@leverege/build-tools 2.80.1 → 2.82.0

package/src/helm-charts/velero/helmup.bootstrap

@@ -0,0 +1,104 @@
+#!/bin/bash
+#
+# lifted from helmup.sh
+function installVeleroEnvironment() {
+  # Follows instructions => https://github.com/vmware-tanzu/velero-plugin-for-gcp
+  showInstalling "Velero Backup Management"
+  createNamespaceIfNeeded velero
+
+  # Do we need to => gcloud auth application-default
+  gcloud config set project $GCP_PROJECT_ID
+
+  ## The major chart version will determine the bucket suffix
+  [ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="10"
+
+  ## Create a bucket
+  BUCKET="$GCP_PROJECT_ID-velero-$VELERO_CHART_VERSION"
+  printf "\nCreating storage bucket `color g $BUCKET` in `color g $GCE_REGION`\n"
+  gsutil mb -l $GCE_REGION gs://$BUCKET/ &> $DEVNULL
+  warnOnError $? "Bucket failed to create or already exists - go check it\n"
+  gsutil ubla set on gs://$BUCKET &> $DEVNULL
+
+  ## Create a service account
+  printf "\nCreating the service account\n"
+  gcloud iam service-accounts create velero \
+    --project $GCP_PROJECT_ID \
+    --display-name "Velero service account" \
+    --description "Velero service account" &> $DEVNULL
+  if [ $? -eq 0 ];
+  then
+    # no error means a new SA was created - slight delay to let it update
+    sleep 2
+  else
+    printf "$YELO_WARN Failed to create the service account - does it already exist?"
+  fi
+
+  SERVICE_ACCOUNT_EMAIL="velero@${GCP_PROJECT_ID}.iam.gserviceaccount.com"
+
+  ## Attach roles
+  ROLE_PERMISSIONS=(
+    compute.disks.get
+    compute.disks.create
+    compute.disks.createSnapshot
+    compute.projects.get
+    compute.snapshots.get
+    compute.snapshots.create
+    compute.snapshots.useReadOnly
+    compute.snapshots.delete
+    compute.zones.get
+    iam.serviceAccounts.actAs
+    iam.serviceAccounts.signBlob
+    storage.objects.create
+    storage.objects.delete
+    storage.objects.get
+    storage.objects.list
+  )
+
+  printf "\nAssigning roles to the SA\n"
+  gcloud iam roles create velero.server \
+    --project $GCP_PROJECT_ID \
+    --title "Velero Server" \
+    --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  if [ $? -ne 0 ];
+  then
+    # assume error is that role exists so try updating instead
+    printf "\nUpdating roles on the SA\n"
+    gcloud iam roles update velero.server \
+      --project $GCP_PROJECT_ID \
+      --title "Velero Server" \
+      --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  fi
+  warnOnError $? "Failed to add roles to velero.server - perhaps they already exist?"
+
+  printf "\nBinding IAM policy to the SA\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --project $GCP_PROJECT_ID \
+    --member serviceAccount:$SERVICE_ACCOUNT_EMAIL \
+    --condition 'None' \
+    --role projects/$GCP_PROJECT_ID/roles/velero.server &> $DEVNULL
+  warnOnError $? "gcloud problem binding IAM policy"
+
+  printf "\nBinding workload identity IAM policy to the SA\n"
+  gcloud iam service-accounts add-iam-policy-binding \
+      --member "serviceAccount:$GCP_PROJECT_ID.svc.id.goog[velero/velero]" \
+      --role roles/iam.workloadIdentityUser \
+      $SERVICE_ACCOUNT_EMAIL
+  warnOnError $? "gcloud workload identity binding may have failed"
+
+  printf "\nCreate and annotate the k8s SA\n"
+  kubectl create serviceaccount velero --namespace velero
+  warnOnError $? "Failed to create k8s SA - perhaps it already exists?"
+  
+  kubectl annotate serviceaccount velero \
+    --namespace velero \
+    "iam.gke.io/gcp-service-account=$SERVICE_ACCOUNT_EMAIL"
+  warnOnError $? "Failed to annotate k8s SA - things may fail"
+
+  gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://$BUCKET
+
+  ## Clean up from previous failed install
+  # kubectl delete volumesnapshotlocation.velero.io -n velero gcp &> $DEVNULL
+}
+
+# Run It!
+installVeleroEnvironment

package/src/helm-charts/velero/helmup.plugin

@@ -7,7 +7,7 @@ addHelmRepo vmware-tanzu https://vmware-tanzu.github.io/helm-charts
 [ -z "$VELERO_CHART_VERSION" ] && VELERO_CHART_VERSION="10"
 #
 # Build the bucket, region and SA email variables and use --set to mod the
-# chart values as opposed to using an OVH:<label> approach. This eliminates
+# chart values as opposed to using an ${label} approach. This eliminates
 # the need for an overwhelm generated values.yaml file which also contains
 # all of the contamination from the default-values.yaml file.
 #

package/src/helmdn.sh

@@ -38,12 +38,13 @@ PLATFORM=(
 )
 
 SYSTEM=(
-  elastic
+  elasticsearch8
   preemptible-killer
   redis
   postgres
   timescale-db
   monitoring
+  prom-operator
   reloader
   traefik
   velero