porkadot 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d234a54eadea75f593857f0d1a697af8be3cb74c5a4b48bb42b19ec966a905ae
-  data.tar.gz: a62e0011627d9d7f5b93e34fadd8c76df6dc88496c7ff39b561d808880ac1570
+  metadata.gz: c4a540c5dd8b6b61feeb82c0237ec62c70740de25656cfa0b95ae0ef22bfffe5
+  data.tar.gz: aeddd88d774b653d1e5dc40cc28996090baa90ada864ccb1457340d2a4791582
 SHA512:
-  metadata.gz: e359ab5f970e9ed84d82c1210a4c74215bec8fb878a42b736add72a2c27771ab1c8fe3d36125387694b3ea84c626f5b5bbdcbc9bbcb25e0f47dfa6c54484c651
-  data.tar.gz: 1dda5458027c308e37832c74cd66b67422935c88968960b2ea017aa30aad2a6d39aa3ca2d3eaeb0d334431e4a2e50f4eb2e35bd43cca8b216eccab9c93a38c6b
+  metadata.gz: 711a19855866bb0d22ffcb47558a56b20c9b000d2b5c38a9f88b9553bde85d918b069cd0520e46817e62de57fb7f29ce16e98c48688fb1a3d744f29f3c9fb6cf
+  data.tar.gz: ffd3ff0472e4df3374086857fac3e239d638b59e97449e4e1e480673f2af64129fbe92b22979d364cf850dcb3fad6258d241e37a6557ac370a1fdbe2b72064f2

data/lib/porkadot/assets/bootstrap.rb

@@ -18,8 +18,8 @@ module Porkadot; module Assets
 
     def render
       logger.info "--> Rendering bootstrap manifests"
-      unless File.directory?(config.target_path)
-        FileUtils.mkdir_p(config.target_path)
+      unless File.directory?(config.bootstrap_path)
+        FileUtils.mkdir_p(config.bootstrap_path)
       end
       render_secrets
       render_erb 'bootstrap/kubeconfig-bootstrap.yaml'

data/lib/porkadot/assets/etcd.rb

@@ -50,6 +50,9 @@ module Porkadot; module Assets
       unless File.directory?(config.target_path)
         FileUtils.mkdir_p(config.target_path)
       end
+      unless File.directory?(config.target_secrets_path)
+        FileUtils.mkdir_p(config.target_secrets_path)
+      end
       render_ca_crt
       render_etcd_crt
       render_erb 'etcd-server.yaml', etcd: global_config.etcd

data/lib/porkadot/assets/kubelet/install-deps.sh.erb

@@ -1,20 +1,27 @@
 #!/bin/bash
 
+architecture="arm64"
+case $(uname -m) in
+    x86_64) architecture="amd64" ;;
+    arm)    dpkg --print-architecture | grep -q "arm64" && architecture="arm64" || architecture="arm" ;;
+esac
+echo $architecture
+
 CNI_VERSION="<%= global_config.k8s.networking.cni_version %>"
 mkdir -p /opt/cni/bin
-curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-amd64-${CNI_VERSION}.tgz" | tar -C /opt/cni/bin -xz
+curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-${architecture}-${CNI_VERSION}.tgz" | tar -C /opt/cni/bin -xz
 
 RELEASE="<%= global_config.k8s.kubernetes_version %>"
 
 mkdir -p /opt/bin
 
-curl -L https://storage.googleapis.com/kubernetes-release/release/${RELEASE}/bin/linux/amd64/kubectl \
+curl -L https://storage.googleapis.com/kubernetes-release/release/${RELEASE}/bin/linux/${architecture}/kubectl \
   -o /opt/bin/kubectl-${RELEASE}
 chmod +x /opt/bin/kubectl-${RELEASE}
 rm -f /opt/bin/kubectl
 ln -s /opt/bin/kubectl-${RELEASE} /opt/bin/kubectl
 
