@leverege/build-tools 2.14.1 → 2.14.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.14.1",
+  "version": "2.14.2",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -61,7 +61,7 @@
     "inquirer": "^8.2.4",
     "js-yaml": "^4.1.0",
     "ncp": "^2.0.0",
-    "npm-check-updates": "^13.1.1",
+    "npm-check-updates": "^13.1.2",
     "npm-registry-fetch": "^11.0.0",
     "open": "^8.4.0",
     "ora": "^5.4.1",

package/src/bash-funcs

@@ -95,6 +95,8 @@ INSTALLING
 }
 
 function addHelmRepo() {
+  [ ! -z "$HELM_REPO_SKIP" ] && return
+
   local chart=$1
   local url=$2
 
@@ -107,5 +109,6 @@ REPOADD
 }
 
 function removeHelmRepo(){
+  [ ! -z "$HELM_REPO_SKIP" ] && return
   helm repo remove $1 &>/dev/null
 }

package/src/helmup

@@ -8,7 +8,7 @@
 # Load the standard helper functions
 . `build-tools --bashfun`
 
-HELMUP_ARGS=("$*")
+SHELMUP_ARGS=("$*")
 
 # removed geotile-server from standard platform 3/20/22 - low usage
 PLATFORM=(
@@ -59,6 +59,52 @@ CATNAMI
   addHelmRepo bitnami $BITNAMI_URL
 }
 
+function getProjectIdFromK8sContext() {
+  local currContext=`kubectl config current-context`
+   
+  IFS='_'
+  read -ra ADDR <<< "$currContext" 
+
+  echo ${ADDR[1]} # project id is the second string split by _
+}
+
+function bindWorkloadIdentity(){
+  PROJECT_ID=$(getProjectIdFromK8sContext)
+  SVC_ACCT=$1
+  NAMESPACE=$2
+  SVC_ACCT_EMAIL="${SVC_ACCT}@${PROJECT_ID}.iam.gserviceaccount.com"
+
+  cat<<WORKLOAD_ID
+Binding workload identity IAM policy
+  Service Account : `color g $SVC_ACCT`
+  Project         : `color g $PROJECT_ID`
+  Namespace       : `color g $NAMESPACE`
+  Service Email   : `color g $SVC_ACCT_EMAIL`
+
+WORKLOAD_ID
+
+  gcloud iam service-accounts add-iam-policy-binding \
+      --project $PROJECT_ID \
+      --member "serviceAccount:$PROJECT_ID.svc.id.goog[${NAMESPACE}/${SVC_ACCT}]" \
+      --role roles/iam.workloadIdentityUser $SVC_ACCT_EMAIL
+  warnOnError $? "gcloud workload identity binding may have failed"
+ 
+  # Verify the Kubernetes SA and create it if necessary
+  printf "\nChecking for the $NAMESPACE/#SVC_ACCT k8s SA\n"
+  kubectl get sa -n $NAMESPACE $SVC_ACCT
+  if [[ $? -eq 1 ]];
+  then
+    printf "Creating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
+    kubectl create sa -n $NAMESPACE $SVC_ACCT
+  fi
+
+  printf "\nAnnotating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
+  kubectl annotate serviceaccount $SVC_ACCT \
+      --namespace $NAMESPACE --overwrite \
+      "iam.gke.io/gcp-service-account=$SVC_ACCT_EMAIL"
+  warnOnError $? "Failed to annotate service account $NAMESPACE/$SVC_ACCT - things may fail"
+}
+
 function checkTimescalePassword(){
   kubectl get secret postgresql-password
   if [[ $? -eq 1 ]]; then
@@ -90,6 +136,18 @@ function createNamespaceIfNeeded(){
   fi
 }
 
+function installPrometheus() {
+  # Add the community helm repositories
+  addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
+
+  helm upgrade --install prometheus prometheus-community/prometheus \
+    --namespace monitoring \
+    --values prometheus/values.yaml \
+    --version 13
+
+# removeHelmRepo prometheus-community
+}
+
 function installMonitoringCharts(){
   showInstalling "Grafana Monitoring"
   createNamespaceIfNeeded monitoring
@@ -168,10 +226,7 @@ SA_EXISTS
   fi
 
