From 355369afa677b60de0288e4ef8f384107ee12ea4 Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Tue, 21 Jan 2020 12:33:45 +0000 Subject: [PATCH] Create devel directory and use it for e2e tests Signed-off-by: James Munnelly --- BUILD.bazel | 1 + Makefile | 18 -- devel/BUILD.bazel | 20 +++ devel/README.md | 100 +++++++++++ devel/addon/README.md | 11 ++ devel/addon/certmanager/BUILD.bazel | 26 +++ devel/addon/certmanager/install.sh | 63 +++++++ devel/addon/ingressnginx/BUILD.bazel | 24 +++ devel/addon/ingressnginx/install.sh | 61 +++++++ devel/addon/pebble/BUILD.bazel | 40 +++++ devel/addon/pebble/chart/.helmignore | 21 +++ devel/addon/pebble/chart/Chart.yaml | 4 + .../addon/pebble/chart/templates/_helpers.tpl | 16 ++ .../pebble/chart/templates/configmap.yaml | 73 ++++++++ .../pebble/chart/templates/deployment.yaml | 49 ++++++ .../addon/pebble/chart/templates/service.yaml | 19 ++ devel/addon/pebble/chart/values.yaml | 16 ++ devel/addon/pebble/install.sh | 50 ++++++ devel/addon/samplewebhook/BUILD.bazel | 26 +++ devel/addon/samplewebhook/chart/.helmignore | 21 +++ devel/addon/samplewebhook/chart/Chart.yaml | 5 + .../samplewebhook/chart/templates/NOTES.txt | 0 .../chart/templates/_helpers.tpl | 48 ++++++ .../chart/templates/apiservice.yaml | 19 ++ .../chart/templates/deployment.yaml | 68 ++++++++ .../samplewebhook/chart/templates/pki.yaml | 76 ++++++++ .../samplewebhook/chart/templates/rbac.yaml | 111 ++++++++++++ .../chart/templates/service.yaml | 19 ++ devel/addon/samplewebhook/chart/values.yaml | 43 +++++ devel/addon/samplewebhook/install.sh | 49 ++++++ devel/addon/samplewebhook/sample/BUILD.bazel | 43 +++++ devel/addon/samplewebhook/sample/main.go | 163 ++++++++++++++++++ devel/addon/vault/BUILD.bazel | 23 +++ devel/addon/vault/install.sh | 39 +++++ .../lib/cluster_destroy.sh => devel/bin/helm | 14 +- devel/bin/kind | 26 +++ devel/bin/kubectl | 26 +++ devel/ci-run-e2e.sh | 40 +++++ devel/cluster/config/v1alpha2.yaml | 22 +++ devel/cluster/config/v1alpha3.yaml | 18 ++ devel/cluster/config/v1beta1.yaml | 18 ++ devel/cluster/config/v1beta2.yaml | 18 ++ devel/cluster/create.sh | 83 +++++++++ devel/lib/lib.sh | 68 ++++++++ devel/run-e2e.sh | 42 +++++ devel/setup-e2e-deps.sh | 43 +++++ hack/bin/deps.bzl | 78 +-------- hack/ci/lib/build_images.sh | 60 ------- hack/ci/lib/cluster_create.sh | 62 ------- hack/ci/lib/lib.sh | 56 ------ hack/ci/run-dev-kind.sh | 75 -------- hack/ci/run-e2e-kind.sh | 23 +-- hack/ci/run-e2e-minikube.sh | 36 ---- 53 files changed, 1769 insertions(+), 404 deletions(-) create mode 100644 devel/BUILD.bazel create mode 100644 devel/README.md create mode 100644 devel/addon/README.md create mode 100644 devel/addon/certmanager/BUILD.bazel create mode 100755 devel/addon/certmanager/install.sh create mode 100644 devel/addon/ingressnginx/BUILD.bazel create mode 100755 devel/addon/ingressnginx/install.sh create mode 100644 devel/addon/pebble/BUILD.bazel create mode 100644 devel/addon/pebble/chart/.helmignore create mode 100644 devel/addon/pebble/chart/Chart.yaml create mode 100644 devel/addon/pebble/chart/templates/_helpers.tpl create mode 100644 devel/addon/pebble/chart/templates/configmap.yaml create mode 100644 devel/addon/pebble/chart/templates/deployment.yaml create mode 100644 devel/addon/pebble/chart/templates/service.yaml create mode 100644 devel/addon/pebble/chart/values.yaml create mode 100755 devel/addon/pebble/install.sh create mode 100644 devel/addon/samplewebhook/BUILD.bazel create mode 100644 devel/addon/samplewebhook/chart/.helmignore create mode 100644 devel/addon/samplewebhook/chart/Chart.yaml create mode 100644 devel/addon/samplewebhook/chart/templates/NOTES.txt create mode 100644 devel/addon/samplewebhook/chart/templates/_helpers.tpl create mode 100644 devel/addon/samplewebhook/chart/templates/apiservice.yaml create mode 100644 devel/addon/samplewebhook/chart/templates/deployment.yaml create mode 100644 devel/addon/samplewebhook/chart/templates/pki.yaml create mode 100644 devel/addon/samplewebhook/chart/templates/rbac.yaml create mode 100644 devel/addon/samplewebhook/chart/templates/service.yaml create mode 100644 devel/addon/samplewebhook/chart/values.yaml create mode 100755 devel/addon/samplewebhook/install.sh create mode 100644 devel/addon/samplewebhook/sample/BUILD.bazel create mode 100644 devel/addon/samplewebhook/sample/main.go create mode 100644 devel/addon/vault/BUILD.bazel create mode 100755 devel/addon/vault/install.sh rename hack/ci/lib/cluster_destroy.sh => devel/bin/helm (73%) create mode 100755 devel/bin/kind create mode 100755 devel/bin/kubectl create mode 100755 devel/ci-run-e2e.sh create mode 100644 devel/cluster/config/v1alpha2.yaml create mode 100644 devel/cluster/config/v1alpha3.yaml create mode 100644 devel/cluster/config/v1beta1.yaml create mode 100644 devel/cluster/config/v1beta2.yaml create mode 100755 devel/cluster/create.sh create mode 100644 devel/lib/lib.sh create mode 100755 devel/run-e2e.sh create mode 100755 devel/setup-e2e-deps.sh delete mode 100755 hack/ci/lib/build_images.sh delete mode 100755 hack/ci/lib/cluster_create.sh delete mode 100644 hack/ci/lib/lib.sh delete mode 100755 hack/ci/run-dev-kind.sh delete mode 100755 hack/ci/run-e2e-minikube.sh diff --git a/BUILD.bazel b/BUILD.bazel index f4125270a..0e09c6fdc 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -50,6 +50,7 @@ filegroup( "//cmd/controller:all-srcs", "//cmd/webhook:all-srcs", "//deploy:all-srcs", + "//devel:all-srcs", "//hack:all-srcs", "//pkg/acme:all-srcs", "//pkg/api:all-srcs", diff --git a/Makefile b/Makefile index 82d3893ad..2031f9661 100644 --- a/Makefile +++ b/Makefile @@ -86,24 +86,6 @@ $(CMDS): bazel build \ //cmd/$@ -e2e_test: - mkdir -p "$$(pwd)/_artifacts" - bazel build //hack/bin:helm //test/e2e:e2e.test - # Run e2e tests - KUBECONFIG=$(KUBECONFIG) \ - bazel run @com_github_onsi_ginkgo//ginkgo -- \ - -nodes 10 \ - -flakeAttempts $(FLAKE_ATTEMPTS) \ - $$(bazel info bazel-genfiles)/test/e2e/e2e.test \ - -- \ - --helm-binary-path=$$(bazel info bazel-genfiles)/hack/bin/helm \ - --repo-root="$$(pwd)" \ - --report-dir="$${ARTIFACTS:-./_artifacts}" \ - --ginkgo.skip="$(GINKGO_SKIP)" \ - --ginkgo.focus="$(GINKGO_FOCUS)" \ - --skip-globals=$(SKIP_GLOBALS) \ - --kubectl-path="$(KUBECTL)" - # Generate targets ################## generate: diff --git a/devel/BUILD.bazel b/devel/BUILD.bazel new file mode 100644 index 000000000..710dad719 --- /dev/null +++ b/devel/BUILD.bazel @@ -0,0 +1,20 @@ +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [ + ":package-srcs", + "//devel/addon/certmanager:all-srcs", + "//devel/addon/ingressnginx:all-srcs", + "//devel/addon/pebble:all-srcs", + "//devel/addon/samplewebhook:all-srcs", + "//devel/addon/vault:all-srcs", + ], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/devel/README.md b/devel/README.md new file mode 100644 index 000000000..fae3db7b9 --- /dev/null +++ b/devel/README.md @@ -0,0 +1,100 @@ +# Development tooling + +This directory contains tools and scripts used to create development and +testing environments for cert-manager. + +## Tool dependencies + +The scripts in this directory commonly require additional tooling, such as +access to `kubectl`, `helm`, `kind` and a bunch of other things. + +If you already have these tools available on your host system, the scripts +should just work, so long as the versions you have installed are roughly +compatible. + +If you are running into issues with your host-installed tools, Bazel provides +versioned access to all of the required tools for the e3e scripts. + +To setup your shell to use the Bazel provided versions of these tools, run the +following from the **root of the repository**: + +```console +export PATH="$(pwd)/devel/bin:$PATH" +``` + +## Common usages + +This section describes common usage patterns for development and testing. + +### Creating a kind cluster + +To create a kind cluster that can be used for both development and testing, run +`./devel/cluster/create.sh` from the root of the cert-manager repository: + +```console +./devel/cluster/create.sh +``` + +You can change the name of the kind cluster created by setting: + +```console +export KIND_CLUSTER_NAME=custom-cluster-name +``` + +If a cluster with the same name already exists, it will **not** be recreated +and instead will be reused. + +### Installing a development build of cert-manager + +Once you have a kind cluster running, you can install a development version of +cert-manager by running: + +```console +./devel/addon/certmanager/install.sh +``` + +This will build, load and install cert-manager from source into your kind +development cluster. + +Further invocations of the `install.sh` script will rebuild and upgrade the +installed version of cert-manager, making it