-curl -L https://storage.googleapis.com/kubernetes-release/release/${RELEASE}/bin/linux/amd64/kubelet \
+curl -L https://storage.googleapis.com/kubernetes-release/release/${RELEASE}/bin/linux/${architecture}/kubelet \
   -o /opt/bin/kubelet-${RELEASE}
 chmod +x /opt/bin/kubelet-${RELEASE}
 rm -f /opt/bin/kubelet

data/lib/porkadot/assets/kubelet.rb

@@ -50,6 +50,9 @@ module Porkadot; module Assets
       unless File.directory?(config.target_path)
         FileUtils.mkdir_p(config.target_path)
       end
+      unless File.directory?(config.target_secrets_path)
+        FileUtils.mkdir_p(config.target_secrets_path)
+      end
       ca_data = certs.ca_cert.to_pem
       ca_data = Base64.strict_encode64(ca_data)
 

data/lib/porkadot/assets/kubernetes/manifests/kube-apiserver.secrets.yaml.erb

@@ -0,0 +1,37 @@
+<% k8s = global_config.k8s -%>
+---
+apiVersion: v1
+data:
+  apiserver.crt: <%= certs.kubernetes.to_base64(:apiserver_cert) %>
+  apiserver.key: <%= certs.kubernetes.to_base64(:apiserver_key) %>
+  ca.crt: <%= certs.kubernetes.to_base64(:ca_cert) %>
+  front-proxy-ca.crt: <%= certs.front_proxy.to_base64(:ca_cert) %>
+  front-proxy-client.crt: <%= certs.front_proxy.to_base64(:client_cert) %>
+  front-proxy-client.key: <%= certs.front_proxy.to_base64(:client_key) %>
+  kubelet-client.crt: <%= certs.kubernetes.to_base64(:kubelet_client_cert) %>
+  kubelet-client.key: <%= certs.kubernetes.to_base64(:kubelet_client_key) %>
+  sa.pub: <%= certs.kubernetes.to_base64(:sa_public_key) %>
+kind: Secret
+metadata:
+  name: kube-apiserver
+  namespace: kube-system
+  labels:
+    <%- k8s.apiserver.labels.each do |k, v| -%>
+    <%= k.to_s %>: <%= v %>
+    <%- end -%>
+type: Opaque
+---
+apiVersion: v1
+data:
+  ca.crt: <%= certs.etcd.to_base64(:ca_cert) %>
+  etcd-client.crt:  <%= certs.etcd.to_base64(:client_cert) %>
+  etcd-client.key:  <%= certs.etcd.to_base64(:client_key) %>
+kind: Secret
+metadata:
+  name: etcd-tls
+  namespace: kube-system
+  labels:
+    <%- k8s.apiserver.labels.each do |k, v| -%>
+    <%= k.to_s %>: <%= v %>
+    <%- end -%>
+type: Opaque

data/lib/porkadot/assets/kubernetes/manifests/kube-apiserver.yaml.erb

@@ -1,41 +1,5 @@
 <% k8s = global_config.k8s -%>
 ---
-apiVersion: v1
-data:
-  apiserver.crt: <%= certs.kubernetes.to_base64(:apiserver_cert) %>
-  apiserver.key: <%= certs.kubernetes.to_base64(:apiserver_key) %>
-  ca.crt: <%= certs.kubernetes.to_base64(:ca_cert) %>
-  front-proxy-ca.crt: <%= certs.front_proxy.to_base64(:ca_cert) %>
-  front-proxy-client.crt: <%= certs.front_proxy.to_base64(:client_cert) %>
-  front-proxy-client.key: <%= certs.front_proxy.to_base64(:client_key) %>
-  kubelet-client.crt: <%= certs.kubernetes.to_base64(:kubelet_client_cert) %>
-  kubelet-client.key: <%= certs.kubernetes.to_base64(:kubelet_client_key) %>
-  sa.pub: <%= certs.kubernetes.to_base64(:sa_public_key) %>
-kind: Secret
-metadata:
-  name: kube-apiserver
-  namespace: kube-system
-  labels:
-    <%- k8s.apiserver.labels.each do |k, v| -%>
-    <%= k.to_s %>: <%= v %>
-    <%- end -%>
-type: Opaque
----
-apiVersion: v1
-data:
-  ca.crt: <%= certs.etcd.to_base64(:ca_cert) %>
-  etcd-client.crt:  <%= certs.etcd.to_base64(:client_cert) %>
-  etcd-client.key:  <%= certs.etcd.to_base64(:client_key) %>
-kind: Secret
-metadata:
-  name: etcd-tls
-  namespace: kube-system
-  labels:
-    <%- k8s.apiserver.labels.each do |k, v| -%>
-    <%= k.to_s %>: <%= v %>
-    <%- end -%>
-type: Opaque
----
 apiVersion: "apps/v1"
 kind: DaemonSet
 metadata:

data/lib/porkadot/assets/kubernetes/manifests/kube-controller-manager.secrets.yaml.erb

