@leverege/build-tools 2.26.2 → 2.26.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.26.2",
+  "version": "2.26.4",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {

package/src/helmup

@@ -59,7 +59,7 @@ CATNAMI
 
 function bindWorkloadIdentity() {
   SVC_ACCT=$1
-  NAMESPACE=$2
+  NAMESPACE=${2:-default}
   SVC_ACCT_EMAIL="${SVC_ACCT}@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
 
   cat<<WORKLOAD_ID
@@ -78,12 +78,12 @@ WORKLOAD_ID
   warnOnError $? "gcloud workload identity binding may have failed"
  
   # Verify the Kubernetes SA and create it if necessary
-  printf "\nChecking for the $NAMESPACE/#SVC_ACCT k8s SA\n"
-  kubectl get sa -n $NAMESPACE $SVC_ACCT
+  printf "\nChecking for the $NAMESPACE/$SVC_ACCT k8s SA\n"
+  kubectl get sa -n $NAMESPACE $SVC_ACCT &>/dev/null
   if [[ $? -eq 1 ]];
   then
-    printf "Creating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
-    kubectl create sa -n $NAMESPACE $SVC_ACCT
+    printf "Creating the k8s $SVC_ACCT SA in $NAMESPACE\n"
+    kubectl create sa $SVC_ACCT -n $NAMESPACE
   fi
 
   printf "\nAnnotating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
@@ -119,7 +119,26 @@ function bootstrapLocalSetup() {
   SYSTEM_HUP="$SYSTEM_FILES/$SERVICE.hup"
   [ ! -f "$SYSTEM_HUP" ] && errorExit "Missing $SERVICE helmup script => $(color y $SYSTEM_HUP)"
 
-  [ ! -d "$SERVICE" ] && mkdir $SERVICE
+  if [ ! -d "$SERVICE" ];
+  then
+    mkdir $SERVICE
+  else
+    # If the service dir already exists but the helmup.plugin file is missing
+    # then this is most likely a legacy setup - for example, an older setup for
+    # elasticsearch that only had an es-values.yaml file. Note that we cannot
+    # get to this logic if the helmup.plugin file exists so no need to check
+    # for it again - just error.
+    cat<<MISSING_HELMUP_PLUGIN
+
+  $RED_ERROR Legacy setup detected for service `color y "$SERVICE"`
+
+  This looks like a legacy setup of the $SERVICE service. In order to
+  proceed, the existing $SERVICE subdirectory should be moved out of
+  way before attempting to rerun helmup for this service.
+
+MISSING_HELMUP_PLUGIN
+    errorExit "Installaion of `color y $SERVICE` failed - exiting"
+  fi
 
   if [ "$2" == "set-values-local" ];
   then
@@ -147,30 +166,40 @@ function errorIfMissingSecret() {
 
 function installStackdriverExporterEnvironment() {
   showInstalling "Stackdriver Exporter Service Account Binding"
-  createNamespaceIfNeeded monitoring
 
   # Add necessary helm repositories - note that stable is deprecated
   addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
 
-  local SDEXP_SA='stackdriver-exporter'
+  local SDEXP_NS="monitoring"
+  local SDEXP_SA="stackdriver-exporter"
+  local SDEXP_EM="$SDEXP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+  createNamespaceIfNeeded $SDEXP_NS
+
+  # guarantee any previous remnants of the exporter are gone
+  printf "\n*** Removing the previous $SDEXP_SA installation...\n"
+  helm uninstall -n $SDEXP_NS $SDEXP_SA                 &> /dev/null
+  kubectl delete serviceaccounts -n $SDEXP_NS $SDEXP_SA &> /dev/null
+  gcloud --quiet iam service-accounts delete $SDEXP_EM  &> /dev/null
 
   # NOTE: The k8s SA != GCP SA - the former is created by the helm chart
   # that installs the stackdriver-exporter, the latter is handled here in
   # order to provide the proper IAM permissions to the exporter.
 