possible to iteratively work on +the codebase and test changes. + +### Running end-to-end tests + +Before running the end-to-end tests, you must install some additional +components used during the tests into your kind cluster. + +Run the following to setup persistent test instances of Pebble, ingress-nginx, +and a sample DNS01 webhook: + +```console +./devel/setup-e2e-deps.sh +``` + +You only need to run this command once for the lifetime of your test cluster. + +If you haven't already, deploy a new test build of cert-manager: + +```console +./devel/addon/certmanager/install.sh +``` + +Finally, run the end-to-test tests using: + +```console +./devel/run-e2e.sh +``` + +You can run this command multiple times against the same cluster without +adverse effects. + +### Deleting the test cluster + +Once you have finished with your testing environment, or if you have +encountered a strange state you cannot recover from, you can tear down the +testing environment by using `kind` directly: + +```console +kind delete cluster [--name=$KIND_CLUSTER_NAME] +``` diff --git a/devel/addon/README.md b/devel/addon/README.md new file mode 100644 index 000000000..501399cf3 --- /dev/null +++ b/devel/addon/README.md @@ -0,0 +1,11 @@ +# End-to-end test addons + +This directory contains code for deploying instances of addons used during +end-to-end tests and whilst developing. + +This includes things like [Vault](https://www.vaultproject.io/), +[ingress-nginx](https://github.com/kubernetes/ingress-nginx) and +[Pebble](https://github.com/letsencrypt/pebble) amongst others. + +These tools are designed to be easily reusable during tests or by developers +when testing out new features or writing tests. diff --git a/devel/addon/certmanager/BUILD.bazel b/devel/addon/certmanager/BUILD.bazel new file mode 100644 index 000000000..c02127cb3 --- /dev/null +++ b/devel/addon/certmanager/BUILD.bazel @@ -0,0 +1,26 @@ +load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle") + +container_bundle( + name = "bundle", + images = { + "{STABLE_DOCKER_REPO}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//cmd/controller:image", + "{STABLE_DOCKER_REPO}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//cmd/acmesolver:image", + "{STABLE_DOCKER_REPO}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//cmd/webhook:image", + "{STABLE_DOCKER_REPO}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//cmd/cainjector:image", + }, + tags = ["manual"], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/devel/addon/certmanager/install.sh b/devel/addon/certmanager/install.sh new file mode 100755 index 000000000..5b08cb05e --- /dev/null +++ b/devel/addon/certmanager/install.sh @@ -0,0 +1,63 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +# Namespace to deploy into +NAMESPACE="${NAMESPACE:-cert-manager}" +# Release name to use with Helm +RELEASE_NAME="${RELEASE_NAME:-cert-manager}" + +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") +source "${SCRIPT_ROOT}/../../lib/lib.sh" +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") + +# Require kubectl & helm available on PATH +check_tool kubectl +check_tool helm + +# Use the current timestamp as the APP_VERSION so a rolling update will be +# triggered on every call to this script. +export APP_VERSION="$(date +"%s")" +# Build a copy of the cert-manager release images using the :bazel image tag +bazel run --stamp=true --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 "//devel/addon/certmanager:bundle" + +# Load all images into the kind cluster +kind load docker-image --name "$KIND_CLUSTER_NAME" "quay.io/jetstack/cert-manager-controller:${APP_VERSION}" & +kind load docker-image --name "$KIND_CLUSTER_NAME" "quay.io/jetstack/cert-manager-acmesolver:${APP_VERSION}" & +kind load docker-image --name "$KIND_CLUSTER_NAME" "quay.io/jetstack/cert-manager-cainjector:${APP_VERSION}" & +kind load docker-image --name "$KIND_CLUSTER_NAME" "quay.io/jetstack/cert-manager-webhook:${APP_VERSION}" & + +wait + +# Ensure the pebble namespace exists +kubectl get namespace "${NAMESPACE}" || kubectl create namespace "${NAMESPACE}" + +# Install a copy of the CRDs +kubectl apply -f "${REPO_ROOT}/deploy/charts/cert-manager/crds/" + +# Upgrade or install Pebble +helm upgrade \ + --install \ + --wait \ + --namespace "${NAMESPACE}" \ + --set image.tag="${APP_VERSION}" \ + --set cainjector.image.tag="${APP_VERSION}" \ + --set webhook.image.tag="${APP_VERSION}" \ + "$RELEASE_NAME" \ + "$REPO_ROOT/deploy/charts/cert-manager" diff --git a/devel/addon/ingressnginx/BUILD.bazel b/devel/addon/ingressnginx/BUILD.bazel new file mode 100644 index 000000000..9bb21871c --- /dev/null +++ b/devel/addon/ingressnginx/BUILD.bazel @@ -0,0 +1,24 @@ +load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle") + +container_bundle( + name = "bundle", + images = { + "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1": "@io_kubernetes_ingress-nginx//image", + "k8s.gcr.io/defaultbackend-amd64:bazel": "@io_gcr_k8s_defaultbackend//image", + }, + tags = ["manual"], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/devel/addon/ingressnginx/install.sh b/devel/addon/ingressnginx/install.sh new file mode 100755 index 000000000..e72008542 --- /dev/null +++ b/devel/addon/ingressnginx/install.sh @@ -0,0 +1,61 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +# Installs an instance of ingress-nginx using the 'stable' Helm chart. +# Configure the cluster to target using the KUBECONFIG environment variable. +# Additional parameters can be configured by overriding the variables below. + +# Namespace to deploy into +NAMESPACE="${NAMESPACE:-ingress-nginx}" +# Release name to use with Helm +RELEASE_NAME="${RELEASE_NAME:-ingress-nginx}" + +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") +source "${SCRIPT_ROOT}/../../lib/lib.sh" +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") + +# Require helm available on PATH +check_tool kubectl +check_tool helm +require_image "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1" "//devel/addon/ingressnginx:bundle" +require_image "k8s.gcr.io/defaultbackend-amd64:bazel" "//devel/addon/ingressnginx:bundle" + +# Ensure the pebble namespace exists +kubectl get namespace "${NAMESPACE}" || kubectl create namespace "${NAMESPACE}" + +helm repo add stable https://kubernetes-charts.storage.googleapis.com + +helm repo update + +# Upgrade or install Pebble +helm upgrade \ + --install \ + --wait \ + --version 1.23.0 \ + --namespace "${NAMESPACE}" \ + --set controller.image.tag=0.26.1 \ + --set controller.image.pullPolicy=Never \ + --set defaultBackend.image.tag=bazel \ + --set defaultBackend.image.pullPolicy=Never \ + --set controller.service.clusterIP=10.0.0.15 \ + --set controller.service.type=ClusterIP \ + --set controller.config.no-tls-redirect-locations="" \ + "$RELEASE_NAME" \ + stable/nginx-ingress diff --git a/devel/addon/pebble/BUILD.bazel b/devel/addon/pebble/BUILD.bazel new file mode 100644 index 000000000..0da887d61 --- /dev/null +++ b/devel/addon/pebble/BUILD.bazel @@ -0,0 +1,40 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_binary") +load("@io_bazel_rules_docker//go:image.bzl", "go_image") +load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle") + +# gazelle:ignore + +container_bundle( + name = "bundle", + images = { + "pebble:bazel": ":image", + }, + tags = ["manual"], +) + +go_image( + name = "image", + base = "@static_base//image", + binary = ":app", + visibility = ["//visibility:public"], +) + +go_binary( + name = "app", + embed = ["@org_letsencrypt_pebble//cmd/pebble:go_default_library"], + pure = "on", +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/devel/addon/pebble/chart/.helmignore b/devel/addon/pebble/chart/.helmignore new file mode 100644 index 000000000..f0c131944 --- /dev/null +++ b/devel/addon/pebble/chart/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/devel/addon/pebble/chart/Chart.yaml b/devel/addon/pebble/chart/Chart.yaml new file mode 100644 index 000000000..ed6747bdb --- /dev/null +++ b/devel/addon/pebble/chart/Chart.