@@ -0,0 +1,16 @@
+<% k8s = global_config.k8s -%>
+---
+apiVersion: v1
+data:
+  ca.crt: <%= certs.kubernetes.to_base64(:ca_cert) %>
+  ca.key: <%= certs.kubernetes.to_base64(:ca_key) %>
+  sa.key: <%= certs.kubernetes.to_base64(:sa_private_key) %>
+kind: Secret
+metadata:
+  name: kube-controller-manager
+  namespace: kube-system
+  labels:
+    <%- k8s.controller_manager.labels.each do |k, v| -%>
+    <%= k.to_s %>: <%= v %>
+    <%- end -%>
+type: Opaque

data/lib/porkadot/assets/kubernetes/manifests/kube-controller-manager.yaml.erb

@@ -44,21 +44,6 @@ metadata:
     <%= k.to_s %>: <%= v %>
     <%- end -%>
 ---
-apiVersion: v1
-data:
-  ca.crt: <%= certs.kubernetes.to_base64(:ca_cert) %>
-  ca.key: <%= certs.kubernetes.to_base64(:ca_key) %>
-  sa.key: <%= certs.kubernetes.to_base64(:sa_private_key) %>
-kind: Secret
-metadata:
-  name: kube-controller-manager
-  namespace: kube-system
-  labels:
-    <%- k8s.controller_manager.labels.each do |k, v| -%>
-    <%= k.to_s %>: <%= v %>
-    <%- end -%>
-type: Opaque
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:

data/lib/porkadot/assets/kubernetes.rb

@@ -20,6 +20,9 @@ module Porkadot; module Assets
       unless File.directory?(config.manifests_path)
         FileUtils.mkdir_p(config.manifests_path)
       end
+      unless File.directory?(config.manifests_secrets_path)
+        FileUtils.mkdir_p(config.manifests_secrets_path)
+      end
       lb = global_config.lb
       cni = global_config.cni
       render_erb 'manifests/porkadot.yaml'
@@ -27,9 +30,11 @@ module Porkadot; module Assets
       render_erb "manifests/#{lb.type}.yaml"
       render_erb "manifests/#{cni.type}.yaml"
       render_erb "manifests/kube-apiserver.yaml"
+      render_secrets_erb "manifests/kube-apiserver.secrets.yaml"
       render_erb "manifests/kube-proxy.yaml"
       render_erb "manifests/kube-scheduler.yaml"
       render_erb "manifests/kube-controller-manager.yaml"
+      render_secrets_erb "manifests/kube-controller-manager.secrets.yaml"
       render_erb "manifests/pod-checkpointer.yaml"
       render_erb "manifests/kubelet-rubber-stamp.yaml"
       render_erb 'install.sh'

data/lib/porkadot/assets.rb

@@ -21,4 +21,19 @@ module Porkadot::Assets
     end
   end
 
+  def render_secrets_erb file, opts={}
+    file = file.to_s
+    opts[:config] = self.config
+    opts[:global_config] = self.global_config
+    opts[:certs] = Porkadot::Assets::Certs.new(self.global_config)
+    opts[:u] = ErbUtils.new
+
+    logger.info "----> #{file}"
+    open(File.join(self.class::TEMPLATE_DIR, "#{file}.erb")) do |io|
+      open(config.secrets_path(file), 'w') do |out|
+        out.write ERB.new(io.read, trim_mode: '-').result_with_hash(opts)
+      end
+    end
+  end
+
 end

data/lib/porkadot/config.rb

@@ -81,6 +81,10 @@ module Porkadot
       File.expand_path(raw.local.assets_dir)
     end
 
+    def secrets_root_dir
+      File.join(self.assets_dir, 'secrets')
+    end
+
   end
 
   module ConfigUtils
@@ -102,6 +106,10 @@ module Porkadot
     end
     alias path asset_path
 
