO}"/cert-manager-controller:"${DOCKER_TAG}" \
|
||||
"${DOCKER_REPO}"/cert-manager-cainjector:"${DOCKER_TAG}" \
|
||||
"${DOCKER_REPO}"/cert-manager-acmesolver:"${DOCKER_TAG}" \
|
||||
"${DOCKER_REPO}"/cert-manager-webhook:"${DOCKER_TAG}" \
|
||||
"pebble:bazel" \
|
||||
"quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1" \
|
||||
"k8s.gcr.io/defaultbackend-amd64:bazel" \
|
||||
"sample-webhook:bazel" \
|
||||
"vault:bazel" \
|
||||
"gcr.io/kubernetes-helm/tiller:bazel" \
|
||||
; do
|
||||
echo "Loading image ${IMG} into kind container"
|
||||
"${KIND}" load docker-image --name "${KIND_CLUSTER_NAME}" "${IMG}" &
|
||||
done
|
||||
echo "Waiting for all images to be loaded..."
|
||||
wait
|
||||
echo "All images loaded!"
|
||||
}
|
||||
|
||||
build_images
|
||||
@@ -1,62 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/lib.sh"
|
||||
|
||||
# deploy_kind will deploy a kubernetes-in-docker cluster
|
||||
deploy_kind() {
|
||||
echo "Exporting kind image to docker daemon..."
|
||||
bazel run "${KIND_IMAGE_TARGET}"
|
||||
|
||||
function kubeVersion() {
|
||||
echo $(docker run \
|
||||
--entrypoint="cat" \
|
||||
"${KIND_IMAGE}" \
|
||||
/kind/version)
|
||||
}
|
||||
|
||||
# default to v1beta2
|
||||
# - if 1.13.x or 1.14.x use v1beta1
|
||||
# - if 1.12.x then use v1alpha3
|
||||
# - if 1.11.x then use v1alpha2
|
||||
vers="$(kubeVersion)"
|
||||
config="v1beta2"
|
||||
if [[ "$vers" =~ v1\.11\..+ ]]; then
|
||||
config="v1alpha2"
|
||||
fi
|
||||
if [[ "$vers" =~ v1\.12\..+ ]]; then
|
||||
config="v1alpha3"
|
||||
fi
|
||||
if [[ "$vers" =~ v1\.1[3-4]\..+ ]] ; then
|
||||
config="v1beta1"
|
||||
fi
|
||||
|
||||
|
||||
echo "Booting Kubernetes version: $vers"
|
||||
echo "Using kubeadm config api version '$config'"
|
||||
# create the kind cluster
|
||||
"${KIND}" create cluster \
|
||||
--name="${KIND_CLUSTER_NAME}" \
|
||||
--image="${KIND_IMAGE}" \
|
||||
--config "${REPO_ROOT}"/test/fixtures/kind/config-"$config".yaml
|
||||
}
|
||||
|
||||
deploy_kind
|
||||
@@ -1,56 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
_SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
REPO_ROOT="${_SCRIPT_ROOT}/../../.."
|
||||
|
||||
# This file contains common definitions that are re-used in other scripts
|
||||
|
||||
export K8S_VERSION="${K8S_VERSION:-1.15}"
|
||||
KUBECTL_TARGET="${KUBECTL_TARGET:-//hack/bin:kubectl-${K8S_VERSION}}"
|
||||
KIND_IMAGE_TARGET="${KIND_IMAGE_TARGET:-@kind-${K8S_VERSION}//image}"
|
||||
|
||||
export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-cm-local-cluster}"
|
||||
export KIND_CONTAINER_NAME="kind-${KIND_CLUSTER_NAME}-control-plane"
|
||||
|
||||
# DOCKER_REPO is the docker repo to use for cert-manager images, either when
|
||||
# building or deploying cert-manager using these scripts.
|
||||
export DOCKER_REPO="quay.io/jetstack"
|
||||
|
||||
# DOCKER_TAG is the docker tag to use for the cert-manager images.
|
||||
# This defaults to 'build' so it doesn't conflict with images built for any
|
||||
# other purpose
|
||||
export DOCKER_TAG="build"
|
||||
|
||||
if [ ! "${CM_DEPS_LOADED:-}" = "1" ]; then
|
||||
# Build all e2e test dependencies
|
||||
bazel build \
|
||||
"${KUBECTL_TARGET}" \
|
||||
"${KIND_IMAGE_TARGET}" \
|
||||
//hack/bin:kind
|
||||
|
||||
genfiles="$(bazel info bazel-genfiles)"
|
||||
export KUBECTL="${genfiles}/hack/bin/kubectl-${K8S_VERSION}"
|
||||
# TODO: use a more unique name for the kind image
|
||||
export KIND_IMAGE="bazel/image:image"
|
||||
export KIND="${genfiles}/hack/bin/kind"
|
||||
|
||||
export CM_DEPS_LOADED="1"
|
||||
fi
|
||||
@@ -1,75 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# This script will provision a development environment using kind on your local
|
||||
# machine.
|
||||
# The end result should be an environment that can pass e2e tests.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/lib/lib.sh"
|
||||
|
||||
echo "+++ Creating cluster using kind"
|
||||
"${SCRIPT_ROOT}/lib/cluster_create.sh"
|
||||
|
||||
echo "+++ Building cert-manager images from source and exporting them to the development cluster"
|
||||
"${SCRIPT_ROOT}/lib/build_images.sh"
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo "Your development environment is now ready."
