@leverege/build-tools 2.14.0 → 2.14.2

package/lib/server/unleash.js

@@ -44,16 +44,6 @@ const npmRunner = async script => {
       await npmRunner(script[i]);
     }
   } else {
-    try {
-      await execa('npm-check-updates', ['--color', '--packageFile', './package.json'], {
-        stdio: 'inherit'
-      });
-      process.exit(0);
-    } catch (err) {
-      console.log({
-        err
-      }, 'npm-check-update failed');
-      process.exit(err.exitCode);
-    }
+    process.exit(0);
   }
 })();

package/lib/web/unleash.js

@@ -44,16 +44,6 @@ const npmRunner = async script => {
       await npmRunner(script[i]);
     }
   } else {
-    try {
-      await execa('npm-check-updates', ['--color', '--packageFile', './package.json'], {
-        stdio: 'inherit'
-      });
-      process.exit(0);
-    } catch (err) {
-      console.log({
-        err
-      }, 'npm-check-update failed');
-      process.exit(err.exitCode);
-    }
+    process.exit(0);
   }
 })();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.14.0",
+  "version": "2.14.2",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -61,7 +61,7 @@
     "inquirer": "^8.2.4",
     "js-yaml": "^4.1.0",
     "ncp": "^2.0.0",
-    "npm-check-updates": "^13.0.3",
+    "npm-check-updates": "^13.1.2",
     "npm-registry-fetch": "^11.0.0",
     "open": "^8.4.0",
     "ora": "^5.4.1",
@@ -76,6 +76,6 @@
     "@babel/node": "^7.17.10",
     "@leverege/babel-preset-leverege-node": "^2.0.0",
     "@leverege/eslint-config-leverege": "^3.0.1",
-    "npm": "^8.11.0"
+    "npm": "^8.12.1"
   }
 }

package/src/bash-funcs

@@ -95,6 +95,8 @@ INSTALLING
 }
 
 function addHelmRepo() {
+  [ ! -z "$HELM_REPO_SKIP" ] && return
+
   local chart=$1
   local url=$2
 
@@ -107,5 +109,6 @@ REPOADD
 }
 
 function removeHelmRepo(){
+  [ ! -z "$HELM_REPO_SKIP" ] && return
   helm repo remove $1 &>/dev/null
 }

package/src/helmup

@@ -8,6 +8,8 @@
 # Load the standard helper functions
 . `build-tools --bashfun`
 
+SHELMUP_ARGS=("$*")
+
 # removed geotile-server from standard platform 3/20/22 - low usage
 PLATFORM=(
   authz-server
@@ -39,6 +41,70 @@ SYSTEM=(
   monitoring # do monitoring last to show password
 )
 
