@leverege/build-tools 2.13.3 → 2.14.0

package/lib/server/unleash.js

@@ -44,9 +44,16 @@ const npmRunner = async script => {
       await npmRunner(script[i]);
     }
   } else {
-    await execa('npm-check-updates', ['--color'], {
-      stdio: 'inherit'
-    });
-    process.exit(0);
+    try {
+      await execa('npm-check-updates', ['--color', '--packageFile', './package.json'], {
+        stdio: 'inherit'
+      });
+      process.exit(0);
+    } catch (err) {
+      console.log({
+        err
+      }, 'npm-check-update failed');
+      process.exit(err.exitCode);
+    }
   }
 })();

package/lib/web/unleash.js

@@ -44,9 +44,16 @@ const npmRunner = async script => {
       await npmRunner(script[i]);
     }
   } else {
-    await execa('npm-check-updates', ['--color'], {
-      stdio: 'inherit'
-    });
-    process.exit(0);
+    try {
+      await execa('npm-check-updates', ['--color', '--packageFile', './package.json'], {
+        stdio: 'inherit'
+      });
+      process.exit(0);
+    } catch (err) {
+      console.log({
+        err
+      }, 'npm-check-update failed');
+      process.exit(err.exitCode);
+    }
   }
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.13.3",
+  "version": "2.14.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -57,11 +57,11 @@
     "dotenv": "^16.0.1",
     "execa": "^5.1.1",
     "figlet": "^1.5.2",
-    "glob": "^7.2.0",
+    "glob": "^7.2.3",
     "inquirer": "^8.2.4",
     "js-yaml": "^4.1.0",
     "ncp": "^2.0.0",
-    "npm-check-updates": "^13.0.1",
+    "npm-check-updates": "^13.0.3",
     "npm-registry-fetch": "^11.0.0",
     "open": "^8.4.0",
     "ora": "^5.4.1",
@@ -72,10 +72,10 @@
   },
   "devDependencies": {
     "@babel/cli": "^7.17.10",
-    "@babel/core": "^7.18.0",
+    "@babel/core": "^7.18.2",
     "@babel/node": "^7.17.10",
     "@leverege/babel-preset-leverege-node": "^2.0.0",
     "@leverege/eslint-config-leverege": "^3.0.1",
-    "npm": "^8.10.0"
+    "npm": "^8.11.0"
   }
 }

package/src/bash-funcs

@@ -105,3 +105,7 @@ REPOADD
   helm repo add $chart $url &> /dev/null
   helm repo update &> /dev/null
 }
+
+function removeHelmRepo(){
+  helm repo remove $1 &>/dev/null
+}

package/src/helmup

@@ -165,6 +165,10 @@ SA_EXISTS
     --namespace monitoring \
     --values grafana/values-grafana.yaml \
     --version 6.26.5 # latest v8 grafana
+
+  ## Clean up
+  removeHelmRepo prometheus-community
+  removeHelmRepo grafana
 }
 
 function monitoringHelp(){
@@ -271,6 +275,7 @@ function installPreemptibleKiller() {
                --set extraEnv.BLACKLIST_HOURS="10:00-02:00" # No killing from 5AM-9PM EST
 #              --set extraEnv.WHITELIST_HOURS="12:30-13:30"
   [ -f "google_service_account.json" ] && rm google_service_account.json
+  removeHelmRepo estafette
 }
 
 function installCronZombieKiller() {
@@ -403,6 +408,7 @@ DELAY
   check certs: `color g "kubectl -n cert-manager describe certificate"`
 
 HINTS
+  removeHelmRepo jetstack
 }
 
 function installTraefik() {
@@ -450,19 +456,18 @@ deployment:
 TRAEFIK_CFG
   fi
 
-  # old chart => traefik https://containous.github.io/traefik-helm-chart
-  helm repo remove traefik &> /dev/null
   addHelmRepo traefik https://helm.traefik.io/traefik
 
   helm upgrade --install traefik traefik/traefik \
     --namespace traefik \
     --values $TRAEFIK_HA_YAML
+
+  removeHelmRepo traefik
 }
 
 function installVelero() {
+  # Follows instructions => https://github.com/vmware-tanzu/velero-plugin-for-gcp
   showInstalling "Velero Backup Management"
-  open https://velero.io/docs
-  yesToContinue "when you are done checking the docs"
 