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +description: A Helm chart for Kubernetes +name: pebble +version: 0.1.1 diff --git a/devel/addon/pebble/chart/templates/_helpers.tpl b/devel/addon/pebble/chart/templates/_helpers.tpl new file mode 100644 index 000000000..f0d83d2ed --- /dev/null +++ b/devel/addon/pebble/chart/templates/_helpers.tpl @@ -0,0 +1,16 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "fullname" -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/devel/addon/pebble/chart/templates/configmap.yaml b/devel/addon/pebble/chart/templates/configmap.yaml new file mode 100644 index 000000000..4635e1117 --- /dev/null +++ b/devel/addon/pebble/chart/templates/configmap.yaml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "fullname" . }} + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + config.json: | + { + "pebble": { + "listenAddress": "0.0.0.0:14000", + "certificate": "/config/cert.pem", + "privateKey": "/config/key.pem", + "httpPort": 80, + "tlsPort": 443, + "externalAccountBindingRequired": false, + "externalAccountMACKeys": { + "kid-1": "a2lkLXNlY3JldC0x", + "kid-2": "a2lkLXNlY3JldC0y" + } + } + } + cert.pem: | + -----BEGIN CERTIFICATE----- + MIIDGzCCAgOgAwIBAgIIbEfayDFsBtwwDQYJKoZIhvcNAQELBQAwIDEeMBwGA1UE + AxMVbWluaWNhIHJvb3QgY2EgMjRlMmRiMCAXDTE3MTIwNjE5NDIxMFoYDzIxMDcx + MjA2MTk0MjEwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEB + AQUAA4IBDwAwggEKAoIBAQCbFMW3DXXdErvQf2lCZ0qz0DGEWadDoF0O2neM5mVa + VQ7QGW0xc5Qwvn3Tl62C0JtwLpF0pG2BICIN+DHdVaIUwkf77iBS2doH1I3waE1I + 8GkV9JrYmFY+j0dA1SwBmqUZNXhLNwZGq1a91nFSI59DZNy/JciqxoPX2K++ojU2 + FPpuXe2t51NmXMsszpa+TDqF/IeskA9A/ws6UIh4Mzhghx7oay2/qqj2IIPjAmJj + i73kdUvtEry3wmlkBvtVH50+FscS9WmPC5h3lDTk5nbzSAXKuFusotuqy3XTgY5B + PiRAwkZbEY43JNfqenQPHo7mNTt29i+NVVrBsnAa5ovrAgMBAAGjYzBhMA4GA1Ud + DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0T + AQH/BAIwADAiBgNVHREEGzAZgglsb2NhbGhvc3SCBnBlYmJsZYcEfwAAATANBgkq + hkiG9w0BAQsFAAOCAQEAYIkXff8H28KS0KyLHtbbSOGU4sujHHVwiVXSATACsNAE + D0Qa8hdtTQ6AUqA6/n8/u1tk0O4rPE/cTpsM3IJFX9S3rZMRsguBP7BSr1Lq/XAB + 7JP/CNHt+Z9aKCKcg11wIX9/B9F7pyKM3TdKgOpqXGV6TMuLjg5PlYWI/07lVGFW + /mSJDRs8bSCFmbRtEqc4lpwlrpz+kTTnX6G7JDLfLWYw/xXVqwFfdengcDTHCc8K + wtgGq/Gu6vcoBxIO3jaca+OIkMfxxXmGrcNdseuUCa3RMZ8Qy03DqGu6Y6XQyK4B + W8zIG6H9SVKkAznM2yfYhW8v2ktcaZ95/OBHY97ZIw== + -----END CERTIFICATE----- + key.pem: | + -----BEGIN RSA PRIVATE KEY----- + MIIEowIBAAKCAQEAmxTFtw113RK70H9pQmdKs9AxhFmnQ6BdDtp3jOZlWlUO0Blt + MXOUML5905etgtCbcC6RdKRtgSAiDfgx3VWiFMJH++4gUtnaB9SN8GhNSPBpFfSa + 2JhWPo9HQNUsAZqlGTV4SzcGRqtWvdZxUiOfQ2TcvyXIqsaD19ivvqI1NhT6bl3t + redTZlzLLM6Wvkw6hfyHrJAPQP8LOlCIeDM4YIce6Gstv6qo9iCD4wJiY4u95HVL + 7RK8t8JpZAb7VR+dPhbHEvVpjwuYd5Q05OZ280gFyrhbrKLbqst104GOQT4kQMJG + WxGONyTX6np0Dx6O5jU7dvYvjVVawbJwGuaL6wIDAQABAoIBAGW9W/S6lO+DIcoo + PHL+9sg+tq2gb5ZzN3nOI45BfI6lrMEjXTqLG9ZasovFP2TJ3J/dPTnrwZdr8Et/ + 357YViwORVFnKLeSCnMGpFPq6YEHj7mCrq+YSURjlRhYgbVPsi52oMOfhrOIJrEG + ZXPAwPRi0Ftqu1omQEqz8qA7JHOkjB2p0i2Xc/uOSJccCmUDMlksRYz8zFe8wHuD + XvUL2k23n2pBZ6wiez6Xjr0wUQ4ESI02x7PmYgA3aqF2Q6ECDwHhjVeQmAuypMF6 + IaTjIJkWdZCW96pPaK1t+5nTNZ+Mg7tpJ/PRE4BkJvqcfHEOOl6wAE8gSk5uVApY + ZRKGmGkCgYEAzF9iRXYo7A/UphL11bR0gqxB6qnQl54iLhqS/E6CVNcmwJ2d9pF8 + 5HTfSo1/lOXT3hGV8gizN2S5RmWBrc9HBZ+dNrVo7FYeeBiHu+opbX1X/C1HC0m1 + wJNsyoXeqD1OFc1WbDpHz5iv4IOXzYdOdKiYEcTv5JkqE7jomqBLQk8CgYEAwkG/ + rnwr4ThUo/DG5oH+l0LVnHkrJY+BUSI33g3eQ3eM0MSbfJXGT7snh5puJW0oXP7Z + Gw88nK3Vnz2nTPesiwtO2OkUVgrIgWryIvKHaqrYnapZHuM+io30jbZOVaVTMR9c + X/7/d5/evwXuP7p2DIdZKQKKFgROm1XnhNqVgaUCgYBD/ogHbCR5RVsOVciMbRlG + UGEt3YmUp/vfMuAsKUKbT2mJM+dWHVlb+LZBa4pC06QFgfxNJi/aAhzSGvtmBEww + xsXbaceauZwxgJfIIUPfNZCMSdQVIVTi2Smcx6UofBz6i/Jw14MEwlvhamaa7qVf + kqflYYwelga1wRNCPopLaQKBgQCWsZqZKQqBNMm0Q9yIhN+TR+2d7QFjqeePoRPl + 1qxNejhq25ojE607vNv1ff9kWUGuoqSZMUC76r6FQba/JoNbefI4otd7x/GzM9uS + 8MHMJazU4okwROkHYwgLxxkNp6rZuJJYheB4VDTfyyH/ng5lubmY7rdgTQcNyZ5I + majRYQKBgAMKJ3RlII0qvAfNFZr4Y2bNIq+60Z+Qu2W5xokIHCFNly3W1XDDKGFe + CCPHSvQljinke3P9gPt2HVdXxcnku9VkTti+JygxuLkVg7E0/SWwrWfGsaMJs+84 + fK+mTZay2d3v24r9WKEKwLykngYPyZw5+BdWU0E+xx5lGUd3U4gG + -----END RSA PRIVATE KEY----- diff --git a/devel/addon/pebble/chart/templates/deployment.yaml b/devel/addon/pebble/chart/templates/deployment.yaml new file mode 100644 index 000000000..c6411e618 --- /dev/null +++ b/devel/addon/pebble/chart/templates/deployment.yaml @@ -0,0 +1,49 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "fullname" . }} + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ template "name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "name" . }} + release: {{ .Release.Name }} + spec: + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: + - -config=/config/config.json + - -strict={{ .Values.strict }} + volumeMounts: + - name: config + mountPath: /config + readOnly: true + readinessProbe: + tcpSocket: + port: 14000 + initialDelaySeconds: 1 + periodSeconds: 1 + failureThreshold: 10 + successThreshold: 1 + resources: +{{ toYaml .Values.resources | indent 12 }} + volumes: + - name: config + configMap: + name: {{ template "fullname" . }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} diff --git a/devel/addon/pebble/chart/templates/service.yaml b/devel/addon/pebble/chart/templates/service.yaml new file mode 100644 index 000000000..b7ce56c84 --- /dev/null +++ b/devel/addon/pebble/chart/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: pebble + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.service.type }} + ports: + - port: 443 + targetPort: 14000 + protocol: TCP + name: https + selector: + app: {{ template "name" . }} + release: {{ .Release.Name }} diff --git a/devel/addon/pebble/chart/values.yaml b/devel/addon/pebble/chart/values.yaml new file mode 100644 index 000000000..9c7e591da --- /dev/null +++ b/devel/addon/pebble/chart/values.yaml @@ -0,0 +1,16 @@ +replicaCount: 1 +image: + repository: pebble + tag: "bazel" + pullPolicy: Never +service: + type: ClusterIP +resources: + requests: + cpu: 10m + memory: 10Mi + limits: + cpu: 100m + memory: 100Mi + +strict: "false" diff --git a/devel/addon/pebble/install.sh b/devel/addon/pebble/install.sh new file mode 100755 index 000000000..64db1ae60 --- /dev/null +++ b/devel/addon/pebble/install.sh @@ -0,0 +1,50 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +# Installs an instance of pebble using the Helm chart located in chart/ +# Configure the cluster to target using the KUBECONFIG environment variable. +# Additional parameters can be configured by overriding the variables below. + +# Namespace to deploy into +NAMESPACE="${NAMESPACE:-pebble}" +# Release name to use with Helm +RELEASE_NAME="${RELEASE_NAME:-pebble}" +# Image to use - by default uses a Bazel built image +IMAGE="${IMAGE:-pebble:bazel}" + +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") +source "${SCRIPT_ROOT}/../../lib/lib.sh" +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") + +# Require helm available on PATH +check_tool kubectl +check_tool helm +require_image "pebble:bazel" "//devel/addon/pebble:bundle" + +# Ensure the pebble namespace exists +kubectl get namespace "${NAMESPACE}" || kubectl create namespace "${NAMESPACE}" + +# Upgrade or install Pebble +helm upgrade \ + --install \ + --wait \ + --namespace "${NAMESPACE}" \ + "$RELEASE_NAME" \ + "$SCRIPT_ROOT/chart" diff --git a/devel/addon/samplewebhook/BUILD.bazel b/devel/addon/samplewebhook/BUILD.bazel new file mode 100644 index 000000000..74a01297a --- /dev/null +++ b/devel/addon/samplewebhook/BUILD.bazel @@ -0,0 +1,26 @@ +load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle") + +container_bundle( + name = "bundle", + images = { + "sample-webhook:bazel": "//devel/addon/samplewebhook/sample:image", + }, + tags = ["manual"], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [ + ":package-srcs", + "//devel/addon/samplewebhook/sample:all-srcs", + ], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/devel/addon/samplewebhook/chart/.helmignore b/devel/addon/samplewebhook/chart/.helmignore new file mode 100644 index 000000000..f0c131944 --- /dev/null +++ b/devel/addon/samplewebhook/chart/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/devel/addon/samplewebhook/chart/Chart.yaml b/devel/addon/samplewebhook/chart/Chart.yaml new file mode 100644 index 000000000..77c6eadac --- /dev/null +++ b/devel/addon/samplewebhook/chart/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +appVersion: "1.0" +description: A Helm chart for Kubernetes +name: example-webhook +version: 0.1.0 diff --git a/devel/addon/samplewebhook/chart/templates/NOTES.txt b/devel/addon/samplewebhook/chart/templates/NOTES.txt new file mode 100644 index 000000000..e69de29bb diff --git a/devel/addon/samplewebhook/chart/templates/_helpers.tpl b/devel/addon/samplewebhook/chart/templates/_helpers.tpl new file mode 100644 index 000000000..d3c474b64 --- /dev/null +++ b/devel/addon/samplewebhook/chart/templates/_helpers.tpl @@ -0,0 +1,48 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "example-webhook.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "example-webhook.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "example-webhook.