|
||||
echo
|
||||
echo "A single node Kubernetes cluster has been provisioned in a Docker container"
|
||||
echo "on your machine."
|
||||
echo ""
|
||||
echo "You should now configure your shell to use the KUBECONFIG file that has"
|
||||
echo "been generated in order to access this cluster:"
|
||||
echo ""
|
||||
echo " export KUBECONFIG=\$HOME/.kube/kind-config-${KIND_CLUSTER_NAME}"
|
||||
echo ""
|
||||
echo ""
|
||||
echo "A freshly built copy of the cert-manager images have also been exported to"
|
||||
echo "the docker daemon in this single node Kubernetes cluster."
|
||||
echo ""
|
||||
echo "You can build and export a fresh copy of these images with:"
|
||||
echo ""
|
||||
echo " ./hack/ci/lib/build_images.sh"
|
||||
echo ""
|
||||
echo ""
|
||||
echo "You should now be able to run end-to-end tests using:"
|
||||
echo ""
|
||||
echo " make e2e_test"
|
||||
echo ""
|
||||
echo ""
|
||||
echo "We have \*\*not\*\* automatically deployed cert-manager into this cluster."
|
||||
echo "To deploy cert-manager into this cluster, run:"
|
||||
echo ""
|
||||
echo " bazel run //hack/bin:helm -- install \\"
|
||||
echo " --name cert-manager \\"
|
||||
echo " --namespace cert-manager \\"
|
||||
echo " --values ./test/fixtures/cert-manager-values.yaml \\"
|
||||
echo " ./deploy/charts/cert-manager"
|
||||
echo ""
|
||||
echo ""
|
||||
echo "Each time you make a change and run build_images.sh, you will need to manually"
|
||||
echo "delete the cert-manager pod that is deployed in the cert-manager namespace."
|
||||
echo ""
|
||||
echo "Thanks for contributing!"
|
||||
echo ""
|
||||
echo ""
|
||||
+2
-21
@@ -25,25 +25,6 @@ set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")
|
||||
source "${SCRIPT_ROOT}/lib/lib.sh"
|
||||
|
||||
cleanup() {
|
||||
# Ignore errors here
|
||||
"${SCRIPT_ROOT}/lib/cluster_destroy.sh" || true
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
"${SCRIPT_ROOT}/lib/cluster_create.sh"
|
||||
|
||||
export KUBECONFIG="${HOME}/.kube/kind-config-${KIND_CLUSTER_NAME}"
|
||||
|
||||
echo "Testing kind apiserver connectivity"
|
||||
# Ensure the apiserver is responding
|
||||
"${KUBECTL}" get nodes
|
||||
|
||||
"${SCRIPT_ROOT}/lib/build_images.sh"
|
||||
|
||||
make e2e_test \
|
||||
KUBECONFIG="${KUBECONFIG}" \
|
||||
KUBECTL="${KUBECTL}" \
|
||||
FLAKE_ATTEMPTS="${FLAKE_ATTEMPTS:-1}"
|
||||
echo "DEPRECATED: This script will be removed. Invoke './devel/ci-run-e2e.sh' directly instead."
|
||||
"${SCRIPT_ROOT}/../../devel/ci-run-e2e.sh"
|
||||
|
||||
@@ -1,36 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2019 The Jetstack cert-manager contributors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# This file is the entrypoint to our legacy minikube e2e testing environment
|
||||
# for cert-manager. It is currently used to run e2e test jobs against a
|
||||
# 1.9 or lower minikube built cluster.
|
||||
# This script should not be used for anything except for our CI process.
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
# Build images while we wait for services to start
|
||||
make images APP_VERSION=build
|
||||
|
||||
# Wait for e2e service dependencies
|
||||
echo "Waiting for minikube cluster to be ready..."
|
||||
|
||||
while true; do if kubectl get nodes; then break; fi; echo "Waiting 5s for kubernetes to be ready..."; sleep 5; done
|
||||
|
||||
echo "Running e2e tests"
|
||||
# Skip RBAC tests as they do not pass on Kubernetes <1.9
|
||||
make e2e_test GINKGO_SKIP="RBAC"
|
||||
Reference in New Issue
Block a user