+    def secrets_path file
+      File.join(self.target_secrets_path, file.to_s)
+    end
+
     def method_missing name, *args
       return nil if self.raw.nil?
       self.raw[name]

data/lib/porkadot/configs/bootstrap.rb

@@ -16,6 +16,10 @@ module Porkadot; module Configs
       def target_path
         File.join(bootstrap_config.target_path, 'kubelet')
       end
+
+      def target_secrets_path
+        File.join(bootstrap_config.target_secrets_path, 'kubelet')
+      end
     end
 
     include Porkadot::ConfigUtils
@@ -31,12 +35,20 @@ module Porkadot; module Configs
       File.join(self.config.assets_dir, 'bootstrap')
     end
 
+    def target_secrets_path
+      File.join(self.config.secrets_root_dir, 'bootstrap')
+    end
+
     def bootstrap_path
       File.join(self.target_path, 'bootstrap')
     end
 
+    def bootstrap_secrets_path
+      File.join(self.target_secrets_path, 'bootstrap')
+    end
+
     def secrets_path
-      File.join(self.bootstrap_path, 'secrets')
+      File.join(self.bootstrap_secrets_path, 'secrets')
     end
 
     def kubeconfig_path

data/lib/porkadot/configs/etcd.rb

@@ -79,16 +79,20 @@ module Porkadot; module Configs
       File.join(self.kubelet.addon_path, 'etcd')
     end
 
+    def target_secrets_path
+      File.join(self.kubelet.addon_secrets_path, 'etcd')
+    end
+
     def ca_crt_path
-      File.join(self.target_path, 'ca.crt')
+      File.join(self.target_secrets_path, 'ca.crt')
     end
 
     def etcd_key_path
-      File.join(self.target_path, 'etcd.key')
+      File.join(self.target_secrets_path, 'etcd.key')
     end
 
     def etcd_crt_path
-      File.join(self.target_path, 'etcd.crt')
+      File.join(self.target_secrets_path, 'etcd.crt')
     end
 
   end

data/lib/porkadot/configs/kubelet.rb

@@ -41,16 +41,24 @@ module Porkadot; module Configs
       File.join(self.config.assets_dir, 'kubelet', name)
     end
 
+    def target_secrets_path
+      File.join(self.config.secrets_root_dir, 'kubelet', name)
+    end
+
     def addon_path
       File.join(self.target_path, 'addons')
     end
 
+    def addon_secrets_path
+      File.join(self.target_secrets_path, 'addons')
+    end
+
     def ca_crt_path
       File.join(self.target_path, 'ca.crt')
     end
 
     def bootstrap_key_path
-      File.join(self.target_path, 'bootstrap.key')
+      File.join(self.target_secrets_path, 'bootstrap.key')
     end
 
     def bootstrap_cert_path

data/lib/porkadot/configs/kubernetes.rb

@@ -27,10 +27,18 @@ module Porkadot; module Configs
       File.join(self.config.assets_dir, 'kubernetes')
     end
 
+    def target_secrets_path
+      File.join(self.config.secrets_root_dir, 'kubernetes')
+    end
+
     def manifests_path
       File.join(self.target_path, 'manifests')
     end
 
+    def manifests_secrets_path
+      File.join(self.target_secrets_path, 'manifests')
+    end
+
     def control_plane_endpoint_host_and_port
       endpoint = self.config.k8s.control_plane_endpoint
       raise "kubernetes.control_plane_endpoint should not be nil" unless endpoint

data/lib/porkadot/install/bootstrap.rb

@@ -1,6 +1,7 @@
 module Porkadot; module Install
   class Bootstrap
     KUBE_TEMP = File.join(Porkadot::Install::KUBE_TEMP, 'bootstrap')
+    KUBE_SECRETS_TEMP = File.join(Porkadot::Install::KUBE_TEMP, '.bootstrap')
     include SSHKit::DSL
     attr_reader :global_config
     attr_reader :config
@@ -21,8 +22,11 @@ module Porkadot; module Install
         execute(:mkdir, '-p', Porkadot::Install::KUBE_TEMP)
         if test("[ -d #{KUBE_TEMP} ]")
           execute(:rm, '-rf', KUBE_TEMP)
+          execute(:rm, '-rf', KUBE_SECRETS_TEMP)
         end
         upload! config.target_path, KUBE_TEMP, recursive: true
+        upload! config.target_secrets_path, KUBE_SECRETS_TEMP, recursive: true
+        execute(:cp, '-r', KUBE_SECRETS_TEMP + '/*', KUBE_TEMP)
 
