@leverege/build-tools 2.29.1 → 2.31.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.29.1",
+  "version": "2.31.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {

package/src/circleate

@@ -10,7 +10,7 @@ if [ "$1" != "server" ] && [ "$1" != "ui" ] && [ "$1" != "lib" ]; then
 fi
 
 repo_type=$1
-NODE_VERSION="gallium"
+NODE_VERSION="hydrogen"
 
 check_circle_config(){
   if [ -d "./.circleci" ];

package/src/dockreate

@@ -69,7 +69,7 @@ strip_undefined() {
 #         $3 = additional packages to install (htop redis-cli etc)
 create_Dockerfile() {
   local regvers="${1}"
-  local nodeimg="${2:-gallium-alpine}"
+  local nodeimg="${2:-hydrogen-alpine}"
   local apkadds="${3}"
 
   echo "Creating the Dockerfile for node ${nodeimg}"
@@ -220,7 +220,7 @@ fi
 
 # TODO: these should be combined into one require
 nodeimg=$(packageJson '.leverege.nodeimg')
-nodeimg="${nodeimg:-gallium-alpine}"
+nodeimg="${nodeimg:-hydrogen-alpine}"
 nodeops=$(packageJson '.leverege.nodeops')
 apkadds=$(packageJson '.leverege.apkadds')
 runuser=$(packageJson '.leverege.runuser')
@@ -399,8 +399,13 @@ else
   gcloud config unset builds/use_kaniko
 fi
 
-# submit the build request to gcloud
-time gcloud builds submit --tag $gcimage:$version .
+# need a logging area outside of the default cloud build bucket in order
+# to enable 3rd party builders from outside of leverege.com user space
+buildlogs="--gcs-log-dir gs://leverege-docker-images_cloudbuild/logs"
+
+# submit the build request to gcloud with logs directed to the cloudbuild
+# logging bucket from the docker directory
+time gcloud builds submit $buildlogs --tag $gcimage:$version .
  
 if [ $? -ne 0 ];
 then

package/src/helm-charts/cert-manager/helmup.plugin

@@ -3,7 +3,7 @@
 addHelmRepo jetstack https://charts.jetstack.io
 [ -z "$CERT_MANAGER_CHART_VERSION" ] && CERT_MANAGER_CHART_VERSION="v1.10"
 helm upgrade --install cert-manager jetstack/cert-manager \
-  --namespace cert-manager --set installCRDs=true \
+  --namespace default --set installCRDs=true \
   --version $CERT_MANAGER_CHART_VERSION $HELM_WHAT
 
 [ ! -z "$HELM_WHAT" ] && exit 0
@@ -15,15 +15,18 @@ cat<<DELAY
 DELAY
 
 sleep 20
-kubectl -n cert-manager apply -f cert-manager
+#kubectl -n cert-manager apply -f cert-manager
+kubectl apply -f cert-manager
 
 if [[ $? -eq 1 ]];
 then
+  cat<<APPLY_PROBLEM
 
-  `color y "***WARNING: cert-manager components still coming up"`
+  `color y "***WARNING: the kubectl apply to cert-manager is struggling"`
 
   Try rerunning this apply again in 30 seconds:
   `color g "kubectl -n cert-manager apply -f cert-manager"`
+APPLY_PROBLEM
 fi
 
 cat<<HINTS

package/src/helm-charts/traefik/traefik-local.yaml

@@ -1,14 +1,18 @@
+#service:
+#  spec:
+#    loadBalancerIP: xx.xx.xx.xx
+
 additionalArguments:
-  - "--accesslog=true"
-  - "--accesslog.format=json"
   - "--api.debug=true"
-  - "--log.level=WARN"
-  - "--metrics.prometheus=true"
   - "--api.dashboard=true"
 
