@leverege/build-tools 2.43.12 → 2.45.0-beta.2

package/src/helmup.sh

@@ -43,6 +43,7 @@ AUXILIARY=(
   pubsub-pulse
   push-notifier
   pusher
+  transponder-dh
   vin-decoder-server
 )
 
@@ -53,6 +54,7 @@ SYSTEM=(
   postgres
   timescale-db
   preemptible-killer
+  reflector
   reloader
   traefik
   velero
@@ -84,14 +86,31 @@ CATNAMI
   addHelmRepo bitnami $BITNAMI_URL
 }
 
+# Accepts 3 paramaters - 1 mandatory.
+#   bindWorkloadIdentity <Service Account> <Namespace> <Target Service Account>
+# where:
+#   Service Account = SA to receive the binding
+#   Namespace = optional - uses the default namespace if unspecified
+#   Target Service Account = SA to receive the workload binding
+#
+# We typically have a one to one binding for SA and target SA (and target seems
+# like a poor choice of word), so for api-server running in the default namespace:
+#   bindWorkloadIdentity api-server
+#
+# but in the case of services like transponder which has various flavors but
+# only the single trandponder services account we woul do:
+#   bindWorkloadIdentity transponder default tranponder-rt
+#
 function bindWorkloadIdentity() {
   SVC_ACCT=$1
   NAMESPACE=${2:-default}
+  BOUND_SVC_ACCT=${3:-$SVC_ACCT}
   SVC_ACCT_EMAIL="${SVC_ACCT}@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
 
   cat<<WORKLOAD_ID
 Binding workload identity IAM policy
-  Service Account : `color g $SVC_ACCT`
+  Target Svc Acct : `color g $SVC_ACCT`
+  Bound Svc Acct  : `color g $BOUND_SVC_ACCT`
   Project         : `color g $GCP_PROJECT_ID`
   Namespace       : `color g $NAMESPACE`
   Service Email   : `color g $SVC_ACCT_EMAIL`
@@ -100,38 +119,40 @@ WORKLOAD_ID
 
   gcloud iam service-accounts add-iam-policy-binding \
       --project $GCP_PROJECT_ID \
-      --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[${NAMESPACE}/${SVC_ACCT}]" \
+      --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[${NAMESPACE}/${BOUND_SVC_ACCT}]" \
       --role roles/iam.workloadIdentityUser $SVC_ACCT_EMAIL
   warnOnError $? "gcloud workload identity binding may have failed"
+
+  sleep 2 # give the policy a chance to propagate
  
   # Verify the Kubernetes SA and create it if necessary
-  printf "\nChecking for the $NAMESPACE/$SVC_ACCT k8s SA\n"
+  printf "\nChecking for the `color g $NAMESPACE/$SVC_ACCT` k8s SA\n"
   kubectl get sa -n $NAMESPACE $SVC_ACCT &> $DEVNULL
   if [[ $? -eq 1 ]];
   then
-    printf "Creating the k8s $SVC_ACCT SA in $NAMESPACE\n"
+    printf "Creating the k8s `color g $SVC_ACCT` SA in `color g $NAMESPACE`\n"
     kubectl create sa $SVC_ACCT -n $NAMESPACE
   fi
 
-  printf "\nAnnotating the k8s SA $NAMESPACE/@$SVC_ACCT\n"
+  printf "\nAnnotating the k8s SA `color g $NAMESPACE/@$SVC_ACCT`\n"
   kubectl annotate serviceaccount $SVC_ACCT \
       --namespace $NAMESPACE --overwrite \
       "iam.gke.io/gcp-service-account=$SVC_ACCT_EMAIL"
   warnOnError $? "Failed to annotate service account $NAMESPACE/$SVC_ACCT - things may fail"
-}
 
-function generatePassword() {
-  RANDOMPW=`openssl rand -base64 12`
-  echo $RANDOMPW
+  sleep 2 # give the annotation a chance to propagate before exiting
 }
 
 function createNamespaceIfNeeded() {
   # Check the namespace exists in kubernetes
-  kubectl get namespace $1 &> $DEVNULL
+  local NS=$1
+  kubectl get namespace $NS &> $DEVNULL
   if [[ $? -eq 1 ]];
   then
-    printf "\n*** Creating $1 namespace ***\n\n"
-    kubectl create namespace $1
+    printf "\n*** Creating $NS namespace ***\n\n"
+    kubectl create namespace $NS
+    # annotate to tell the network policy to allow redis access from NS
+    kubectl label namespaces $NS redis=external
   fi
 }
 
