@leverege/build-tools 2.5.4 → 2.5.6

package/lib/server/husky-check.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+"use strict";
+
+const SimpleGit = require('simple-git');
+
+const git = new SimpleGit();
+
+const getCurrentBranchName = async () => {
+  const branchInfo = await git.branch();
+  return Object.entries(branchInfo.branches).find(([name, info]) => info.current)[0];
+};
+
+const isProtected = async () => {
+  const protectedBranches = ['master', 'development'];
+  const theBranch = await getCurrentBranchName();
+  return protectedBranches.includes(theBranch);
+};
+
+(async () => {
+  try {
+    const active = await isProtected();
+    process.exit(active ? 0 : 1);
+  } catch (err) {
+    console.error(err);
+  }
+})();

package/lib/web/husky-check.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+"use strict";
+
+const SimpleGit = require('simple-git');
+
+const git = new SimpleGit();
+
+const getCurrentBranchName = async () => {
+  const branchInfo = await git.branch();
+  return Object.entries(branchInfo.branches).find(([name, info]) => info.current)[0];
+};
+
+const isProtected = async () => {
+  const protectedBranches = ['master', 'development'];
+  const theBranch = await getCurrentBranchName();
+  return protectedBranches.includes(theBranch);
+};
+
+(async () => {
+  try {
+    const active = await isProtected();
+    process.exit(active ? 0 : 1);
+  } catch (err) {
+    console.error(err);
+  }
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.5.4",
+  "version": "2.5.6",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "scripts": {
@@ -33,6 +33,7 @@
     "helminit-dp": "src/helminit-dp",
     "helminit-scaler": "src/helminit-scaler",
     "helmup": "src/helmup",
+    "husky-check": "src/husky-check.js",
     "k8scale": "src/k8scale",
     "k8x": "src/k8x",
     "npm-link": "src/npm-link",

package/src/helmup

@@ -149,11 +149,45 @@ function installMonitoringCharts(){
 
   ## Installing stackdriver exporter in GKE
   if [[ "$IS_GKE" = true ]]; then
+    # Check SA creation
+    kubectl get sa -n monitoring stackdriver-exporter
+    if [[ $? -eq 1 ]]; then
+      # Create Kubernetes SA
+      printf "\n*** Creating stackdriver-exporter SA ***\n\n"
+      kubectl create sa -n monitoring stackdriver-exporter
+
+      # Detect Project ID
+      currContext=`kubectl config current-context`
+       
+      IFS='_'
+      read -ra ADDR <<< "$currContext" 
+
+      GCP_PROJECT_ID=${ADDR[1]} # project id is the second string split by _
+
+      # Create GCP SA and bind policies
+      printf "\n*** Creating GCP SA with monitoring/viewer ***\n\n"
+      gcloud iam service-accounts create stackdriver-exporter --project "$GCP_PROJECT_ID"
+
+      gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
+        --member "serviceAccount:stackdriver-exporter@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
+        --role "roles/monitoring.viewer"
+
+      gcloud iam service-accounts add-iam-policy-binding \
+        --role roles/iam.workloadIdentityUser \
+        --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[monitoring/stackdriver-exporter]" \
+        "stackdriver-exporter@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+      # Annotate Kubernetes SA
+      kubectl annotate serviceaccount stackdriver-exporter \
+        "iam.gke.io/gcp-service-account=stackdriver-exporter@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
+        --namespace monitoring
+    fi
+
     helm upgrade --install stackdriver-exporter \
       stable/stackdriver-exporter \
       --namespace monitoring \
       -f stackdriver-exporter/values.yaml \
-      --version 1.2.3
+      --version 1.3.0
   fi
 
   ## Install Prometheus

package/src/husky-check.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+const SimpleGit = require( 'simple-git' )
+const git = new SimpleGit()
+
+const getCurrentBranchName = async () => {
+  const branchInfo = await git.branch()
+  return Object
+    .entries( branchInfo.branches )
+    .find( ( [ name, info ] ) => ( info.current ) )[0]
+}
+
+const isProtected = async () => {
+  const protectedBranches = [ 'master', 'development' ]
+  const theBranch = await getCurrentBranchName()
+  return protectedBranches.includes( theBranch )
+}
+
+( async () => {
+  try {
+    const active = await isProtected()
+    process.exit( active ? 0 : 1 )
+  } catch ( err ) {
+    console.error( err )
+  }
+} )()

package/src/sa-tools/imp-sa

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+IMPERSONATE='gcloud config set auth/impersonate_service_account'
+impersonate() {
+ sa=$1
+ echo "Impersonating $sa"
+ $IMPERSONATE $sa
+}
+
+case $1 in
+gke)
+ impersonate k8s@project.iam.gserviceaccount.com
+ ;;
+admin)
+ impersonate admin@other-project.iam.gserviceaccount.com
+ ;;
+clear)
+ gcloud config unset auth/impersonate_service_account
+ ;;
+*)
+ echo "Usage: Updates impersonated service account"
+ echo "  imp-sa [gke|admin|clear]"
+esac

package/src/sa-tools/make-sa

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+SVC_PROJ="leverege-dev-john"
+
+SVC_NAME="terraformer"
+SVC_ACCT="${SVC_NAME}@${SVC_PROJ}.iam.gserviceaccount.com"
+
+function countdown() {
+  local SEC=${1}
+  shift
+  local MSG=${@}
+  while [ $SEC -ne 0 ];
+  do
+    printf "\r\033[KWaiting %.d seconds $MSG" $((SEC--))
+    sleep 1
+  done
+}
+
+gcloud iam service-accounts create ${SVC_NAME} \
+  --project=${SVC_PROJ} --quiet \
+  --description="the terraforming account" \
+  --display-name="terraformer" &> /dev/null
+
+gcloud projects add-iam-policy-binding ${SVC_PROJ} \
+  --project=${SVC_PROJ} --quiet \
+  --member=serviceAccount:${SVC_ACCT}              \
+  --role=roles/editor &> /dev/null
+
+gcloud projects add-iam-policy-binding ${SVC_PROJ} \
+  --project=${SVC_PROJ} --quiet \
+  --member=serviceAccount:${SVC_ACCT}              \
+  --role=roles/iam.securityAdmin &> /dev/null
+
+countdown 30 "will delete ${SVC_NAME} service account"
+
+gcloud projects remove-iam-policy-binding ${SVC_PROJ} \
+  --project=${SVC_PROJ} --quiet \
+  --member=serviceAccount:${SVC_ACCT}              \
+  --role=roles/iam.securityAdmin &> /dev/null
+
+gcloud projects remove-iam-policy-binding ${SVC_PROJ} \
+  --project=${SVC_PROJ} --quiet \
+  --member=serviceAccount:${SVC_ACCT}              \
+  --role=roles/editor &> /dev/null
+
+gcloud iam service-accounts delete ${SVC_ACCT} --quiet &> /dev/null