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "example-webhook.selfSignedIssuer" -}} +{{ printf "%s-selfsign" (include "example-webhook.fullname" .) }} +{{- end -}} + +{{- define "example-webhook.rootCAIssuer" -}} +{{ printf "%s-ca" (include "example-webhook.fullname" .) }} +{{- end -}} + +{{- define "example-webhook.rootCACertificate" -}} +{{ printf "%s-ca" (include "example-webhook.fullname" .) }} +{{- end -}} + +{{- define "example-webhook.servingCertificate" -}} +{{ printf "%s-webhook-tls" (include "example-webhook.fullname" .) }} +{{- end -}} diff --git a/devel/addon/samplewebhook/chart/templates/apiservice.yaml b/devel/addon/samplewebhook/chart/templates/apiservice.yaml new file mode 100644 index 000000000..5b67d2a1f --- /dev/null +++ b/devel/addon/samplewebhook/chart/templates/apiservice.yaml @@ -0,0 +1,19 @@ +apiVersion: apiregistration.k8s.io/v1beta1 +kind: APIService +metadata: + name: v1alpha1.{{ .Values.groupName }} + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "example-webhook.servingCertificate" . }}" +spec: + group: {{ .Values.groupName }} + groupPriorityMinimum: 1000 + versionPriority: 15 + service: + name: {{ include "example-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} + version: v1alpha1 diff --git a/devel/addon/samplewebhook/chart/templates/deployment.yaml b/devel/addon/samplewebhook/chart/templates/deployment.yaml new file mode 100644 index 000000000..ed4946396 --- /dev/null +++ b/devel/addon/samplewebhook/chart/templates/deployment.yaml @@ -0,0 +1,68 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "example-webhook.fullname" . }} + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ include "example-webhook.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ include "example-webhook.name" . }} + release: {{ .Release.Name }} + spec: + serviceAccountName: {{ include "example-webhook.fullname" . }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: + - --tls-cert-file=/tls/tls.crt + - --tls-private-key-file=/tls/tls.key + env: + - name: GROUP_NAME + value: {{ .Values.groupName | quote }} + ports: + - name: https + containerPort: 443 + protocol: TCP + livenessProbe: + httpGet: + scheme: HTTPS + path: /healthz + port: https + readinessProbe: + httpGet: + scheme: HTTPS + path: /healthz + port: https + volumeMounts: + - name: certs + mountPath: /tls + readOnly: true + resources: +{{ toYaml .Values.resources | indent 12 }} + volumes: + - name: certs + secret: + secretName: {{ include "example-webhook.servingCertificate" . }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} diff --git a/devel/addon/samplewebhook/chart/templates/pki.yaml b/devel/addon/samplewebhook/chart/templates/pki.yaml new file mode 100644 index 000000000..2a62da595 --- /dev/null +++ b/devel/addon/samplewebhook/chart/templates/pki.yaml @@ -0,0 +1,76 @@ +--- +# Create a selfsigned Issuer, in order to create a root CA certificate for +# signing webhook serving certificates +apiVersion: cert-manager.io/v1alpha2 +kind: Issuer +metadata: + name: {{ include "example-webhook.selfSignedIssuer" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + selfSigned: {} + +--- + +# Generate a CA Certificate used to sign certificates for the webhook +apiVersion: cert-manager.io/v1alpha2 +kind: Certificate +metadata: + name: {{ include "example-webhook.rootCACertificate" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + secretName: {{ include "example-webhook.rootCACertificate" . }} + duration: 43800h # 5y + issuerRef: + name: {{ include "example-webhook.selfSignedIssuer" . }} + commonName: "ca.example-webhook.cert-manager" + isCA: true + +--- + +# Create an Issuer that uses the above generated CA certificate to issue certs +apiVersion: cert-manager.io/v1alpha2 +kind: Issuer +metadata: + name: {{ include "example-webhook.rootCAIssuer" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + ca: + secretName: {{ include "example-webhook.rootCACertificate" . }} + +--- + +# Finally, generate a serving certificate for the webhook to use +apiVersion: cert-manager.io/v1alpha2 +kind: Certificate +metadata: + name: {{ include "example-webhook.servingCertificate" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + secretName: {{ include "example-webhook.servingCertificate" . }} + duration: 8760h # 1y + issuerRef: + name: {{ include "example-webhook.rootCAIssuer" . }} + dnsNames: + - {{ include "example-webhook.fullname" . }} + - {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }} + - {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }}.svc diff --git a/devel/addon/samplewebhook/chart/templates/rbac.yaml b/devel/addon/samplewebhook/chart/templates/rbac.yaml new file mode 100644 index 000000000..5ca2e1234 --- /dev/null +++ b/devel/addon/samplewebhook/chart/templates/rbac.yaml @@ -0,0 +1,111 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "example-webhook.fullname" . }} + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +--- +# Grant the webhook permission to read the ConfigMap containing the Kubernetes +# apiserver's requestheader-ca-certificate. +# This ConfigMap is automatically created by the Kubernetes apiserver. +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader + namespace: kube-system + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ include "example-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} +--- +# Once we no longer have to support Kubernetes versions lower than 1.17, we +# can remove this custom defined Role in favour of the system-provisioned +# extension-apiserver-authentication-reader Role resource in kube-system. +# See https://github.com/kubernetes/kubernetes/issues/86359 for more details. +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader + namespace: kube-system +rules: +- apiGroups: + - "" + resourceNames: + - extension-apiserver-authentication + resources: + - configmaps + verbs: + - get + - list + - watch +--- +# apiserver gets the auth-delegator role to delegate auth decisions to +# the core apiserver +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: {{ include "example-webhook.fullname" . }}:auth-delegator + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ include "example-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} +--- +# Grant cert-manager permission to validate using our apiserver +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: {{ include "example-webhook.fullname" . }}:domain-solver + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: + - {{ .Values.groupName }} + resources: + - '*' + verbs: + - 'create' +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: {{ include "example-webhook.fullname" . }}:domain-solver + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "example-webhook.fullname" . }}:domain-solver +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ .Values.certManager.serviceAccountName }} + namespace: {{ .Values.certManager.namespace }} diff --git a/devel/addon/samplewebhook/chart/templates/service.yaml b/devel/addon/samplewebhook/chart/templates/service.yaml new file mode 100644 index 000000000..572089efd --- /dev/null +++ b/devel/addon/samplewebhook/chart/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "example-webhook.fullname" . }} + labels: + app: {{ include "example-webhook.name" . }} + chart: {{ include "example-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: https + protocol: TCP + name: https + selector: + app: {{ include "example-webhook.name" . }} + release: {{ .Release.Name }} diff --git a/devel/addon/samplewebhook/chart/values.yaml b/devel/addon/samplewebhook/chart/values.yaml new file mode 100644 index 000000000..4ac331a4a --- /dev/null +++ b/devel/addon/samplewebhook/chart/values.yaml @@ -0,0 +1,43 @@ +# The GroupName here is used to identify your company or business unit that +# created this webhook. +# For example, this may be "acme.mycompany.com". +# This name will need to be referenced in each Issuer's `webhook` stanza to +# inform cert-manager of where to send ChallengePayload resources in order to +# solve the DNS01 challenge. +# This group name should be **unique**, hence using your own company's domain +# here is recommended. +groupName: acme.testing.cert-manager.io + +certManager: + namespace: cert-manager + serviceAccountName: cert-manager + +image: + repository: sample-webhook + tag: bazel + pullPolicy: Never + +nameOverride: "" +fullnameOverride: "" + +service: + type: ClusterIP + port: 443 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +nodeSelector: {} + +tolerations: [] + +affinity: {} diff --git a/devel/addon/samplewebhook/install.sh b/devel/addon/samplewebhook/install.sh new file mode 100755 index 000000000..916e36753 --- /dev/null +++ b/devel/addon/samplewebhook/install.sh @@ -0,0 +1,49 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +# Installs an instance of the sample-webhook using the Helm chart located in +# chart/. +# Configure the cluster to target using the KUBECONFIG environment variable. +# Additional parameters can be configured by overriding the variables below. + +# Namespace to deploy into +NAMESPACE="${NAMESPACE:-sample-webhook}" +# Release