@leverege/build-tools 2.13.4 → 2.14.1

package/lib/server/unleash.js

@@ -44,16 +44,6 @@ const npmRunner = async script => {
       await npmRunner(script[i]);
     }
   } else {
-    try {
-      await execa('npm-check-updates', ['--color', '--packageFile', './package.json'], {
-        stdio: 'inherit'
-      });
-      process.exit(0);
-    } catch (err) {
-      console.log({
-        err
-      }, 'npm-check-update failed');
-      process.exit(err.exitCode);
-    }
+    process.exit(0);
   }
 })();

package/lib/web/unleash.js

@@ -44,16 +44,6 @@ const npmRunner = async script => {
       await npmRunner(script[i]);
     }
   } else {
-    try {
-      await execa('npm-check-updates', ['--color', '--packageFile', './package.json'], {
-        stdio: 'inherit'
-      });
-      process.exit(0);
-    } catch (err) {
-      console.log({
-        err
-      }, 'npm-check-update failed');
-      process.exit(err.exitCode);
-    }
+    process.exit(0);
   }
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.13.4",
+  "version": "2.14.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -61,7 +61,7 @@
     "inquirer": "^8.2.4",
     "js-yaml": "^4.1.0",
     "ncp": "^2.0.0",
-    "npm-check-updates": "^13.0.3",
+    "npm-check-updates": "^13.1.1",
     "npm-registry-fetch": "^11.0.0",
     "open": "^8.4.0",
     "ora": "^5.4.1",
@@ -76,6 +76,6 @@
     "@babel/node": "^7.17.10",
     "@leverege/babel-preset-leverege-node": "^2.0.0",
     "@leverege/eslint-config-leverege": "^3.0.1",
-    "npm": "^8.11.0"
+    "npm": "^8.12.1"
   }
 }

package/src/bash-funcs

@@ -105,3 +105,7 @@ REPOADD
   helm repo add $chart $url &> /dev/null
   helm repo update &> /dev/null
 }
+
+function removeHelmRepo(){
+  helm repo remove $1 &>/dev/null
+}

package/src/helmup

@@ -8,6 +8,8 @@
 # Load the standard helper functions
 . `build-tools --bashfun`
 
+HELMUP_ARGS=("$*")
+
 # removed geotile-server from standard platform 3/20/22 - low usage
 PLATFORM=(
   authz-server
@@ -39,6 +41,24 @@ SYSTEM=(
   monitoring # do monitoring last to show password
 )
 
+# support for legacy bitnami charts
+function addBitnamiRepo() {
+  if [ ! -z "$BITNAMI_LATEST" ];
+  then
+    BITNAMI_URL="https://charts.bitnami.com/bitnami"
+  else
+    cat<<CATNAMI
+    Using the pre 2022 legacy charts from bitnami. To use latest run:
+
+        `color y "BITNAMI_LATEST=1 $HELMUP_ARGS"`
+
+CATNAMI
+    BITNAMI_URL="https://raw.githubusercontent.com/bitnami/charts/eb5f9a9513d987b519f0ecd732e7031241c50328/bitnami"
+  fi
+
+  addHelmRepo bitnami $BITNAMI_URL
+}
+
 function checkTimescalePassword(){
   kubectl get secret postgresql-password
   if [[ $? -eq 1 ]]; then
@@ -165,6 +185,10 @@ SA_EXISTS
     --namespace monitoring \
     --values grafana/values-grafana.yaml \
     --version 6.26.5 # latest v8 grafana
+
+  ## Clean up
+  removeHelmRepo prometheus-community
+  removeHelmRepo grafana
 }
 
 function monitoringHelp(){
@@ -271,6 +295,7 @@ function installPreemptibleKiller() {
                --set extraEnv.BLACKLIST_HOURS="10:00-02:00" # No killing from 5AM-9PM EST
 #              --set extraEnv.WHITELIST_HOURS="12:30-13:30"
   [ -f "google_service_account.json" ] && rm google_service_account.json
+  removeHelmRepo estafette
 }
 
 function installCronZombieKiller() {
@@ -403,6 +428,7 @@ DELAY
   check certs: `color g "kubectl -n cert-manager describe certificate"`
 