   ## Set the project id by parsing current context
   currContext=`kubectl config current-context`
@@ -483,7 +488,9 @@ function installVelero() {
   ## Create a service account
   printf "\nCreating the service account\n"
   gcloud iam service-accounts create velero \
-    --display-name "Velero service account" &>/dev/null
+    --project $PROJECT_ID \
+    --display-name "Velero service account" \
+    --description "Velero service account" &>/dev/null
   if [ $? -eq 0 ];
   then
     # no error means a new SA was created - slight delay to let it update
@@ -504,6 +511,11 @@ function installVelero() {
     compute.snapshots.useReadOnly
     compute.snapshots.delete
     compute.zones.get
+    iam.serviceAccounts.actAs
+    storage.objects.create
+    storage.objects.delete
+    storage.objects.get
+    storage.objects.list
   )
 
   printf "\nAssigning roles to the SA\n"
@@ -511,43 +523,64 @@ function installVelero() {
     --project $PROJECT_ID \
     --title "Velero Server" \
     --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &>/dev/null
+  if [ $? -ne 0 ];
+  then
+    # assume error is that role exists so try updating instead
+    printf "\nUpdating roles on the SA\n"
+    gcloud iam roles update velero.server \
+      --project $PROJECT_ID \
+      --title "Velero Server" \
+      --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &>/dev/null
+  fi
   warnOnError $? "Failed to add roles to velero.server - perhaps they already exist?"
 
   printf "\nBinding IAM policy to the SA\n"
   gcloud projects add-iam-policy-binding $PROJECT_ID \
+    --project $PROJECT_ID \
     --member serviceAccount:$SERVICE_ACCOUNT_EMAIL \
+    --condition 'None' \
     --role projects/$PROJECT_ID/roles/velero.server &>/dev/null
   warnOnError $? "gcloud problem binding IAM policy"
 
-  gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://$BUCKET
-
-  ## Create keys
-  VELERO_CREDS="velero-credentials"
-  gcloud iam service-accounts keys create $VELERO_CREDS \
-    --iam-account $SERVICE_ACCOUNT_EMAIL
+  printf "\nBinding workload identity IAM policy to the SA\n"
+  gcloud iam service-accounts add-iam-policy-binding \
+      --member "serviceAccount:$PROJECT_ID.svc.id.goog[velero/velero]" \
+      --role roles/iam.workloadIdentityUser \
+      $SERVICE_ACCOUNT_EMAIL
+  warnOnError $? "gcloud workload identity binding may have failed"
 
   ## Create velero namespace
   kubectl get namespaces velero &>/dev/null
   [ $? -eq 1 ] && kubectl create ns velero
 
-  ## Create kubernetes secret
-  printf "\nStoring the credentials in $VELERO_CREDS k8s secret\n"
-  kubectl delete secret $VELERO_CREDS --namespace velero &>/dev/null # toss old key if exists
-  kubectl create secret generic $VELERO_CREDS --namespace velero --from-file cloud=${VELERO_CREDS}
+  printf "\nCreate and annotate the k8s SA\n"
+  kubectl create serviceaccount velero --namespace velero
+  warnOnError $? "Failed to create k8s SA - perhaps it already exists?"
+  
+  kubectl annotate serviceaccount velero \
+    --namespace velero \
+    iam.gke.io/gcp-service-account=$SERVICE_ACCOUNT_EMAIL
+  warnOnError $? "Failed to annotate k8s SA - things may fail"
+
+  gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://$BUCKET
 