name to use with Helm +RELEASE_NAME="${RELEASE_NAME:-sample-webhook}" + +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") +source "${SCRIPT_ROOT}/../../lib/lib.sh" +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") + +# Require helm available on PATH +check_tool kubectl +check_tool helm +require_image "sample-webhook:bazel" "//devel/addon/samplewebhook:bundle" + +# Ensure the pebble namespace exists +kubectl get namespace "${NAMESPACE}" || kubectl create namespace "${NAMESPACE}" + +# Upgrade or install Pebble +helm upgrade \ + --install \ + --wait \ + --namespace "${NAMESPACE}" \ + "$RELEASE_NAME" \ + "$SCRIPT_ROOT/chart" diff --git a/devel/addon/samplewebhook/sample/BUILD.bazel b/devel/addon/samplewebhook/sample/BUILD.bazel new file mode 100644 index 000000000..49f1cf2a0 --- /dev/null +++ b/devel/addon/samplewebhook/sample/BUILD.bazel @@ -0,0 +1,43 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library") +load("@io_bazel_rules_docker//go:image.bzl", "go_image") + +go_image( + name = "image", + base = "@static_base//image", + binary = ":sample", + visibility = ["//visibility:public"], +) + +go_library( + name = "go_default_library", + srcs = ["main.go"], + importpath = "github.com/jetstack/cert-manager/devel/addon/samplewebhook/sample", + visibility = ["//visibility:private"], + deps = [ + "//pkg/acme/webhook/apis/acme/v1alpha1:go_default_library", + "//pkg/acme/webhook/cmd:go_default_library", + "@io_k8s_apiextensions_apiserver//pkg/apis/apiextensions/v1beta1:go_default_library", + "@io_k8s_client_go//rest:go_default_library", + ], +) + +go_binary( + name = "sample", + embed = [":go_default_library"], + pure = "on", + visibility = ["//visibility:public"], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/devel/addon/samplewebhook/sample/main.go b/devel/addon/samplewebhook/sample/main.go new file mode 100644 index 000000000..1f86fdade --- /dev/null +++ b/devel/addon/samplewebhook/sample/main.go @@ -0,0 +1,163 @@ +/* +Copyright 2019 The Jetstack cert-manager contributors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package main + +import ( + "encoding/json" + "fmt" + "os" + + extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1" + //"k8s.io/client-go/kubernetes" + "k8s.io/client-go/rest" + + "github.com/jetstack/cert-manager/pkg/acme/webhook/apis/acme/v1alpha1" + "github.com/jetstack/cert-manager/pkg/acme/webhook/cmd" +) + +var GroupName = os.Getenv("GROUP_NAME") + +func main() { + if GroupName == "" { + panic("GROUP_NAME must be specified") + } + + // This will register our custom DNS provider with the webhook serving + // library, making it available as an API under the provided GroupName. + // You can register multiple DNS provider implementations with a single + // webhook, where the Name() method will be used to disambiguate between + // the different implementations. + cmd.RunWebhookServer(GroupName, + &customDNSProviderSolver{}, + ) +} + +// customDNSProviderSolver implements the provider-specific logic needed to +// 'present' an ACME challenge TXT record for your own DNS provider. +// To do so, it must implement the `github.com/jetstack/cert-manager/pkg/acme/webhook.Solver` +// interface. +type customDNSProviderSolver struct { + // If a Kubernetes 'clientset' is needed, you must: + // 1. uncomment the additional `client` field in this structure below + // 2. uncomment the "k8s.io/client-go/kubernetes" import at the top of the file + // 3. uncomment the relevant code in the Initialize method below + // 4. ensure your webhook's service account has the required RBAC role + // assigned to it for interacting with the Kubernetes APIs you need. + //client kubernetes.Clientset +} + +// customDNSProviderConfig is a structure that is used to decode into when +// solving a DNS01 challenge. +// This information is provided by cert-manager, and may be a reference to +// additional configuration that's needed to solve the challenge for this +// particular certificate or issuer. +// This typically includes references to Secret resources containing DNS +// provider credentials, in cases where a 'multi-tenant' DNS solver is being +// created. +// If you do *not* require per-issuer or per-certificate configuration to be +// provided to your webhook, you can skip decoding altogether in favour of +// using CLI flags or similar to provide configuration. +// You should not include sensitive information here. If credentials need to +// be used by your provider here, you should reference a Kubernetes Secret +// resource and fetch these credentials using a Kubernetes clientset. +type customDNSProviderConfig struct { + // Change the two fields below according to the format of the configuration + // to be decoded. + // These fields will be set by users in the + // `issuer.spec.acme.dns01.providers.webhook.config` field. + + //Email string `json:"email"` + //APIKeySecretRef cmmeta.SecretKeySelector `json:"apiKeySecretRef"` +} + +// Name is used as the name for this DNS solver when referencing it on the ACME +// Issuer resource. +// This should be unique **within the group name**, i.e. you can have two +// solvers configured with the same Name() **so long as they do not co-exist +// within a single webhook deployment**. +// For example, `cloudflare` may be used as the name of a solver. +func (c *customDNSProviderSolver) Name() string { + return "my-custom-solver" +} + +// Present is responsible for actually presenting the DNS record with the +// DNS provider. +// This method should tolerate being called multiple times with the same value. +// cert-manager itself will later perform a self check to ensure that the +// solver has correctly configured the DNS provider. +func (c *customDNSProviderSolver) Present(ch *v1alpha1.ChallengeRequest) error { + cfg, err := loadConfig(ch.Config) + if err != nil { + return err + } + + // TODO: do something more useful with the decoded configuration + fmt.Printf("Decoded configuration %v", cfg) + + // TODO: add code that sets a record in the DNS provider's console + return nil +} + +// CleanUp should delete the relevant TXT record from the DNS provider console. +// If multiple TXT records exist with the same record name (e.g. +// _acme-challenge.example.com) then **only** the record with the same `key` +// value provided on the ChallengeRequest should be cleaned up. +// This is in order to facilitate multiple DNS validations for the same domain +// concurrently. +func (c *customDNSProviderSolver) CleanUp(ch *v1alpha1.ChallengeRequest) error { + // TODO: add code that deletes a record from the DNS provider's console + return nil +} + +// Initialize will be called when the webhook first starts. +// This method can be used to instantiate the webhook, i.e. initialising +// connections or warming up caches. +// Typically, the kubeClientConfig parameter is used to build a Kubernetes +// client that can be used to fetch resources from the Kubernetes API, e.g. +// Secret resources containing credentials used to authenticate with DNS +// provider accounts. +// The stopCh can be used to handle early termination of the webhook, in cases +// where a SIGTERM or similar signal is sent to the webhook process. +func (c *customDNSProviderSolver) Initialize(kubeClientConfig *rest.Config, stopCh <-chan struct{}) error { + ///// UNCOMMENT THE BELOW CODE TO MAKE A KUBERNETES CLIENTSET AVAILABLE TO + ///// YOUR CUSTOM DNS PROVIDER + + //cl, err := kubernetes.NewForConfig(kubeClientConfig) + //if err != nil { + // return err + //} + // + //c.client = cl + + ///// END OF CODE TO MAKE KUBERNETES CLIENTSET AVAILABLE + return nil +} + +// loadConfig is a small helper function that decodes JSON configuration into +// the typed config struct. +func loadConfig(cfgJSON *extapi.JSON) (customDNSProviderConfig, error) { + cfg := customDNSProviderConfig{} + // handle the 'base case' where no configuration has been provided + if cfgJSON == nil { + return cfg, nil + } + if err := json.Unmarshal(cfgJSON.Raw, &cfg); err != nil { + return cfg, fmt.Errorf("error decoding solver config: %v", err) + } + + return cfg, nil +} diff --git a/devel/addon/vault/BUILD.bazel b/devel/addon/vault/BUILD.bazel new file mode 100644 index 000000000..32d1683c4 --- /dev/null +++ b/devel/addon/vault/BUILD.bazel @@ -0,0 +1,23 @@ +load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle") + +container_bundle( + name = "bundle", + images = { + "vault:bazel": "@com_hashicorp_vault//image", + }, + tags = ["manual"], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/devel/addon/vault/install.sh b/devel/addon/vault/install.sh new file mode 100755 index 000000000..127f6b471 --- /dev/null +++ b/devel/addon/vault/install.sh @@ -0,0 +1,39 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +# Installs an instance of Vault using the Helm chart located in chart/ +# Configure the cluster to target using the KUBECONFIG environment variable. +# Additional parameters can be configured by overriding the variables below. + +# Namespace to deploy into +NAMESPACE="${NAMESPACE:-vault}" +# Release name to use with Helm +RELEASE_NAME="${RELEASE_NAME:-vault}" +# Image to use - by default uses a Bazel built image +IMAGE="${IMAGE:-vault:bazel}" + +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") +source "${SCRIPT_ROOT}/../../lib/lib.sh" +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") + +# Require helm available on PATH +check_tool kubectl +check_tool helm +require_image "vault:bazel" "//devel/addon/vault:bundle" diff --git a/hack/ci/lib/cluster_destroy.sh b/devel/bin/helm similarity index 73% rename from hack/ci/lib/cluster_destroy.sh rename to devel/bin/helm index 64bb88666..55ca30b0d 100755 --- a/hack/ci/lib/cluster_destroy.sh +++ b/devel/bin/helm @@ -1,6 +1,6 @@ -#!