 HINTS
+  removeHelmRepo jetstack
 }
 
 function installTraefik() {
@@ -450,19 +476,18 @@ deployment:
 TRAEFIK_CFG
   fi
 
-  # old chart => traefik https://containous.github.io/traefik-helm-chart
-  helm repo remove traefik &> /dev/null
   addHelmRepo traefik https://helm.traefik.io/traefik
 
   helm upgrade --install traefik traefik/traefik \
     --namespace traefik \
     --values $TRAEFIK_HA_YAML
+
+  removeHelmRepo traefik
 }
 
 function installVelero() {
+  # Follows instructions => https://github.com/vmware-tanzu/velero-plugin-for-gcp
   showInstalling "Velero Backup Management"
-  open https://velero.io/docs
-  yesToContinue "when you are done checking the docs"
 
   ## Set the project id by parsing current context
   currContext=`kubectl config current-context`
@@ -483,7 +508,9 @@ function installVelero() {
   ## Create a service account
   printf "\nCreating the service account\n"
   gcloud iam service-accounts create velero \
-    --display-name "Velero service account" &>/dev/null
+    --project $PROJECT_ID \
+    --display-name "Velero service account" \
+    --description "Velero service account" &>/dev/null
   if [ $? -eq 0 ];
   then
     # no error means a new SA was created - slight delay to let it update
@@ -504,6 +531,11 @@ function installVelero() {
     compute.snapshots.useReadOnly
     compute.snapshots.delete
     compute.zones.get
+    iam.serviceAccounts.actAs
+    storage.objects.create
+    storage.objects.delete
+    storage.objects.get
+    storage.objects.list
   )
 
   printf "\nAssigning roles to the SA\n"
@@ -511,43 +543,64 @@ function installVelero() {
     --project $PROJECT_ID \
     --title "Velero Server" \
     --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &>/dev/null
+  if [ $? -ne 0 ];
+  then
+    # assume error is that role exists so try updating instead
+    printf "\nUpdating roles on the SA\n"
+    gcloud iam roles update velero.server \
+      --project $PROJECT_ID \
+      --title "Velero Server" \
+      --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &>/dev/null
+  fi
   warnOnError $? "Failed to add roles to velero.server - perhaps they already exist?"
 
   printf "\nBinding IAM policy to the SA\n"
   gcloud projects add-iam-policy-binding $PROJECT_ID \
+    --project $PROJECT_ID \
     --member serviceAccount:$SERVICE_ACCOUNT_EMAIL \
+    --condition 'None' \
     --role projects/$PROJECT_ID/roles/velero.server &>/dev/null
   warnOnError $? "gcloud problem binding IAM policy"
 
-  gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://$BUCKET
-
-  ## Create keys
-  VELERO_CREDS="velero-credentials"
-  gcloud iam service-accounts keys create $VELERO_CREDS \
-    --iam-account $SERVICE_ACCOUNT_EMAIL
+  printf "\nBinding workload identity IAM policy to the SA\n"
+  gcloud iam service-accounts add-iam-policy-binding \
+      --member "serviceAccount:$PROJECT_ID.svc.id.goog[velero/velero]" \
+      --role roles/iam.workloadIdentityUser \
+      $SERVICE_ACCOUNT_EMAIL
+  warnOnError $? "gcloud workload identity binding may have failed"
 
   ## Create velero namespace
   kubectl get namespaces velero &>/dev/null
   [ $? -eq 1 ] && kubectl create ns velero
 
-  ## Create kubernetes secret
-  printf "\nStoring the credentials in $VELERO_CREDS k8s secret\n"
-  kubectl delete secret $VELERO_CREDS --namespace velero &>/dev/null # toss old key if exists
-  kubectl create secret generic $VELERO_CREDS --namespace velero --from-file cloud=${VELERO_CREDS}
+  printf "\nCreate and annotate the k8s SA\n"
+  kubectl create serviceaccount velero --namespace velero
+  warnOnError $? "Failed to create k8s SA - perhaps it already exists?"
+  
+  kubectl annotate serviceaccount velero \
+    --namespace velero \
+    iam.gke.io/gcp-service-account=$SERVICE_ACCOUNT_EMAIL
+  warnOnError $? "Failed to annotate k8s SA - things may fail"
+
+  gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://$BUCKET
 