   ## Clean up from previous failed install
   kubectl delete volumesnapshotlocation.velero.io -n velero  gcp &>/dev/null
 
-  ## Install velero
+  ## Install velero chart   => https://github.com/vmware-tanzu/helm-charts/blob/main/charts/velero/values.yaml
+  ## Helpful debugging link => https://github.com/vmware-tanzu/helm-charts/issues/351
   addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
   helm upgrade --install velero vmware-tanzu/velero \
     --namespace velero \
+    --set credentials.useSecret="false" \
     --set configuration.provider="gcp" \
     --set configuration.backupStorageLocation.name=default \
     --set configuration.backupStorageLocation.bucket="${BUCKET}" \
+    --set configuration.backupStorageLocation.config.serviceAccount=$SERVICE_ACCOUNT_EMAIL \
+    --set serviceAccount.server.create="false" \
+    --set serviceAccount.server.name="velero" \
     --set snapshotsEnabled="true" \
     --set configuration.volumeSnapshotLocation.name=default \
-    --set credentials.existingSecret="${VELERO_CREDS}" \
     --set "initContainers[0].name"="velero-plugin-for-gcp" \
     --set "initContainers[0].image"="velero/velero-plugin-for-gcp:v1.0.0" \
     --set "initContainers[0].volumeMounts[0].mountPath"="/target" \
@@ -564,8 +597,11 @@ function installVelero() {
     --set schedules.timescale.template.snapshotVolumes="true"
 
   velero get backups
-  printf "\n\nVelero keys => kubectl get secret $VELERO_CREDS --namespace velero\n\n"
-  /bin/rm -f $VELERO_CREDS
+  cat<<DONE_VELERO
+
+  Velero docs => `color g 'open https://velero.io/docs'`
+DONE_VELERO
+  removeHelmRepo vmware-tanzu
   echo -n "npm run ahoy && velero get backups" | pbcopy
 }
 
@@ -644,8 +680,7 @@ CHARTVER=
 FROM_VERSIONS=
 function doInstall() {
 
-# helm repo remove stable &> /dev/null # stable was deprecated
-  helm repo update &> /dev/null
+  helm repo update # XXX &> /dev/null
 
   for PARAM in "$@";
   do
@@ -692,6 +727,7 @@ function doInstall() {
         helm upgrade --install elasticsearch elastic/elasticsearch \
           --values $LOCAL_ES_VALUES \
           --set volumeClaimTemplate.storageClassName="ssd"
+        removeHelmRepo elastic
         ;;
 
       "estafette"|"preemptible-killer")
@@ -711,6 +747,7 @@ function doInstall() {
         showInstalling "PostgreSQL Database"
         addHelmRepo bitnami https://charts.bitnami.com/bitnami
         helm upgrade --install postgres bitnami/postgresql -f postgres/postgres-values.yaml --version 8.9.6
+        removeHelmRepo bitnami
         ;;
 
       "redis")
@@ -721,12 +758,14 @@ function doInstall() {
           -f redis/redis-values.yaml \
           --version $REDIS_HELM_CHART
         printf "\n\nTo start a specific version => `color g 'REDIS_HELM_CHART="13.0.1" helmup redis'`\n\n"
+        removeHelmRepo bitnami
         ;;
 
       "reloader")
         showInstalling "Stakater ConfigMap Reloader"
         addHelmRepo stakater https://stakater.github.io/stakater-charts
         helm upgrade --install reloader stakater/reloader
+        removeHelmRepo stakater
         ;;
 
       "timescale-db")

package/src/unleash.js

@@ -39,7 +39,14 @@ const npmRunner = async ( script ) => {
       await npmRunner( script[i] )
     }
   } else {
-    await execa( 'npm-check-updates', [ '--color', ], { stdio : 'inherit' } )
-    process.exit( 0 )
+    try {
+      await execa( 'npm-check-updates', [
+        '--color', '--packageFile', './package.json',
+      ], { stdio : 'inherit' } )
+      process.exit( 0 )
+    } catch ( err ) {
+      console.log( { err }, 'npm-check-update failed' )
+      process.exit( err.exitCode )
+    }
   }
 } )()