@@ -456,6 +477,65 @@ NEED_MANAGED_SECRET
   fi
 }
 
+# See => https://github.com/emberstack/kubernetes-reflector
+function reflectSecretIntoNamespaces() {
+  local SECRET="$1"
+  local SOURCE_NS="$2"
+  local REFLECT_INTO_NS="$3"
+
+  printf "\nReflecting secret `color y "$SOURCE_NS/$SECRET"` into `color g "$REFLECT_INTO_NS"` namespace\n"
+
+  kubectl annotate secrets $SECRET -n $SOURCE_NS \
+    reflector.v1.k8s.emberstack.com/reflection-allowed="true" &> $DEVNULL
+  kubectl annotate secrets $SECRET -n $SOURCE_NS \
+    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces="$REFLECT_INTO_NS" &> $DEVNULL
+
+  cat<<REFLECTED_SECRET | kubectl apply -f -
+apiVersion: v1
+kind: Secret
+metadata:
+ name: $SECRET
+ namespace: "$REFLECT_INTO_NS"
+ annotations:
+   reflector.v1.k8s.emberstack.com/reflects: "$SOURCE_NS/$SECRET"
+REFLECTED_SECRET
+}
+
+# This function is used to randomly generate the postgresql database passwords
+# for the postgres and imagine users in a cnpg operator configuration. Since
+# the resultant passwords will live in the cnpg-operands namespace they will
+# be mirrored to the default namespace via the reflector service. Lastly, the
+# service account will have workload identity bound to it in the cnpg-operands
+# namespace.
+function initializeCnpgOperand() {
+  local CNPG_SERVICE="$1"
+  local CNPG_NAMESPACE="cnpg-operands"
+  local CNPG_SVC_ACCT="$CNPG_NAMESPACE-sa"
+  local IMAGINE_PW_NAME="$CNPG_SERVICE-imagine-pw"
+  local POSTGRES_PW_NAME="$CNPG_SERVICE-postgres-pw"
+
+  printf "\nCreating imagine db password for `color g $CNPG_SERVICE`\n"
+  kubectl create secret generic -n $CNPG_NAMESPACE "$IMAGINE_PW_NAME" \
+        --from-literal=username="imagine" \
+        --from-literal=password="$(generatePassword)" &> $DEVNULL
+  warnOnError $? "the `color y $IMAGINE_PW_NAME` secret may already exist"
+
+  # reflect the secret to default namespace
+  reflectSecretIntoNamespaces $IMAGINE_PW_NAME $CNPG_NAMESPACE "default"
+
+  printf "\nCreating postgres db password for `color g $CNPG_SERVICE`\n"
+  kubectl create secret generic -n $CNPG_NAMESPACE "$POSTGRES_PW_NAME" \
+        --from-literal=username="postgres" \
+        --from-literal=password="$(generatePassword)" &> $DEVNULL
+  warnOnError $? "the `color y $POSTGRES_PW_NAME` secret may already exist"
+
+  # reflect the secret to default namespace
+  reflectSecretIntoNamespaces $POSTGRES_PW_NAME $CNPG_NAMESPACE "default"
+
+  printf "\nBinding `color g $CNPG_SERVICE` to the `color y "$CNPG_SVC_ACCT"` SA\n"
+  bindWorkloadIdentity $CNPG_SVC_ACCT $CNPG_NAMESPACE $CNPG_SERVICE
+}
+
 function installCnpgOperatorEnvironment() {
   # See => https://github.com/cloudnative-pg/charts
 
@@ -469,24 +549,29 @@ function installCnpgOperatorEnvironment() {
   kubectl delete serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
   gcloud --quiet iam service-accounts delete $CNPG_SVC_EMAIL  --project $GCP_PROJECT_ID&> $DEVNULL
 
+  # Create the operands namespace and annotate to allow redis access
   createNamespaceIfNeeded $CNPG_NAMESPACE
 