/bin/bash +#!/usr/bin/env bash -# Copyright 2019 The Jetstack cert-manager contributors. +# Copyright 2020 The Jetstack cert-manager contributors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -14,11 +14,13 @@ # See the License for the specific language governing permissions and # limitations under the License. -set -o errexit set -o nounset +set -o errexit set -o pipefail -SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") -source "${SCRIPT_ROOT}/lib.sh" +if ! command -v bazel &>/dev/null; then + echo "Install bazel at https://bazel.build" >&2 + exit 1 +fi -"${KIND}" delete cluster --name="${KIND_CLUSTER_NAME}" +bazel run //hack/bin:helm -- "$@" diff --git a/devel/bin/kind b/devel/bin/kind new file mode 100755 index 000000000..72df73b1c --- /dev/null +++ b/devel/bin/kind @@ -0,0 +1,26 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +if ! command -v bazel &>/dev/null; then + echo "Install bazel at https://bazel.build" >&2 + exit 1 +fi + +bazel run //hack/bin:kind -- "$@" diff --git a/devel/bin/kubectl b/devel/bin/kubectl new file mode 100755 index 000000000..63a6fbfcd --- /dev/null +++ b/devel/bin/kubectl @@ -0,0 +1,26 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +if ! command -v bazel &>/dev/null; then + echo "Install bazel at https://bazel.build" >&2 + exit 1 +fi + +bazel run //hack/bin:kubectl -- "$@" diff --git a/devel/ci-run-e2e.sh b/devel/ci-run-e2e.sh new file mode 100755 index 000000000..07f6effd8 --- /dev/null +++ b/devel/ci-run-e2e.sh @@ -0,0 +1,40 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +# This script will build an entirely new testing environment using kind. +# This is inteded to be run in a CI environment and *not* for development. +# It is not optimised for quick, iterative development. + +SCRIPT_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" > /dev/null && pwd )" +export REPO_ROOT="${SCRIPT_ROOT}/.." +# Configure PATH to use bazel provided e2e tools +export PATH="${SCRIPT_ROOT}/bin:$PATH" + +echo "Ensuring a kind cluster exists..." +"${SCRIPT_ROOT}/cluster/create.sh" + +echo "Ensuring all e2e test dependencies are installed..." +"${SCRIPT_ROOT}/setup-e2e-deps.sh" + +echo "Running e2e test suite..." +# Skip Venafi end-to-end tests in CI +FLAKE_ATTEMPTS=2 "${SCRIPT_ROOT}/run-e2e.sh" \ + --ginkgo.skip=Venafi \ + "$@" diff --git a/devel/cluster/config/v1alpha2.yaml b/devel/cluster/config/v1alpha2.yaml new file mode 100644 index 000000000..96756794c --- /dev/null +++ b/devel/cluster/config/v1alpha2.yaml @@ -0,0 +1,22 @@ +# this config file is similar to the default, except we set the cluster's +# service cidr range to be 10.0.0.0/16. +# we do this because we need a fixed/predictable clusterIP of 10.0.0.15 for the +# nginx-ingress service, in order to perform HTTP01 validations during tests. + +apiVersion: kind.sigs.k8s.io/v1alpha3 +kind: Cluster +kubeadmConfigPatches: + - | + # config generated by kind + apiVersion: kubeadm.k8s.io/v1alpha2 + kind: MasterConfiguration + metadata: + name: config + networking: + serviceSubnet: 10.0.0.0/16 + kubeletConfiguration: + baseConfig: + clusterDNS: + - 10.0.0.10 +nodes: +- role: control-plane diff --git a/devel/cluster/config/v1alpha3.yaml b/devel/cluster/config/v1alpha3.yaml new file mode 100644 index 000000000..79c1ac3e6 --- /dev/null +++ b/devel/cluster/config/v1alpha3.yaml @@ -0,0 +1,18 @@ +# this config file is similar to the default, except we set the cluster's +# service cidr range to be 10.0.0.0/16. +# we do this because we need a fixed/predictable clusterIP of 10.0.0.15 for the +# nginx-ingress service, in order to perform HTTP01 validations during tests. + +apiVersion: kind.sigs.k8s.io/v1alpha3 +kind: Cluster +kubeadmConfigPatches: + - | + # config generated by kind + apiVersion: kubeadm.k8s.io/v1alpha3 + kind: ClusterConfiguration + metadata: + name: config + networking: + serviceSubnet: 10.0.0.0/16 +nodes: +- role: control-plane diff --git a/devel/cluster/config/v1beta1.yaml b/devel/cluster/config/v1beta1.yaml new file mode 100644 index 000000000..1126c8b7c --- /dev/null +++ b/devel/cluster/config/v1beta1.yaml @@ -0,0 +1,18 @@ +# this config file is similar to the default, except we set the cluster's +# service cidr range to be 10.0.0.0/16. +# we do this because we need a fixed/predictable clusterIP of 10.0.0.15 for the +# nginx-ingress service, in order to perform HTTP01 validations during tests. + +apiVersion: kind.sigs.k8s.io/v1alpha3 +kind: Cluster +kubeadmConfigPatches: + - | + # config generated by kind + apiVersion: kubeadm.k8s.io/v1beta1 + kind: ClusterConfiguration + metadata: + name: config + networking: + serviceSubnet: 10.0.0.0/16 +nodes: +- role: control-plane diff --git a/devel/cluster/config/v1beta2.yaml b/devel/cluster/config/v1beta2.yaml new file mode 100644 index 000000000..e5db5747f --- /dev/null +++ b/devel/cluster/config/v1beta2.yaml @@ -0,0 +1,18 @@ +# this config file is similar to the default, except we set the cluster's +# service cidr range to be 10.0.0.0/16. +# we do this because we need a fixed/predictable clusterIP of 10.0.0.15 for the +# nginx-ingress service, in order to perform HTTP01 validations during tests. + +apiVersion: kind.sigs.k8s.io/v1alpha3 +kind: Cluster +kubeadmConfigPatches: + - | + # config generated by kind + apiVersion: kubeadm.k8s.io/v1beta2 + kind: ClusterConfiguration + metadata: + name: config + networking: + serviceSubnet: 10.0.0.0/16 +nodes: + - role: control-plane diff --git a/devel/cluster/create.sh b/devel/cluster/create.sh new file mode 100755 index 000000000..f1ee24031 --- /dev/null +++ b/devel/cluster/create.sh @@ -0,0 +1,83 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") +source "${SCRIPT_ROOT}/../lib/lib.sh" +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") + +# Require helm available on PATH +check_tool kind + +export KIND_IMAGE_REPO="kindest/node" +# Default Kubernetes version to use to 1.17 +export K8S_VERSION=${K8S_VERSION:-1.17} + +# Compute the details of the kind image to use +export KIND_IMAGE_SHA="" +export KIND_IMAGE_CONFIG="" +if [[ "$K8S_VERSION" =~ 1\.11 ]]; then + # v1.11.10 @ sha256:e6f3dade95b7cb74081c5b9f3291aaaa6026a90a977e0b990778b6adc9ea6248 + KIND_IMAGE_SHA="sha256:e6f3dade95b7cb74081c5b9f3291aaaa6026a90a977e0b990778b6adc9ea6248" + KIND_IMAGE_CONFIG="v1alpha2" +elif [[ "$K8S_VERSION" =~ 1\.12 ]]; then + # v1.12.10 @ sha256:68a6581f64b54994b824708286fafc37f1227b7b54cbb8865182ce1e036ed1cc + KIND_IMAGE_SHA="sha256:68a6581f64b54994b824708286fafc37f1227b7b54cbb8865182ce1e036ed1cc" + KIND_IMAGE_CONFIG="v1alpha3" +elif [[ "$K8S_VERSION" =~ 1\.13 ]] ; then + # v1.13.12 @sha256:5e8ae1a4e39f3d151d420ef912e18368745a2ede6d20ea87506920cd947a7e3a + KIND_IMAGE_SHA="sha256:5e8ae1a4e39f3d151d420ef912e18368745a2ede6d20ea87506920cd947a7e3a" + KIND_IMAGE_CONFIG="v1beta1" +elif [[ "$K8S_VERSION" =~ 1\.14 ]] ; then + # v1.14.10 @ sha256:81ae5a3237c779efc4dda43cc81c696f88a194abcc4f8fa34f86cf674aa14977 + KIND_IMAGE_SHA="sha256:81ae5a3237c779efc4dda43cc81c696f88a194abcc4f8fa34f86cf674aa14977" + KIND_IMAGE_CONFIG="v1beta1" +elif [[ "$K8S_VERSION" =~ 1\.15 ]] ; then + # v1.15.7 @ sha256:e2df133f80ef633c53c0200114fce2ed5e1f6947477dbc83261a6a921169488d + KIND_IMAGE_SHA="sha256:e2df133f80ef633c53c0200114fce2ed5e1f6947477dbc83261a6a921169488d" + KIND_IMAGE_CONFIG="v1beta2" +elif [[ "$K8S_VERSION" =~ 1\.16 ]] ; then + # v1.16.4 @ sha256:b91a2c2317a000f3a783489dfb755064177dbc3a0b2f4147d50f04825d016f55 + KIND_IMAGE_SHA="sha256:b91a2c2317a000f3a783489dfb755064177dbc3a0b2f4147d50f04825d016f55" + KIND_IMAGE_CONFIG="v1beta2" +elif [[ "$K8S_VERSION" =~ 1\.17 ]] ; then + # v1.17.0 @ sha256:9512edae126da271b66b990b6fff768fbb7cd786c7d39e86bdf55906352fdf62 + KIND_IMAGE_SHA="sha256:9512edae126da271b66b990b6fff768fbb7cd786c7d39e86bdf55906352fdf62" + KIND_IMAGE_CONFIG="v1beta2" +else + echo "Unrecognised Kubernetes version '${K8S_VERSION}'! Aborting..." + exit 1 +fi +export KIND_IMAGE="${KIND_IMAGE_REPO}@${KIND_IMAGE_SHA}" +echo "kind image details:" +echo " repo: ${KIND_IMAGE_REPO}" +echo " sha256: ${KIND_IMAGE_SHA}" +echo " version: ${K8S_VERSION}" +echo " config: ${KIND_IMAGE_CONFIG}" + +if kind get clusters | grep "^$KIND_CLUSTER_NAME\$" &>/dev/null; then + echo "Existing cluster '$KIND_CLUSTER_NAME' found, skipping creating cluster..." + exit 0 +fi + +# Create the kind cluster +kind create cluster \ + --config "${SCRIPT_ROOT}/config/${KIND_IMAGE_CONFIG}.yaml" \ + --image "${KIND_IMAGE}" \ + --name "${KIND_CLUSTER_NAME}" diff --git a/devel/lib/lib.sh b/devel/lib/lib.sh new file mode 100644 index 000000000..ada3024bf --- /dev/null +++ b/devel/lib/lib.sh @@ -0,0 +1,68 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") +export REPO_ROOT="$SCRIPT_ROOT/../.." + +export SKIP_BUILD_ADDON_IMAGES="${SKIP_BUILD_ADDON_IMAGES:-}" +export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-kind}" + +# check_tool ensures that the tool with the given name is available, or advises +# users to setup their PATH for the test/e3e/bin directory if not. +check_tool() { + tool="$1" + if ! command -v "$tool" &>/dev/null; then + echo "Install $tool or run: export PATH=\"$REPO_ROOT/devel/bin:\$PATH\"" >&2 + exit 1 + fi +} + +# check_bazel ensures that bazel is installed/available. +check_bazel() { + if ! command -v bazel &>/dev/null; then + echo "Install bazel at https://bazel.build" >&2 + exit 1 + fi +} + +# require_image will attempt to ensure that the named docker image exists +# within the kind cluster with name $KIND_CLUSTER_NAME. +# If $SKIP_BUILD_ADDON_IMAGES is 'true', the image will not be built and a +# warning message will be printed instead. +require_image() { + IMAGE_NAME="$1" + BAZEL_TARGET="$2" + # Skip building and loading the image if SKIP_BUILD_ADDON_IMAGES=true + if [ "${SKIP_BUILD_ADDON_IMAGES:-}" == "true" ]; then + echo "Skipping building and loading image '$IMAGE_NAME' because SKIP_BUILD_ADDON_IMAGES=true" + return + fi + + # Ensure bazel is available + check_bazel + # Ensure kind is available + check_tool kind + + # Build and export the docker image + bazel run --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 "${BAZEL_TARGET}" + + # Load the image into the kind cluster + kind load docker-image --name "$KIND_CLUSTER_NAME" "$IMAGE_NAME" +} diff --git a/devel/run-e2e.sh b/devel/run-e2e.sh new file mode 100755 index 000000000..a01a41f9d --- /dev/null +++ b/devel/run-e2e.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +# This script will run the end-to-end test suite against an already configured +# kind cluster. +# If a cluster does not already exist, create one with 'cluster/create.sh'. + +export SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") +source "${SCRIPT_ROOT}/lib/lib.sh" + +check_bazel + +mkdir -p "${REPO_ROOT}/_artifacts" +bazel build //hack/bin:helm //test/e2e:e2e.test +# Set KUBECONFIG environment variable if not already set +export KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}" +# Run e2e tests +bazel run @com_github_onsi_ginkgo//ginkgo -- \ + -nodes 10 \ + -flakeAttempts ${FLAKE_ATTEMPTS:-1} \ + $(bazel info bazel-genfiles)/test/e2e/e2e.test \ + -- \ + --repo-root="${REPO_ROOT}" \ + --report-dir="${ARTIFACTS:-$REPO_ROOT/_artifacts}" \ + "$@" diff --git a/devel/setup-e2e-deps.sh b/devel/setup-e2e-deps.sh new file mode 100755 index 000000000..2c43d2cdd --- /dev/null +++ b/devel/setup-e2e-deps.sh @@ -0,0 +1,43 @@ +#!/usr/bin/env bash + +# Copyright 2020 The Jetstack cert-manager contributors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -o nounset +set -o errexit +set -o pipefail + +# This script will load end-to-end test dependencies into the kind cluster, as +# well as installing all 'global' components such as cert-manager itself, +# pebble, ingress-nginx etc. +# If you are running the *full* test suite, you should be sure to run this +# script beforehand. + +SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}") +export REPO_ROOT="${REPO_ROOT:-$SCRIPT_ROOT/..}" + +echo "Installing cert-manager into the kind cluster..." +"${SCRIPT_ROOT}/addon/certmanager/install.sh" + +echo "Installing sample-webhook into the kind cluster..." +"${SCRIPT_ROOT}/addon/samplewebhook/install.sh" + +echo "Installing pebble into the kind cluster..." +"${SCRIPT_ROOT}/addon/pebble/install.sh" + +echo "Installing ingress-nginx into the kind cluster..." +"${SCRIPT_ROOT}/addon/ingressnginx/install.sh" + +echo "Loading vault into the kind cluster..." +"${SCRIPT_ROOT}/addon/vault/install.sh" diff --git a/hack/bin/deps.bzl b/hack/bin/deps.bzl index e574bb5fc..7d5975467 100644 --- a/hack/bin/deps.bzl +++ b/hack/bin/deps.bzl @@ -109,8 +109,8 @@ def install_helm(): ## the version numbers in these rules. http_archive( name = "helm_darwin", - sha256 = "f51830036f746b7f758a40bf49e02527cc5a9f1b78c5809023e570d318eaff5c", - urls = ["https://get.helm.sh/helm-v2.15.1-darwin-amd64.tar.gz"], + sha256 = "05c7748da0ea8d5f85576491cd3c615f94063f20986fd82a0f5658ddc286cdb1", + urls = ["https://get.helm.sh/helm-v3.0.2-darwin-amd64.tar.gz"], build_file_content = """ filegroup( @@ -125,8 +125,8 @@ filegroup( http_archive( name = "helm_linux", - sha256 = "b4d366bd6625477b2954941aeb7b601946aa4226af6728e3a84eac4e62a84042", - urls = ["https://get.helm.sh/helm-v2.15.1-linux-amd64.tar.gz"], + sha256 = "c6b7aa7e4ffc66e8abb4be328f71d48c643cb8f398d95c74d075cfb348710e1d", + urls = ["https://get.helm.sh/helm-v3.0.2-linux-amd64.tar.gz"], build_file_content = """ filegroup( @@ -141,20 +141,6 @@ filegroup( # Define rules for different kubectl versions def install_kubectl(): - http_file( - name = "kubectl_1_11_darwin", - executable = 1, - sha256 = "cf1feeac2fdedfb069131e7d62735b99b49ec43bf0d7565a30379c35056906c4", - urls = ["https://storage.googleapis.com/kubernetes-release/release/v1.11.3/bin/darwin/amd64/kubectl"], - ) - - http_file( - name = "kubectl_1_11_linux", - executable = 1, - sha256 = "0d4c70484e90d4310f03f997b4432e0a97a7f5b5be5c31d281f3d05919f8b46c", - urls = ["https://storage.googleapis.com/kubernetes-release/release/v1.11.3/bin/linux/amd64/kubectl"], - ) - http_file( name = "kubectl_1_12_darwin", executable = 1, @@ -231,61 +217,13 @@ def install_kind(): http_file( name = "kind_darwin", executable = 1, - sha256 = "023f1886207132dcfc62139a86f09488a79210732b00c9ec6431d6f6b7e9d2d3", - urls = ["https://github.com/kubernetes-sigs/kind/releases/download/v0.4.0/kind-darwin-amd64"], + sha256 = "11b8a7fda7c9d6230f0f28ffe57831a7227c0655dfb8d38e838e8f03db6612de", + urls = ["https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-darwin-amd64"], ) http_file( name = "kind_linux", executable = 1, - sha256 = "a97f7d6d97bc0e261ea85433ca564269f117baf0fae051f16b296d2d7541f8dd", - urls = ["https://github.com/kubernetes-sigs/kind/releases/download/v0.4.0/kind-linux-amd64"], - ) - - container_pull( - name = "kind-1.11", - registry = "index.docker.io", - repository = "kindest/node", - tag = "v1.11.10", - digest = "sha256:176845d919899daef63d0dbd1cf62f79902c38b8d2a86e5fa041e491ab795d33", - ) - - container_pull( - name = "kind-1.12", - registry = "index.docker.io", - repository = "kindest/node", - tag = "v1.12.9", - digest = "sha256:bcb79eb3cd6550c1ba9584ce57c832dcd6e442913678d2785307a7ad9addc029", - ) - - container_pull( - name = "kind-1.13", - registry = "index.docker.io", - repository = "kindest/node", - tag = "v1.13.7", - digest = "sha256:f3f1cfc2318d1eb88d91253a9c5fa45f6e9121b6b1e65aea6c7ef59f1549aaaf", - ) - - container_pull( - name = "kind-1.14", - registry = "index.docker.io", - repository = "kindest/node", - tag = "v1.14.3", - digest = "sha256:583166c121482848cd6509fbac525dd62d503c52a84ff45c338ee7e8b5cfe114", - ) - - container_pull( - name = "kind-1.15", - registry = "index.docker.io", - repository = "kindest/node", - tag = "v1.15.0", - digest = "sha256:b4d092fd2b507843dd096fe6c85d06a27a0cbd740a0b32a880fe61aba24bb478", - ) - - container_pull( - name = "kind-1.16", - registry = "eu.gcr.io", - repository = "jetstack-build-infra-images/kind-node", - tag = "1.16.0-alpha.1", - digest = "sha256:b9775b688fda2e6434cda1b9016baf876f381a8325961f59b9ae238166259885", + sha256 = "0e07d5a9d5b8bf410a1ad8a7c8c9c2ea2a4b19eda50f1c629f1afadb7c80fae7", + urls = ["https://github.com/kubernetes-sigs/kind/releases/download/v0.7.0/kind-linux-amd64"], ) diff --git a/hack/ci/lib/build_images.sh b/hack/ci/lib/build_images.sh deleted file mode 100755 index 9fde9553c..000000000 --- a/hack/ci/lib/build_images.sh +++ /dev/null @@ -1,60 +0,0 @@ -#!