         as user: 'root' do
           execute(:bash, File.join(KUBE_TEMP, 'install.sh'))
@@ -44,8 +48,11 @@ module Porkadot; module Install
         execute(:mkdir, '-p', Porkadot::Install::KUBE_TEMP)
         if test("[ -d #{KUBE_TEMP} ]")
           execute(:rm, '-rf', KUBE_TEMP)
+          execute(:rm, '-rf', KUBE_SECRETS_TEMP)
         end
         upload! config.target_path, KUBE_TEMP, recursive: true
+        upload! config.target_secrets_path, KUBE_SECRETS_TEMP, recursive: true
+        execute(:cp, '-r', KUBE_SECRETS_TEMP + '/*', KUBE_TEMP)
 
         global_config.nodes.each do |k, node|
           if node.apiserver?

data/lib/porkadot/install/kubelet.rb

@@ -1,6 +1,7 @@
 module Porkadot; module Install
   class KubeletList
     KUBE_TEMP = File.join(Porkadot::Install::KUBE_TEMP, 'kubelet')
+    KUBE_SECRETS_TEMP = File.join(Porkadot::Install::KUBE_TEMP, '.kubelet')
     include SSHKit::DSL
     attr_reader :global_config
     attr_reader :logger
@@ -27,8 +28,11 @@ module Porkadot; module Install
         execute(:mkdir, '-p', Porkadot::Install::KUBE_TEMP)
         if test("[ -d #{KUBE_TEMP} ]")
           execute(:rm, '-rf', KUBE_TEMP)
+          execute(:rm, '-rf', KUBE_SECRETS_TEMP)
         end
         upload! host.config.target_path, KUBE_TEMP, recursive: true
+        upload! host.config.target_secrets_path, KUBE_SECRETS_TEMP, recursive: true
+        execute(:cp, '-r', KUBE_SECRETS_TEMP + '/*', KUBE_TEMP)
 
         as user: 'root' do
           unless test("[ -f /opt/bin/kubelet-#{host.global_config.k8s.kubernetes_version} ]") && !force

data/lib/porkadot/install/kubernetes.rb

@@ -1,6 +1,7 @@
 module Porkadot; module Install
   class Kubernetes
     KUBE_TEMP = File.join(Porkadot::Install::KUBE_TEMP, 'kubernetes')
+    KUBE_SECRETS_TEMP = File.join(Porkadot::Install::KUBE_TEMP, '.kubernetes')
     include SSHKit::DSL
     attr_reader :global_config
     attr_reader :config
@@ -19,8 +20,11 @@ module Porkadot; module Install
         execute(:mkdir, '-p', Porkadot::Install::KUBE_TEMP)
         if test("[ -d #{KUBE_TEMP} ]")
           execute(:rm, '-rf', KUBE_TEMP)
+          execute(:rm, '-rf', KUBE_SECRETS_TEMP)
         end
         upload! config.target_path, KUBE_TEMP, recursive: true
+        upload! config.target_secrets_path, KUBE_SECRETS_TEMP, recursive: true
+        execute(:cp, '-r', KUBE_SECRETS_TEMP + '/*', KUBE_TEMP)
 
         as user: 'root' do
           execute(:bash, File.join(KUBE_TEMP, 'install.sh'))

data/lib/porkadot/version.rb

@@ -1,3 +1,3 @@
 module Porkadot
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: porkadot
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - OTSUKA, Yuanying
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-03-27 00:00:00.000000000 Z
+date: 2020-04-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -141,7 +141,9 @@ files:
 - lib/porkadot/assets/kubernetes.rb
 - lib/porkadot/assets/kubernetes/install.sh.erb
 - lib/porkadot/assets/kubernetes/manifests/flannel.yaml.erb
+- lib/porkadot/assets/kubernetes/manifests/kube-apiserver.secrets.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/kube-apiserver.yaml.erb
+- lib/porkadot/assets/kubernetes/manifests/kube-controller-manager.secrets.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/kube-controller-manager.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/kube-proxy.yaml.erb
 - lib/porkadot/assets/kubernetes/manifests/kube-scheduler.yaml.erb