   # Create GCP SA and bind policies
-  printf "\nCreating the gcloud $CNPG_SVC_ACCT service account (SA)\n"
+  printf "\nCreating the gcloud `color g $CNPG_SVC_ACCT` service account (SA)\n"
   gcloud iam service-accounts create $CNPG_SVC_ACCT \
     --project "$GCP_PROJECT_ID" \
     --description "CNPG Operands SA" \
     --display-name "CNPG Operands SA" &> $DEVNULL
-  warnOnError $? "the GCP SA $CNPG_SVC_ACCT may already exist"
+  warnOnError $? "the GCP SA `color y $CNPG_SVC_ACCT` may already exist"
 
   CNPG_OPS_ROLE="cnpg.operands"
-  printf "\nCreating the $CNPG_OPS_ROLE IAM role\n"
+  printf "\nCreating the `color g $CNPG_OPS_ROLE` IAM role\n"
   ## Attach roles
   ROLE_PERMISSIONS=(
     iam.serviceAccounts.actAs
+    iam.serviceAccounts.get
     iam.serviceAccounts.getAccessToken
+    iam.serviceAccounts.getOpenIdToken
+    iam.serviceAccounts.implicitDelegation
+    iam.serviceAccounts.list
     iam.serviceAccounts.signBlob
-    orgpolicy.policy.get
+    iam.serviceAccounts.signJwt
     resourcemanager.projects.get
     storage.buckets.create
     storage.buckets.get
@@ -507,7 +592,7 @@ function installCnpgOperatorEnvironment() {
   if [ $? -ne 0 ];
   then
     # assume error is that role exists so try updating instead
-    printf "\nUpdating roles on the SA\n"
+    printf "\nUpdating the permissions on the `color g $CNPG_OPS_ROLE` IAM role\n"
     gcloud iam roles update $CNPG_OPS_ROLE \
       --project $GCP_PROJECT_ID \
       --title "CNPG Operands" \
@@ -515,22 +600,45 @@ function installCnpgOperatorEnvironment() {
   fi
   warnOnError $? "Failed to add roles to $CNPG_OPS_ROLE - perhaps they already exist?"
 
-  printf "\nBinding IAM role to the SA\n"
+  printf "\nBinding IAM role to the SA `color g $CNPG_SVC_EMAIL`\n"
   gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
-    --project $GCP_PROJECT_ID \
-    --member serviceAccount:$CNPG_SVC_EMAIL \
-    --condition 'None' \
-    --role "roles/owner" &> $DEVNULL # temp bind to Owner
-#   --role "roles/storage.admin" &> $DEVNULL
-#   --role "roles/owner" &> $DEVNULL
+    --member="serviceAccount:$CNPG_SVC_EMAIL" \
+    --role "roles/storage.admin" &> $DEVNULL
 #   --role projects/$GCP_PROJECT_ID/roles/$CNPG_OPS_ROLE &> $DEVNULL
+#   --role "roles/storage.admin" &> $DEVNULL
   warnOnError $? "gcloud problem binding IAM policy"
 
-  sleep 2 # give the IAM binding a chance to complete before moving on
+  printf "\nBinding IAM the Token Creator role to the SA `color g $CNPG_SVC_EMAIL`\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --member="serviceAccount:$CNPG_SVC_EMAIL" \
+    --role="roles/iam.serviceAccountTokenCreator"
+
+  # workload binding will be performed by each cnpg operand on startup
+
+  BARMAN_BUCKET="gs://$GCP_PROJECT_ID-barman"
+  gsutil ls -p $GCP_PROJECT_ID -b $BARMAN_BUCKET &> $DEVNULL
+  if [ "$?" -eq 0 ];
+  then
+    printf "\nBarman bucket `color g "$BARMAN_BUCKET"` already exists - skipping recreation\n"
+  else
+    printf "\nCreating a bucket for barman backups: `color g $BARMAN_BUCKET`\n"
+    gsutil mb -l $GCE_REGION $BARMAN_BUCKET &> $DEVNULL
+    gsutil iam ch serviceAccount:$CNPG_SVC_EMAIL:objectAdmin $BARMAN_BUCKET
+    gsutil ubla set on $BARMAN_BUCKET # uniform bucket access
+  fi
 
-  bindWorkloadIdentity $CNPG_SVC_ACCT $CNPG_NAMESPACE
+  # define the snapshot storage class
+  printf "\nApplying the CNPG VolumeSnapshotClass `color g cnpg-snapshotclass` definition\n"
+  cat<<EOSNAPSC | kubectl apply -f -
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+  name: cnpg-snapshotclass
+driver: pd.csi.storage.gke.io
+deletionPolicy: Delete
+EOSNAPSC
 