+# support for legacy bitnami charts
+function addBitnamiRepo() {
+  if [ ! -z "$BITNAMI_LATEST" ];
+  then
+    BITNAMI_URL="https://charts.bitnami.com/bitnami"
+  else
+    cat<<CATNAMI
+    Using the pre 2022 legacy charts from bitnami. To use latest run:
+
+        `color y "BITNAMI_LATEST=1 $HELMUP_ARGS"`
+
+CATNAMI
+    BITNAMI_URL="https://raw.githubusercontent.com/bitnami/charts/eb5f9a9513d987b519f0ecd732e7031241c50328/bitnami"
+  fi
+
+  addHelmRepo bitnami $BITNAMI_URL
+}
+
+function getProjectIdFromK8sContext() {
+  local currContext=`kubectl config current-context`
+   
+  IFS='_'
+  read -ra ADDR <<< "$currContext" 
+
+  echo ${ADDR[1]} # project id is the second string split by _
+}
+
+function bindWorkloadIdentity(){
+  PROJECT_ID=$(getProjectIdFromK8sContext)
+  SVC_ACCT=$1
+  NAMESPACE=$2
+  SVC_ACCT_EMAIL="${SVC_ACCT}@${PROJECT_ID}.iam.gserviceaccount.com"
+
+  cat<<WORKLOAD_ID
+Binding workload identity IAM policy
+  Service Account : `color g $SVC_ACCT`
+  Project         : `color g $PROJECT_ID`
+  Namespace       : `color g $NAMESPACE`
+  Service Email   : `color g $SVC_ACCT_EMAIL`
+
+WORKLOAD_ID
+
+  gcloud iam service-accounts add-iam-policy-binding \
+      --project $PROJECT_ID \
+      --member "serviceAccount:$PROJECT_ID.svc.id.goog[${NAMESPACE}/${SVC_ACCT}]" \
+      --role roles/iam.workloadIdentityUser $SVC_ACCT_EMAIL
+  warnOnError $? "gcloud workload identity binding may have failed"
+ 
+  # Verify the Kubernetes SA and create it if necessary
+  printf "\nChecking for the $NAMESPACE/#SVC_ACCT k8s SA\n"
+  kubectl get sa -n $NAMESPACE $SVC_ACCT
+  if [[ $? -eq 1 ]];
+  then
+    printf "Creating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
+    kubectl create sa -n $NAMESPACE $SVC_ACCT
+  fi
+
+  printf "\nAnnotating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
+  kubectl annotate serviceaccount $SVC_ACCT \
+      --namespace $NAMESPACE --overwrite \
+      "iam.gke.io/gcp-service-account=$SVC_ACCT_EMAIL"
+  warnOnError $? "Failed to annotate service account $NAMESPACE/$SVC_ACCT - things may fail"
+}
+
 function checkTimescalePassword(){
   kubectl get secret postgresql-password
   if [[ $? -eq 1 ]]; then
@@ -70,6 +136,18 @@ function createNamespaceIfNeeded(){
   fi
 }
 
+function installPrometheus() {
+  # Add the community helm repositories
+  addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
+
+  helm upgrade --install prometheus prometheus-community/prometheus \
+    --namespace monitoring \
+    --values prometheus/values.yaml \
+    --version 13
+
+# removeHelmRepo prometheus-community
+}
+
 function installMonitoringCharts(){
   showInstalling "Grafana Monitoring"
   createNamespaceIfNeeded monitoring
@@ -148,10 +226,7 @@ SA_EXISTS
   fi
 
   ## Install Prometheus
-  helm upgrade --install prometheus prometheus-community/prometheus \
-    --namespace monitoring \
-    --values prometheus/values.yaml \
-    --version 13
+  installPrometheus
 
   ## Installing ES exporter
   helm upgrade --install elasticsearch-exporter prometheus-community/prometheus-elasticsearch-exporter \
@@ -233,45 +308,43 @@ function getManagedSecret() {
   echo $SECRET
 }
 
-function getProjectIdFromK8sContext() {
-  local currContext=`kubectl config current-context`
-   
-  IFS='_'
-  read -ra ADDR <<< "$currContext" 
-
-  echo ${ADDR[1]} # project id is the second string split by _
-}
-
 # https://github.com/estafette/estafette-gke-preemptible-killer
 function installPreemptibleKiller() {
   showInstalling "Preemptible Node Killing Adjusticator"
+  NAMESPACE="estafette"
   PROJECT_ID="$(getProjectIdFromK8sContext)"
-  createNamespaceIfNeeded estafette
+  SVC_ACCT="preemptible-killer"
+
+  createNamespaceIfNeeded $NAMESPACE
   addHelmRepo estafette https://helm.estafette.io
 
-  gcloud iam service-accounts create preemptible-killer \
-    --project=$PROJECT_ID \
-    --display-name preemptible-killer
+  printf "\nCreating the gcloud $SVC_ACCT service account (SA)\n"
+  gcloud iam service-accounts create $SVC_ACCT \
+    --project $PROJECT_ID \
+    --display-name "Estafette Node Killer"
+  warnOnError $? "SA creation may have failed or it already exists"
 