 deployment:
   replicas: 3
 
-#service:
-#  spec:
-#    loadBalancerIP: xx.xx.xx.xx
+logs:
+  general:
+    level: WARN # DEBUG
+  access:
+    enabled: true
+    format: json
+    bufferingSize: 10

package/src/helm-charts/vernemq/TcpRoutes.yaml.ovh

@@ -0,0 +1,37 @@
+# This sets up a traefik TCP router for vernemq's mqtt port. The entry point
+# of mqtt is a reference to the traefik entry point that is open externally
+# to the outside world on port 1883.
+#
+# https://doc.traefik.io/traefik/routing/providers/kubernetes-crd/#kind-ingressroutetcp
+#
+kind: IngressRouteTCP
+apiVersion: traefik.containo.us/v1alpha1
+metadata:
+  name: vernemq
+  namespace: default
+spec:
+  entryPoints:
+    - mqtt
+  routes:
+    # 192.168.0.0/20 and 10.48.0.0/16 seem like the correct choice, but nope!
+    - match: ClientIP(`10.32.0.0/16`)
+      services:
+      - name: vernemq
+        port: 1883   # mqtt port in values-local.yaml
+---
+kind: IngressRouteTCP
+apiVersion: traefik.containo.us/v1alpha1
+metadata:
+  name: vernemq-tls
+  namespace: default
+spec:
+  entryPoints:
+    - mqtts
+  routes:
+    # 192.168.0.0/20 and 10.48.0.0/16 seem like the correct choice, but nope!
+    - match: ClientIP(`10.32.0.0/16`)
+      services:
+      - name: vernemq
+        port: 1883   # mqtt port in values-local.yaml
+  tls:
+    secretName: "OVH:<PROJECT_ID>-cert"

package/src/helm-charts/vernemq/gitignore

@@ -0,0 +1 @@
+TcpRoutes.yaml

package/src/helm-charts/vernemq/helmup.plugin

@@ -0,0 +1,14 @@
+#!/bin/bash
+#
+showInstalling "VerneMQ"
+
+addHelmRepo vernemq https://vernemq.github.io/docker-vernemq
+
+[ -z "$VERNEMQ_CHART_VERSION" ] && VERNEMQ_CHART_VERSION="1"
+helm upgrade --install vernemq vernemq/vernemq \
+  --values vernemq/vernemq-local.yaml \
+  --version $VERNEMQ_CHART_VERSION $HELM_WHAT
+
+kubectl apply -f vernemq/TcpRoutes.yaml
+
+removeHelmRepo vernemq