-  gsutil iam ch serviceAccount:$CNPG_SVC_EMAIL:objectAdmin gs://$GCP_PROJECT_ID-barman
+  sleep 2 # hold up processing for a moment to allow IAM mods to propagate
 }
 
 function installVeleroEnvironment() {
@@ -546,10 +654,10 @@ function installVeleroEnvironment() {
 
   ## Create a bucket
   BUCKET="$GCP_PROJECT_ID-velero-$VELERO_HELM_CHART"
-  GCE_REGION=`overwhelm -k GCE_REGION`
   printf "\nCreating storage bucket `color g $BUCKET` in `color g $GCE_REGION`\n"
   gsutil mb -l $GCE_REGION gs://$BUCKET/ &> $DEVNULL
   warnOnError $? "Bucket failed to create or already exists - go check it\n"
+  gsutil ubla set on gs://$BUCKET &> $DEVNULL
 
   ## Create a service account
   printf "\nCreating the service account\n"
@@ -692,7 +800,7 @@ function doInstall() {
 
     local INVOKED_AS=`basename $0`
     # set the dry-run flag on what
-    [ "$INVOKED_AS" == "helmwhat" ] && HELM_WHAT="--dry-run --debug"
+    [ "$INVOKED_AS" == "helmwhat" ] && HELM_WHAT="--dry-run --debug" && K8S_WHAT="--dry-run=server -o yaml"
 
     # helminit is used to redeploy an existing service
     if [ "$INVOKED_AS" == "helminit" ] && [[ $(isLeveregeService $SERVICE) -eq 1 ]];
@@ -754,6 +862,16 @@ CATBACKUP
         installDefaultConfigs
         ;;
 
+      db-postgres-*|db-timescale-*)
+        if [ ! -d $SERVICE ];
+        then
+          # this code only executes on the first deployment
+          initializeCnpgOperand $SERVICE
+          bootstrapLocalSetup $SERVICE
+          kubectl apply -f $SERVICE/$SERVICE.yaml $K8S_WHAT
+        fi
+        ;;
+
       db-curator-dh)
         # db-curator-dh is a variant of db-curator with diff controlled in values-local.yaml
         HELMUP="helm upgrade --install $SERVICE leverege/db-curator --values $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
@@ -806,6 +924,13 @@ CATBACKUP
         bootstrapLocalSetup $SERVICE
         ;;
 
+      "reflector")
+        showInstalling "Secrets/ConfigMap Namespace Reflector"
+        addHelmRepo emberstack https://emberstack.github.io/helm-charts
+        helm upgrade --install reflector emberstack/reflector
+        removeHelmRepo emberstack
+        ;;
+
       "reloader")
         showInstalling "Stakater ConfigMap Reloader"
         addHelmRepo stakater https://stakater.github.io/stakater-charts
@@ -924,6 +1049,8 @@ overwhelm
 
 # The project id is used in a lot of places so just set it here
 GCP_PROJECT_ID="$(getProjectIdFromK8sContext)"
+# Same for the region, but not as prevalent
+GCE_REGION=`overwhelm -k GCE_REGION`
 
 doInstall $@
 cd - &> $DEVNULL

package/src/k8x.sh

@@ -1,18 +1,21 @@
 #!/bin/bash
 
 cmd=${@:-"bash"}
+ns="default"
 
 [ "$cmd" = "redis" ] || [ "$cmd" = "redis-cli" ] && FZFQ="--query=redis" && cmd='redis-cli'
 
 [ "$cmd" = "pgsql" ] && FZFQ="--query=postgresql" && cmd='psql -U postgres'
 
+[ "$cmd" = "cnpg" ] && ns="cnpg-operands" && cmd="bash"
+
 [ -f overwhelm.yaml ] && [ -f package.json ] && npm run ahoy
 
 [ ! -x "$(command -v fzf)" ] && printf "\n***ERROR: Missing fzf fuzzy matcher => brew install fzf\n\n" && exit 1
 
-pod=$(kubectl -n default get pods -owide | fzf $FZFQ | awk '{print $1}')
+pod=$(kubectl -n $ns get pods -owide | fzf $FZFQ | awk '{print $1}')
 
-kubecmd="kubectl exec -it $pod -- $cmd"
+kubecmd="kubectl exec -n $ns -it $pod -- $cmd"
 echo " run=[${kubecmd}]"
 
 eval ${kubecmd}