   ## Clean up from previous failed install
   kubectl delete volumesnapshotlocation.velero.io -n velero  gcp &>/dev/null
 
-  ## Install velero
+  ## Install velero chart   => https://github.com/vmware-tanzu/helm-charts/blob/main/charts/velero/values.yaml
+  ## Helpful debugging link => https://github.com/vmware-tanzu/helm-charts/issues/351
   addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
   helm upgrade --install velero vmware-tanzu/velero \
     --namespace velero \
+    --set credentials.useSecret="false" \
     --set configuration.provider="gcp" \
     --set configuration.backupStorageLocation.name=default \
     --set configuration.backupStorageLocation.bucket="${BUCKET}" \
+    --set configuration.backupStorageLocation.config.serviceAccount=$SERVICE_ACCOUNT_EMAIL \
+    --set serviceAccount.server.create="false" \
+    --set serviceAccount.server.name="velero" \
     --set snapshotsEnabled="true" \
     --set configuration.volumeSnapshotLocation.name=default \
-    --set credentials.existingSecret="${VELERO_CREDS}" \
     --set "initContainers[0].name"="velero-plugin-for-gcp" \
     --set "initContainers[0].image"="velero/velero-plugin-for-gcp:v1.0.0" \
     --set "initContainers[0].volumeMounts[0].mountPath"="/target" \
@@ -564,8 +617,11 @@ function installVelero() {
     --set schedules.timescale.template.snapshotVolumes="true"
 
   velero get backups
-  printf "\n\nVelero keys => kubectl get secret $VELERO_CREDS --namespace velero\n\n"
-  /bin/rm -f $VELERO_CREDS
+  cat<<DONE_VELERO
+
+  Velero docs => `color g 'open https://velero.io/docs'`
+DONE_VELERO
+  removeHelmRepo vmware-tanzu
   echo -n "npm run ahoy && velero get backups" | pbcopy
 }
 
@@ -644,7 +700,6 @@ CHARTVER=
 FROM_VERSIONS=
 function doInstall() {
 
-# helm repo remove stable &> /dev/null # stable was deprecated
   helm repo update &> /dev/null
 
   for PARAM in "$@";
@@ -692,6 +747,7 @@ function doInstall() {
         helm upgrade --install elasticsearch elastic/elasticsearch \
           --values $LOCAL_ES_VALUES \
           --set volumeClaimTemplate.storageClassName="ssd"
+        removeHelmRepo elastic
         ;;
 
       "estafette"|"preemptible-killer")
@@ -709,24 +765,27 @@ function doInstall() {
 
       "postgres"|"postgresql")
         showInstalling "PostgreSQL Database"
-        addHelmRepo bitnami https://charts.bitnami.com/bitnami
+        addBitnamiRepo
         helm upgrade --install postgres bitnami/postgresql -f postgres/postgres-values.yaml --version 8.9.6
+        removeHelmRepo bitnami
         ;;
 
       "redis")
         showInstalling "Redis Network Cache"
-        addHelmRepo bitnami https://charts.bitnami.com/bitnami
+        addBitnamiRepo
         [ -z "$REDIS_HELM_CHART" ] && REDIS_HELM_CHART="13.0.1" # latest breaks us => "v14+"
         helm upgrade --install redis bitnami/redis \
           -f redis/redis-values.yaml \
           --version $REDIS_HELM_CHART
         printf "\n\nTo start a specific version => `color g 'REDIS_HELM_CHART="13.0.1" helmup redis'`\n\n"
+        removeHelmRepo bitnami
         ;;
 
       "reloader")
         showInstalling "Stakater ConfigMap Reloader"
         addHelmRepo stakater https://stakater.github.io/stakater-charts
         helm upgrade --install reloader stakater/reloader
+        removeHelmRepo stakater
         ;;
 
       "timescale-db")

package/src/unleash.js

@@ -39,14 +39,6 @@ const npmRunner = async ( script ) => {
       await npmRunner( script[i] )
     }
   } else {
-    try {
-      await execa( 'npm-check-updates', [
-        '--color', '--packageFile', './package.json',
-      ], { stdio : 'inherit' } )
-      process.exit( 0 )
-    } catch ( err ) {
-      console.log( { err }, 'npm-check-update failed' )
-      process.exit( err.exitCode )
-    }
+    process.exit( 0 )
   }
 } )()