   # Create GCP SA and bind policies
-  printf "\n*** Creating GCP SA with monitoring/viewer ***\n"
+  printf "\n*** Creating GCP SA with $SDEXP_NS/viewer ***\n"
   gcloud iam service-accounts create $SDEXP_SA \
     --project "$GCP_PROJECT_ID" \
     --display-name "Prometheus Stackdriver Exporter" &>/dev/null
   warnOnError $? "the GCP SA $SDEXP_SA may already exist"
 
-  printf "\n*** Binding IAM role of monitoring viewer to stackdriver-exporter in $GCP_PROJECT_ID\n"
+  printf "\n*** Binding IAM role of $SDEXP_NS viewer to $SDEXP_SA in $GCP_PROJECT_ID\n"
   gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
-    --role "roles/monitoring.viewer" \
-    --member "serviceAccount:$SDEXP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com" &>/dev/null
+    --role "roles/$SDEXP_NS.viewer" \
+    --member "serviceAccount:$SDEXP_EM" &>/dev/null
+  sleep 2 # give the IAM binding a chance to complete before moving on
 
-  bindWorkloadIdentity $SDEXP_SA monitoring
+  bindWorkloadIdentity $SDEXP_SA $SDEXP_NS
 
   removeHelmRepo prometheus-community
 }
@@ -189,7 +218,7 @@ function installMonitoringEnvironment() {
   ## Installing ES exporter
   helm upgrade --install elasticsearch-exporter prometheus-community/prometheus-elasticsearch-exporter \
     --namespace monitoring \
-    --version 4.13 \
+    --version 5 \
     -f - <<ELASTIC_EXPORTER_CHART_MOD
 service:
   annotations:

package/src/system-charts/stackdriver-exporter-local.yaml

@@ -1,12 +1,23 @@
+#
+# to force a reinstall of this service simply remove or rename this
+# stackdriver-exporter subdirectory and rerun helmup stackdriver-exporter
+#
 stackdriver:
   projectId: "OVH:<PROJECT_NAME>"
   metrics:
-    typePrefixes: 'pubsub.googleapis.com/subscription/oldest_unacked_message_age,pubsub.googleapis.com/subscription/num_undelivered_messages,pubsub.googleapis.com/subscription/pull_ack_request_count,pubsub.googleapis.com/subscription/streaming_pull_ack_request_count,pubsub.googleapis.com/topic/message_sizes,pubsub.googleapis.com/topic/send_request_count,firebasedatabase.googleapis.com/io/database_load,firebasedatabase.googleapis.com/network/sent_bytes_count,firebasedatabase.googleapis.com/network/active_connections'
+    typePrefixes: "pubsub.googleapis.com/subscription/oldest_unacked_message_age,pubsub.googleapis.com/subscription/num_undelivered_messages,pubsub.googleapis.com/subscription/pull_ack_request_count,pubsub.googleapis.com/subscription/streaming_pull_ack_request_count,pubsub.googleapis.com/topic/message_sizes,pubsub.googleapis.com/topic/send_request_count,firebasedatabase.googleapis.com/io/database_load,firebasedatabase.googleapis.com/network/sent_bytes_count,firebasedatabase.googleapis.com/network/active_connections"
 
 annotations:
   prometheus.io/port: "9255"
-  prometheus.io/scrape: "true"
+  prometheus.io/scrape: "true" # this is a string annotation - so quoted!
 
+# NOTE to future selves - the exporter's helm chart does not have a clue
+# regarding workload identity, which means the gcloud and k8s service
+# accounts have to be managed outside of the chart by helmup. In order to get
+# the linkages from the SA to the service we specify the SA name here, but
+# disable the creation of the SA since it will have already have been created
+# and bound by the helmup installStackdriverExporterEnvironment function.
+#
 serviceAccount:
-  create : false
+  create : false # this is a flag to helm - so unquoted ... da F?!
   name: "stackdriver-exporter"