@leverege/build-tools 2.43.10 → 2.43.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.43.10",
+  "version": "2.43.12",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {

package/src/bash-funcs

@@ -161,7 +161,18 @@ EOSLACK
 # of the standard setup scripts.
 function ifPluggedIn() {
   local INVOKED_AS=`basename $0`
-  local PLUGIN="$1/$INVOKED_AS.plugin"
+  local PLUGIN=
+  case "$INVOKED_AS" in
+    "helmup"|"helmwhat" )
+      PLUGIN="$1/helmup.plugin"
+      ;;
+    "helmdn" )
+      PLUGIN="$1/helmdn.plugin"
+      ;;
+    *)
+      ;;
+  esac
+
   [ ! -f $PLUGIN ] && return 1
 
   if [ ! -x $PLUGIN ];
@@ -174,7 +185,9 @@ PLUGIN_NOEXEC
     exit 1
   fi
 
-  printf "\n***Executing local plugin code => `color y $PLUGIN`\n\n" && sleep 2
+  local OPERATION="Executing local plugin code"
+  [ ! -z "$HELM_WHAT" ] && OPERATION="Performing a DRY RUN"
+  printf "\n***$OPERATION => `color y $PLUGIN`\n\n" && sleep 2
   export HELM_WHAT
   . $PLUGIN # executing with . allows the plugin to use functions like color
   sendToSlack "$PLUGIN"

package/src/helm-charts/cnpg-operator/helmdn.plugin

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+helm uninstall --namespace cnpg-system cnpg # cnpg-cloudnative-pg

package/src/helm-charts/cnpg-operator/helmup.plugin

@@ -0,0 +1,10 @@
+#!/bin/bash
+#
+# See => https://github.com/cloudnative-pg/charts
+addHelmRepo cnpg https://cloudnative-pg.github.io/charts
+
+helm upgrade --install cnpg cnpg/cloudnative-pg \
+  --namespace cnpg-system --create-namespace \
+  --set webhook.port="10250"
+
+removeHelmRepo cnpg

package/src/helmup.sh

@@ -46,13 +46,13 @@ AUXILIARY=(
   vin-decoder-server
 )
 
+# zombie-killer disabled 20231228
 SYSTEM=(
   elasticsearch8
   redis
   postgres
   timescale-db
   preemptible-killer
-  zombie-killer
   reloader
   traefik
   velero
@@ -456,6 +456,83 @@ NEED_MANAGED_SECRET
   fi
 }
 
+function installCnpgOperatorEnvironment() {
+  # See => https://github.com/cloudnative-pg/charts
+
+  gcloud config set project $GCP_PROJECT_ID
+
+  # create an SA in the cnpg namespace for the operands to bind to
+  CNPG_NAMESPACE="cnpg-operands"
+  CNPG_SVC_ACCT="$CNPG_NAMESPACE-sa"
+  CNPG_SVC_EMAIL="$CNPG_SVC_ACCT@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+  kubectl delete serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
+  gcloud --quiet iam service-accounts delete $CNPG_SVC_EMAIL  --project $GCP_PROJECT_ID&> $DEVNULL
+
+  createNamespaceIfNeeded $CNPG_NAMESPACE
+
+  # Create GCP SA and bind policies
+  printf "\nCreating the gcloud $CNPG_SVC_ACCT service account (SA)\n"
+  gcloud iam service-accounts create $CNPG_SVC_ACCT \
+    --project "$GCP_PROJECT_ID" \
+    --description "CNPG Operands SA" \
+    --display-name "CNPG Operands SA" &> $DEVNULL
+  warnOnError $? "the GCP SA $CNPG_SVC_ACCT may already exist"
+
+  CNPG_OPS_ROLE="cnpg.operands"
+  printf "\nCreating the $CNPG_OPS_ROLE IAM role\n"
+  ## Attach roles
+  ROLE_PERMISSIONS=(
+    iam.serviceAccounts.actAs
+    iam.serviceAccounts.getAccessToken
+    iam.serviceAccounts.signBlob
+    orgpolicy.policy.get
+    resourcemanager.projects.get
+    storage.buckets.create
+    storage.buckets.get
+    storage.buckets.getIamPolicy
+    storage.buckets.list
+    storage.buckets.update
+    storage.objects.create
+    storage.objects.delete
+    storage.objects.get
+    storage.objects.getIamPolicy
+    storage.objects.list
+  )
+  gcloud iam roles create $CNPG_OPS_ROLE \
+    --project $GCP_PROJECT_ID \
+    --title "CNPG Operands" \
+    --description "CNPG Operands" \
+    --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  if [ $? -ne 0 ];
+  then
+    # assume error is that role exists so try updating instead
+    printf "\nUpdating roles on the SA\n"
+    gcloud iam roles update $CNPG_OPS_ROLE \
+      --project $GCP_PROJECT_ID \
+      --title "CNPG Operands" \
+      --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  fi
+  warnOnError $? "Failed to add roles to $CNPG_OPS_ROLE - perhaps they already exist?"
+
+  printf "\nBinding IAM role to the SA\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --project $GCP_PROJECT_ID \
+    --member serviceAccount:$CNPG_SVC_EMAIL \
+    --condition 'None' \
+    --role "roles/owner" &> $DEVNULL # temp bind to Owner
+#   --role "roles/storage.admin" &> $DEVNULL
+#   --role "roles/owner" &> $DEVNULL
+#   --role projects/$GCP_PROJECT_ID/roles/$CNPG_OPS_ROLE &> $DEVNULL
+  warnOnError $? "gcloud problem binding IAM policy"
+
+  sleep 2 # give the IAM binding a chance to complete before moving on
+
+  bindWorkloadIdentity $CNPG_SVC_ACCT $CNPG_NAMESPACE
+
+  gsutil iam ch serviceAccount:$CNPG_SVC_EMAIL:objectAdmin gs://$GCP_PROJECT_ID-barman
+}
+
 function installVeleroEnvironment() {
   # Follows instructions => https://github.com/vmware-tanzu/velero-plugin-for-gcp
   showInstalling "Velero Backup Management"
@@ -660,6 +737,11 @@ CATBACKUP
         bootstrapLocalSetup $SERVICE
         ;;
 
+      "cnpg-operator")
+        installCnpgOperatorEnvironment
+        bootstrapLocalSetup $SERVICE
+        ;;
+
       "cronZombieKiller"|"zombie-killer")
         installCronZombieKiller # eradicate the gke 1.20+ zombies
         ;;

package/src/overwhelm.mjs

@@ -82,7 +82,7 @@ debug( { over, yaml, }, '<==Contents of the over and yaml structs' )
 let cfgs = yaml[context]
 
 // If we just need to check context return 0 if cfgs exists, else error.
-if ( args.checkctx ) { process.exit( !cfgs ) }
+if ( args.checkctx ) { process.exit( !cfgs ? 1 : 0 ) }
 
 if ( !cfgs ) {
   log( `***ERROR: Unknown context => [${context}]\n` )