package/src/helm-charts/vernemq/vernemq-local.yaml

@@ -0,0 +1,78 @@
+service:
+  type: ClusterIP # NodePort
+  annotations:
+    prometheus.io/port: "8888"
+    prometheus.io/scrape: "true"
+  mqtt:
+    enabled: true
+  mqtts:
+    enabled: false
+
+envFrom: []
+
+additionalEnv:
+  - name: DOCKER_VERNEMQ_ACCEPT_EULA
+    value: "yes"
+  - name: DOCKER_VERNEMQ_LISTENER__NR_OF_ACCEPTORS
+    value: "100"
+  - name: DOCKER_VERNEMQ_MAX_ONLINE_MESSAGES
+    value: "10000"
+  - name: DOCKER_VERNEMQ_COORDINATE_REGISTRATIONS
+    value: "off"
+  - name: DOCKER_VERNEMQ_LOG__CONSOLE__LEVEL
+    value: "info"
+#  - name: DOCKER_VERNEMQ_ALLOW_ANONYMOUS
+#    value: "on"
+  - name: DOCKER_VERNEMQ_PLUGINS__VMQ_WEBHOOKS
+    value: "on"
+#  - name: DOCKER_VERNEMQ_PLUGINS__VMQ_PASSWD
+#    value: "off"
+  - name: DOCKER_VERNEMQ_PLUGINS__VMQ_ACL
+    value: "off"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_REG__HOOK
+    value: "auth_on_register"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_REG__ENDPOINT
+    value: "http://relay-hub:8080/vernemq/auth/connect"
+#    value: "http://741c-142-93-193-48.ngrok.io/vernemq/auth/connect"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_SUB__HOOK
+    value: "auth_on_subscribe"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_SUB__ENDPOINT
+    value: "http://relay-hub:8080/vernemq/auth/subscribe"
+#    value: "http://741c-142-93-193-48.ngrok.io/vernemq/auth/subscribe"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_PUB__HOOK
+    value: "auth_on_publish"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_PUB__ENDPOINT
+    value: "http://relay-hub:8080/vernemq/auth/publish"
+#    value: "http://741c-142-93-193-48.ngrok.io/vernemq/auth/publish"
+#  - name: DOCKER_VERNEMQ_ALLOW_MULTIPLE_SESSIONS
+#    value: "on"
+ 
+  # MQTT version 5 support
+  # these use the same relay-hub endpoints, but the
+  # VerneMQ webhook names are different
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_REG_M5__HOOK
+    value: "auth_on_register_m5"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_REG_M5__ENDPOINT
+    value: "http://relay-hub:8080/vernemq/auth/connect"
+
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_SUB_M5__HOOK
+    value: "auth_on_subscribe_m5"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_SUB_M5__ENDPOINT
+    value: "http://relay-hub:8080/vernemq/auth/subscribe"
+
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_PUB_M5__HOOK
+    value: "auth_on_publish_m5"
+  - name: DOCKER_VERNEMQ_VMQ_WEBHOOKS__LEVEREGE_PUB_M5__ENDPOINT
+    value: "http://relay-hub:8080/vernemq/auth/publish"
+
+  - name: DOCKER_VERNEMQ_QUEUE_DELIVER_MODE
+    value: "balance"
+  - name: DOCKER_VERNEMQ_LISTENER__TCP__DEFAULT__ALLOWED_PROTOCOL_VERSIONS
+    value: "3,4,5"
+  - name: DOCKER_VERNEMQ_LISTENER__TCP__LISTENER__PROXY_PROTOCOL
+    value: "on"
+
+resources:
+  requests:
+    cpu: "7000m"
+    memory: "12Gi"

package/src/helmup

@@ -395,11 +395,12 @@ function installCertManagerSecret() {
   showInstalling "Cert Managment"
   createNamespaceIfNeeded cert-manager
 
-  kubectl get secret cloudflare --namespace cert-manager &>/dev/null
+  local NSPACE="default"
+  kubectl get secret cloudflare --namespace $NSPACE &>/dev/null
   if [[ $? -eq 1 ]];
   then
     cat<<NEED_MANAGED_SECRET
-   $RED_ERROR missing secret: `color y cloudflare` namespace: `color y cert-manager`
+   $RED_ERROR missing secret: `color y cloudflare` namespace: `color y $NSPACE`
 
    This secret will be fetched from the leverege-docker-images cluster and
    injected into this cluster.
@@ -413,7 +414,7 @@ NEED_MANAGED_SECRET
     fi
     printf "\nInjecting=[$TOKEN] into cloudflare secret\n"
     kubectl create secret generic cloudflare \
-      --namespace cert-manager \
+      --namespace $NSPACE \
       --from-literal=dns-token=$TOKEN
   fi
 }
@@ -715,7 +716,7 @@ function doInstall() {
         ;;
 
       "traefik")
-        installTraefikEnvironment
+        # installTraefikEnvironment
         bootstrapLocalSetup $SERVICE
         ;;
 
@@ -729,6 +730,10 @@ function doInstall() {
         bootstrapLocalSetup $SERVICE
         ;;
 
+      "vernemq")
+        bootstrapLocalSetup $SERVICE
+        ;;
+
       *)
         if [ ! -d $SERVICE ] || [ ! -f $SERVICE/values-local.yaml ];
         then