-  gcloud iam roles create preemptible_killer \
+  printf "\nCreate the $SVC_ACCT IAM role\n"
+  gcloud iam roles create preemptibleKiller \
     --project $PROJECT_ID \
-    --title preemptible-killer \
+    --title "Estafette Node Killer" \
     --description "Delete compute instances" \
     --permissions compute.instances.delete
+  warnOnError $? "Role creation may have failed or it already exists"
 
-  local service_account_email=$(gcloud iam --project=$PROJECT_ID service-accounts list --filter preemptible-killer --format 'value([email])')
+  local service_account_email=$(gcloud iam --project=$PROJECT_ID service-accounts list --filter $SVC_ACCT --format 'value([email])')
+  printf "\nBinding the IAM role to the $SVC_ACCT SA\n"
   gcloud projects add-iam-policy-binding $PROJECT_ID \
     --member=serviceAccount:${service_account_email} \
-    --role=projects/${PROJECT_ID}/roles/preemptible_killer &>/dev/null
+    --role=projects/${PROJECT_ID}/roles/preemptibleKiller &> /dev/null
+  warnOnError $? "Binding may have failed or it already exists"
 
-  gcloud iam service-accounts keys create \
-    --project=$PROJECT_ID \
-    --iam-account $service_account_email \
-    google_service_account.json &>/dev/null
+  bindWorkloadIdentity $SVC_ACCT $NAMESPACE
 
   helm upgrade --install estafette-gke-preemptible-killer \
                estafette/estafette-gke-preemptible-killer \
-               --namespace estafette \
+               --namespace ${NAMESPACE} \
+               --set secret.workloadIdentityServiceAccount="$SVC_ACCT@$PROJECT_ID.iam.gserviceaccount.com" \
                --set extraEnv.BLACKLIST_HOURS="10:00-02:00" # No killing from 5AM-9PM EST
 #              --set extraEnv.WHITELIST_HOURS="12:30-13:30"
   [ -f "google_service_account.json" ] && rm google_service_account.json
@@ -559,7 +632,7 @@ function installVelero() {
   
   kubectl annotate serviceaccount velero \
     --namespace velero \
-    iam.gke.io/gcp-service-account=$SERVICE_ACCOUNT_EMAIL
+    "iam.gke.io/gcp-service-account=$SERVICE_ACCOUNT_EMAIL"
   warnOnError $? "Failed to annotate k8s SA - things may fail"
 
   gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://$BUCKET
@@ -680,7 +753,7 @@ CHARTVER=
 FROM_VERSIONS=
 function doInstall() {
 
-  helm repo update # XXX &> /dev/null
+  helm repo update &> /dev/null
 
   for PARAM in "$@";
   do
@@ -745,14 +818,18 @@ function doInstall() {
 
       "postgres"|"postgresql")
         showInstalling "PostgreSQL Database"
-        addHelmRepo bitnami https://charts.bitnami.com/bitnami
+        addBitnamiRepo
         helm upgrade --install postgres bitnami/postgresql -f postgres/postgres-values.yaml --version 8.9.6
         removeHelmRepo bitnami
         ;;
 
+      "prometheus")
+        installPrometheus
+        ;;
+
       "redis")
         showInstalling "Redis Network Cache"
-        addHelmRepo bitnami https://charts.bitnami.com/bitnami
+        addBitnamiRepo
         [ -z "$REDIS_HELM_CHART" ] && REDIS_HELM_CHART="13.0.1" # latest breaks us => "v14+"
         helm upgrade --install redis bitnami/redis \
           -f redis/redis-values.yaml \

package/src/unleash.js

@@ -39,14 +39,6 @@ const npmRunner = async ( script ) => {
       await npmRunner( script[i] )
     }
   } else {
-    try {
-      await execa( 'npm-check-updates', [
-        '--color', '--packageFile', './package.json',
-      ], { stdio : 'inherit' } )
-      process.exit( 0 )
-    } catch ( err ) {
-      console.log( { err }, 'npm-check-update failed' )
-      process.exit( err.exitCode )
-    }
+    process.exit( 0 )
   }
 } )()