/bin/bash - -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o errexit -set -o nounset -set -o pipefail - -# build_images will build Docker images for all of cert-manager's components. -# It will transfer them to the 'kind' docker container so they are available -# in a testing environment. - -SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") -source "${SCRIPT_ROOT}/lib.sh" - -build_images() { - # Build cert-manager binaries & docker image - # Set --stamp=true when running a build to workaround issues introduced - # in bazelbuild/rules_go#2110. For more information, see: https://github.com/bazelbuild/rules_go/pull/2110#issuecomment-508713878 - # We should be able to remove the `--stamp=true` arg once this has been fixed! - APP_VERSION="${DOCKER_TAG}" \ - DOCKER_REPO="${DOCKER_REPO}" \ - DOCKER_TAG="${DOCKER_TAG}" \ - bazel run --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 --stamp=true //test/e2e:images - - echo "All images built" - - for IMG in \ - "${DOCKER_REPO}"/cert-manager-controller:"${DOCKER_TAG}" \ - "${DOCKER_REPO}"/cert-manager-cainjector:"${DOCKER_TAG}" \ - "${DOCKER_REPO}"/cert-manager-acmesolver:"${DOCKER_TAG}" \ - "${DOCKER_REPO}"/cert-manager-webhook:"${DOCKER_TAG}" \ - "pebble:bazel" \ - "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1" \ - "k8s.gcr.io/defaultbackend-amd64:bazel" \ - "sample-webhook:bazel" \ - "vault:bazel" \ - "gcr.io/kubernetes-helm/tiller:bazel" \ - ; do - echo "Loading image ${IMG} into kind container" - "${KIND}" load docker-image --name "${KIND_CLUSTER_NAME}" "${IMG}" & - done - echo "Waiting for all images to be loaded..." - wait - echo "All images loaded!" -} - -build_images diff --git a/hack/ci/lib/cluster_create.sh b/hack/ci/lib/cluster_create.sh deleted file mode 100755 index f8c909f87..000000000 --- a/hack/ci/lib/cluster_create.sh +++ /dev/null @@ -1,62 +0,0 @@ -#!/bin/bash - -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o errexit -set -o nounset -set -o pipefail - -SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") -source "${SCRIPT_ROOT}/lib.sh" - -# deploy_kind will deploy a kubernetes-in-docker cluster -deploy_kind() { - echo "Exporting kind image to docker daemon..." - bazel run "${KIND_IMAGE_TARGET}" - - function kubeVersion() { - echo $(docker run \ - --entrypoint="cat" \ - "${KIND_IMAGE}" \ - /kind/version) - } - - # default to v1beta2 - # - if 1.13.x or 1.14.x use v1beta1 - # - if 1.12.x then use v1alpha3 - # - if 1.11.x then use v1alpha2 - vers="$(kubeVersion)" - config="v1beta2" - if [[ "$vers" =~ v1\.11\..+ ]]; then - config="v1alpha2" - fi - if [[ "$vers" =~ v1\.12\..+ ]]; then - config="v1alpha3" - fi - if [[ "$vers" =~ v1\.1[3-4]\..+ ]] ; then - config="v1beta1" - fi - - - echo "Booting Kubernetes version: $vers" - echo "Using kubeadm config api version '$config'" - # create the kind cluster - "${KIND}" create cluster \ - --name="${KIND_CLUSTER_NAME}" \ - --image="${KIND_IMAGE}" \ - --config "${REPO_ROOT}"/test/fixtures/kind/config-"$config".yaml -} - -deploy_kind diff --git a/hack/ci/lib/lib.sh b/hack/ci/lib/lib.sh deleted file mode 100644 index 99e709af9..000000000 --- a/hack/ci/lib/lib.sh +++ /dev/null @@ -1,56 +0,0 @@ -#!/bin/bash - -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o errexit -set -o nounset -set -o pipefail - -_SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") -REPO_ROOT="${_SCRIPT_ROOT}/../../.." - -# This file contains common definitions that are re-used in other scripts - -export K8S_VERSION="${K8S_VERSION:-1.15}" -KUBECTL_TARGET="${KUBECTL_TARGET:-//hack/bin:kubectl-${K8S_VERSION}}" -KIND_IMAGE_TARGET="${KIND_IMAGE_TARGET:-@kind-${K8S_VERSION}//image}" - -export KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-cm-local-cluster}" -export KIND_CONTAINER_NAME="kind-${KIND_CLUSTER_NAME}-control-plane" - -# DOCKER_REPO is the docker repo to use for cert-manager images, either when -# building or deploying cert-manager using these scripts. -export DOCKER_REPO="quay.io/jetstack" - -# DOCKER_TAG is the docker tag to use for the cert-manager images. -# This defaults to 'build' so it doesn't conflict with images built for any -# other purpose -export DOCKER_TAG="build" - -if [ ! "${CM_DEPS_LOADED:-}" = "1" ]; then - # Build all e2e test dependencies - bazel build \ - "${KUBECTL_TARGET}" \ - "${KIND_IMAGE_TARGET}" \ - //hack/bin:kind - - genfiles="$(bazel info bazel-genfiles)" - export KUBECTL="${genfiles}/hack/bin/kubectl-${K8S_VERSION}" - # TODO: use a more unique name for the kind image - export KIND_IMAGE="bazel/image:image" - export KIND="${genfiles}/hack/bin/kind" - - export CM_DEPS_LOADED="1" -fi diff --git a/hack/ci/run-dev-kind.sh b/hack/ci/run-dev-kind.sh deleted file mode 100755 index 2270aa99d..000000000 --- a/hack/ci/run-dev-kind.sh +++ /dev/null @@ -1,75 +0,0 @@ -#!/bin/bash - -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# This script will provision a development environment using kind on your local -# machine. -# The end result should be an environment that can pass e2e tests. - -set -o errexit -set -o nounset -set -o pipefail - -SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") -source "${SCRIPT_ROOT}/lib/lib.sh" - -echo "+++ Creating cluster using kind" -"${SCRIPT_ROOT}/lib/cluster_create.sh" - -echo "+++ Building cert-manager images from source and exporting them to the development cluster" -"${SCRIPT_ROOT}/lib/build_images.sh" - -echo "" -echo "" -echo "Your development environment is now ready." -echo -echo "A single node Kubernetes cluster has been provisioned in a Docker container" -echo "on your machine." -echo "" -echo "You should now configure your shell to use the KUBECONFIG file that has" -echo "been generated in order to access this cluster:" -echo "" -echo " export KUBECONFIG=\$HOME/.kube/kind-config-${KIND_CLUSTER_NAME}" -echo "" -echo "" -echo "A freshly built copy of the cert-manager images have also been exported to" -echo "the docker daemon in this single node Kubernetes cluster." -echo "" -echo "You can build and export a fresh copy of these images with:" -echo "" -echo " ./hack/ci/lib/build_images.sh" -echo "" -echo "" -echo "You should now be able to run end-to-end tests using:" -echo "" -echo " make e2e_test" -echo "" -echo "" -echo "We have \*\*not\*\* automatically deployed cert-manager into this cluster." -echo "To deploy cert-manager into this cluster, run:" -echo "" -echo " bazel run //hack/bin:helm -- install \\" -echo " --name cert-manager \\" -echo " --namespace cert-manager \\" -echo " --values ./test/fixtures/cert-manager-values.yaml \\" -echo " ./deploy/charts/cert-manager" -echo "" -echo "" -echo "Each time you make a change and run build_images.sh, you will need to manually" -echo "delete the cert-manager pod that is deployed in the cert-manager namespace." -echo "" -echo "Thanks for contributing!" -echo "" -echo "" diff --git a/hack/ci/run-e2e-kind.sh b/hack/ci/run-e2e-kind.sh index 23bfc732c..243e5a60d 100755 --- a/hack/ci/run-e2e-kind.sh +++ b/hack/ci/run-e2e-kind.sh @@ -25,25 +25,6 @@ set -o nounset set -o pipefail SCRIPT_ROOT=$(dirname "${BASH_SOURCE}") -source "${SCRIPT_ROOT}/lib/lib.sh" -cleanup() { - # Ignore errors here - "${SCRIPT_ROOT}/lib/cluster_destroy.sh" || true -} -trap cleanup EXIT - -"${SCRIPT_ROOT}/lib/cluster_create.sh" - -export KUBECONFIG="${HOME}/.kube/kind-config-${KIND_CLUSTER_NAME}" - -echo "Testing kind apiserver connectivity" -# Ensure the apiserver is responding -"${KUBECTL}" get nodes - -"${SCRIPT_ROOT}/lib/build_images.sh" - -make e2e_test \ - KUBECONFIG="${KUBECONFIG}" \ - KUBECTL="${KUBECTL}" \ - FLAKE_ATTEMPTS="${FLAKE_ATTEMPTS:-1}" +echo "DEPRECATED: This script will be removed. Invoke './devel/ci-run-e2e.sh' directly instead." +"${SCRIPT_ROOT}/../../devel/ci-run-e2e.sh" diff --git a/hack/ci/run-e2e-minikube.sh b/hack/ci/run-e2e-minikube.sh deleted file mode 100755 index be001ef41..000000000 --- a/hack/ci/run-e2e-minikube.sh +++ /dev/null @@ -1,36 +0,0 @@ -#!/bin/bash - -# Copyright 2019 The Jetstack cert-manager contributors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# This file is the entrypoint to our legacy minikube e2e testing environment -# for cert-manager. It is currently used to run e2e test jobs against a -# 1.9 or lower minikube built cluster. -# This script should not be used for anything except for our CI process. - -set -o errexit -set -o nounset -set -o pipefail - -# Build images while we wait for services to start -make images APP_VERSION=build - -# Wait for e2e service dependencies -echo "Waiting for minikube cluster to be ready..." - -while true; do if kubectl get nodes; then break; fi; echo "Waiting 5s for kubernetes to be ready..."; sleep 5; done - -echo "Running e2e tests" -# Skip RBAC tests as they do not pass on Kubernetes <1.9 -make e2e_test GINKGO_SKIP="RBAC"