@leverege/build-tools 2.26.1 → 2.26.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.26.1",
+  "version": "2.26.3",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {

package/src/helmup

@@ -59,7 +59,7 @@ CATNAMI
 
 function bindWorkloadIdentity() {
   SVC_ACCT=$1
-  NAMESPACE=$2
+  NAMESPACE=${2:-default}
   SVC_ACCT_EMAIL="${SVC_ACCT}@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
 
   cat<<WORKLOAD_ID
@@ -78,12 +78,12 @@ WORKLOAD_ID
   warnOnError $? "gcloud workload identity binding may have failed"
  
   # Verify the Kubernetes SA and create it if necessary
-  printf "\nChecking for the $NAMESPACE/#SVC_ACCT k8s SA\n"
+  printf "\nChecking for the $NAMESPACE/$SVC_ACCT k8s SA\n"
   kubectl get sa -n $NAMESPACE $SVC_ACCT
   if [[ $? -eq 1 ]];
   then
-    printf "Creating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
-    kubectl create sa -n $NAMESPACE $SVC_ACCT
+    printf "Creating the k8s $SVC_ACCT SA in $NAMESPACE\n"
+    kubectl create sa $SVC_ACCT -n $NAMESPACE
   fi
 
   printf "\nAnnotating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
@@ -147,30 +147,40 @@ function errorIfMissingSecret() {
 
 function installStackdriverExporterEnvironment() {
   showInstalling "Stackdriver Exporter Service Account Binding"
-  createNamespaceIfNeeded monitoring
 
   # Add necessary helm repositories - note that stable is deprecated
   addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
 
-  local SDEXP_SA='stackdriver-exporter'
+  local SDEXP_NS="monitoring"
+  local SDEXP_SA="stackdriver-exporter"
+  local SDEXP_EM="$SDEXP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+  createNamespaceIfNeeded $SDEXP_NS
+
+  # guarantee any previous remnants of the exporter are gone
+  printf "\n*** Removing the previous $SDEXP_SA installation...\n"
+  helm uninstall -n $SDEXP_NS $SDEXP_SA                 &> /dev/null
+  kubectl delete serviceaccounts -n $SDEXP_NS $SDEXP_SA &> /dev/null
+  gcloud --quiet iam service-accounts delete $SDEXP_EM  &> /dev/null
 
   # NOTE: The k8s SA != GCP SA - the former is created by the helm chart
   # that installs the stackdriver-exporter, the latter is handled here in
   # order to provide the proper IAM permissions to the exporter.
 
   # Create GCP SA and bind policies
-  printf "\n*** Creating GCP SA with monitoring/viewer ***\n"
+  printf "\n*** Creating GCP SA with $SDEXP_NS/viewer ***\n"
   gcloud iam service-accounts create $SDEXP_SA \
     --project "$GCP_PROJECT_ID" \
     --display-name "Prometheus Stackdriver Exporter" &>/dev/null
   warnOnError $? "the GCP SA $SDEXP_SA may already exist"
 
-  printf "\n*** Binding IAM role of monitoring viewer to stackdriver-exporter in $GCP_PROJECT_ID\n"
+  printf "\n*** Binding IAM role of $SDEXP_NS viewer to $SDEXP_SA in $GCP_PROJECT_ID\n"
   gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
-    --role "roles/monitoring.viewer" \
-    --member "serviceAccount:$SDEXP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com" &>/dev/null
+    --role "roles/$SDEXP_NS.viewer" \
+    --member "serviceAccount:$SDEXP_EM" &>/dev/null
+  sleep 2 # give the IAM binding a chance to complete before moving on
 
-  bindWorkloadIdentity $SDEXP_SA monitoring
+  bindWorkloadIdentity $SDEXP_SA $SDEXP_NS
 
   removeHelmRepo prometheus-community
 }

package/src/system-charts/stackdriver-exporter-local.yaml

@@ -1,8 +1,23 @@
+#
+# to force a reinstall of this service simply remove or rename this
+# stackdriver-exporter subdirectory and rerun helmup stackdriver-exporter
+#
 stackdriver:
   projectId: "OVH:<PROJECT_NAME>"
   metrics:
-    typePrefixes: 'pubsub.googleapis.com/subscription/oldest_unacked_message_age,pubsub.googleapis.com/subscription/num_undelivered_messages,pubsub.googleapis.com/subscription/pull_ack_request_count,pubsub.googleapis.com/subscription/streaming_pull_ack_request_count,pubsub.googleapis.com/topic/message_sizes,pubsub.googleapis.com/topic/send_request_count,firebasedatabase.googleapis.com/io/database_load,firebasedatabase.googleapis.com/network/sent_bytes_count,firebasedatabase.googleapis.com/network/active_connections'
+    typePrefixes: "pubsub.googleapis.com/subscription/oldest_unacked_message_age,pubsub.googleapis.com/subscription/num_undelivered_messages,pubsub.googleapis.com/subscription/pull_ack_request_count,pubsub.googleapis.com/subscription/streaming_pull_ack_request_count,pubsub.googleapis.com/topic/message_sizes,pubsub.googleapis.com/topic/send_request_count,firebasedatabase.googleapis.com/io/database_load,firebasedatabase.googleapis.com/network/sent_bytes_count,firebasedatabase.googleapis.com/network/active_connections"
 
 annotations:
   prometheus.io/port: "9255"
-  prometheus.io/scrape: "true"
+  prometheus.io/scrape: "true" # this is a string annotation - so quoted!
+
+# NOTE to future selves - the exporter's helm chart does not have a clue
+# regarding workload identity, which means the gcloud and k8s service
+# accounts have to be managed outside of the chart by helmup. In order to get
+# the linkages from the SA to the service we specify the SA name here, but
+# disable the creation of the SA since it will have already have been created
+# and bound by the helmup installStackdriverExporterEnvironment function.
+#
+serviceAccount:
+  create : false # this is a flag to helm - so unquoted ... da F?!
+  name: "stackdriver-exporter"