   ## Install Prometheus
-  helm upgrade --install prometheus prometheus-community/prometheus \
-    --namespace monitoring \
-    --values prometheus/values.yaml \
-    --version 13
+  installPrometheus
 
   ## Installing ES exporter
   helm upgrade --install elasticsearch-exporter prometheus-community/prometheus-elasticsearch-exporter \
@@ -253,45 +308,43 @@ function getManagedSecret() {
   echo $SECRET
 }
 
-function getProjectIdFromK8sContext() {
-  local currContext=`kubectl config current-context`
-   
-  IFS='_'
-  read -ra ADDR <<< "$currContext" 
-
-  echo ${ADDR[1]} # project id is the second string split by _
-}
-
 # https://github.com/estafette/estafette-gke-preemptible-killer
 function installPreemptibleKiller() {
   showInstalling "Preemptible Node Killing Adjusticator"
+  NAMESPACE="estafette"
   PROJECT_ID="$(getProjectIdFromK8sContext)"
-  createNamespaceIfNeeded estafette
+  SVC_ACCT="preemptible-killer"
+
+  createNamespaceIfNeeded $NAMESPACE
   addHelmRepo estafette https://helm.estafette.io
 
-  gcloud iam service-accounts create preemptible-killer \
-    --project=$PROJECT_ID \
-    --display-name preemptible-killer
+  printf "\nCreating the gcloud $SVC_ACCT service account (SA)\n"
+  gcloud iam service-accounts create $SVC_ACCT \
+    --project $PROJECT_ID \
+    --display-name "Estafette Node Killer"
+  warnOnError $? "SA creation may have failed or it already exists"
 
-  gcloud iam roles create preemptible_killer \
+  printf "\nCreate the $SVC_ACCT IAM role\n"
+  gcloud iam roles create preemptibleKiller \
     --project $PROJECT_ID \
-    --title preemptible-killer \
+    --title "Estafette Node Killer" \
     --description "Delete compute instances" \
     --permissions compute.instances.delete
+  warnOnError $? "Role creation may have failed or it already exists"
 
-  local service_account_email=$(gcloud iam --project=$PROJECT_ID service-accounts list --filter preemptible-killer --format 'value([email])')
+  local service_account_email=$(gcloud iam --project=$PROJECT_ID service-accounts list --filter $SVC_ACCT --format 'value([email])')
+  printf "\nBinding the IAM role to the $SVC_ACCT SA\n"
   gcloud projects add-iam-policy-binding $PROJECT_ID \
     --member=serviceAccount:${service_account_email} \
-    --role=projects/${PROJECT_ID}/roles/preemptible_killer &>/dev/null
+    --role=projects/${PROJECT_ID}/roles/preemptibleKiller &> /dev/null
+  warnOnError $? "Binding may have failed or it already exists"
 
-  gcloud iam service-accounts keys create \
-    --project=$PROJECT_ID \
-    --iam-account $service_account_email \
-    google_service_account.json &>/dev/null
+  bindWorkloadIdentity $SVC_ACCT $NAMESPACE
 
   helm upgrade --install estafette-gke-preemptible-killer \
                estafette/estafette-gke-preemptible-killer \
-               --namespace estafette \
+               --namespace ${NAMESPACE} \
+               --set secret.workloadIdentityServiceAccount="$SVC_ACCT@$PROJECT_ID.iam.gserviceaccount.com" \
                --set extraEnv.BLACKLIST_HOURS="10:00-02:00" # No killing from 5AM-9PM EST
 #              --set extraEnv.WHITELIST_HOURS="12:30-13:30"
   [ -f "google_service_account.json" ] && rm google_service_account.json
@@ -579,7 +632,7 @@ function installVelero() {
   
   kubectl annotate serviceaccount velero \
     --namespace velero \
-    iam.gke.io/gcp-service-account=$SERVICE_ACCOUNT_EMAIL
+    "iam.gke.io/gcp-service-account=$SERVICE_ACCOUNT_EMAIL"
   warnOnError $? "Failed to annotate k8s SA - things may fail"
 
   gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://$BUCKET
@@ -770,6 +823,10 @@ function doInstall() {
         removeHelmRepo bitnami
         ;;
 
+      "prometheus")
+        installPrometheus
+        ;;
+
       "redis")
         showInstalling "Redis Network Cache"
         addBitnamiRepo