Specify ingress controller type (#43)
* Specify ingress controller type Signed-off-by: Kevin Fox <[email protected]> * Fix indenting, docs Signed-off-by: Kevin Fox <[email protected]> * Fix spacing Signed-off-by: Kevin Fox <[email protected]> * Fix missing brackets Signed-off-by: Kevin Fox <[email protected]> * Fix missing brackets Signed-off-by: Kevin Fox <[email protected]> * Add ingress-nginx support Signed-off-by: Kevin Fox <[email protected]> * Use the right example values for test version to upgrade from. Signed-off-by: Kevin Fox <[email protected]> * Fix var in wrong location Signed-off-by: Kevin Fox <[email protected]> * Fix missing arg Signed-off-by: Kevin Fox <[email protected]> * Try this to checkout the right version Signed-off-by: Kevin Fox <[email protected]> * Switch to upgrading from 0.14.0 Signed-off-by: Kevin Fox <[email protected]> * Install crds Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Enable unset ingress controller type to use with openshift later Signed-off-by: Kevin Fox <[email protected]> * Fix docs after merge issue Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -2,7 +2,7 @@
|
||||
|
||||
set -xe
|
||||
|
||||
UPGRADE_VERSION=v0.13.0
|
||||
UPGRADE_VERSION=v0.14.0
|
||||
UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
@@ -48,30 +48,42 @@ teardown() {
|
||||
|
||||
trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
|
||||
|
||||
kubectl create namespace spire-system 2>/dev/null || true
|
||||
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
||||
kubectl create namespace "${ns}" 2>/dev/null || true
|
||||
kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
|
||||
if [[ -n "$UPGRADE_ARGS" ]]; then
|
||||
pushd "${SCRIPTPATH}"
|
||||
git clone https://github.com/spiffe/helm-charts-hardened "${UPGRADE_VERSION}"
|
||||
pushd "${UPGRADE_VERSION}"
|
||||
git checkout "${UPGRADE_VERSION/v/spire-}"
|
||||
helm install --create-namespace -n spire-system spire-crds charts/spire-crds
|
||||
./examples/production/run-tests.sh -c
|
||||
popd
|
||||
popd
|
||||
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
|
||||
else
|
||||
|
||||
"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
|
||||
--namespace cert-manager \
|
||||
--create-namespace \
|
||||
--set installCRDs=true \
|
||||
--wait
|
||||
kubectl create namespace spire-system 2>/dev/null || true
|
||||
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
||||
kubectl create namespace "${ns}" 2>/dev/null || true
|
||||
kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
|
||||
|
||||
kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
|
||||
"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
|
||||
--namespace cert-manager \
|
||||
--create-namespace \
|
||||
--set installCRDs=true \
|
||||
--wait
|
||||
|
||||
"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||
--namespace ingress-nginx \
|
||||
--create-namespace \
|
||||
--set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
|
||||
--set controller.ingressClassResource.default=true \
|
||||
--wait
|
||||
kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
|
||||
|
||||
ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
|
||||
echo "$ip" oidc-discovery.production.other
|
||||
"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||
--namespace ingress-nginx \
|
||||
--create-namespace \
|
||||
--set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
|
||||
--set controller.ingressClassResource.default=true \
|
||||
--wait
|
||||
|
||||
cat > /tmp/dummydns <<EOF
|
||||
ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
|
||||
echo "$ip" oidc-discovery.production.other
|
||||
|
||||
cat > /tmp/dummydns <<EOF
|
||||
spiffe-oidc-discovery-provider:
|
||||
tests:
|
||||
hostAliases:
|
||||
@@ -91,6 +103,8 @@ spire-server:
|
||||
- "spire-server-federation.production.other"
|
||||
EOF
|
||||
|
||||
fi
|
||||
|
||||
install_and_test() {
|
||||
# Can't pass an array to a function. We completely control the string so its safe.
|
||||
# shellcheck disable=SC2086
|
||||
@@ -110,23 +124,6 @@ install_and_test() {
|
||||
helm test --namespace "${ns}" spire
|
||||
}
|
||||
|
||||
if [[ -n "$UPGRADE_ARGS" ]]; then
|
||||
install_and_test spire "$UPGRADE_ARGS"
|
||||
|
||||
# Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
|
||||
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||
|
||||
helm upgrade --install -n spire-server spire-crds charts/spire-crds
|
||||
fi
|
||||
|
||||
install_and_test charts/spire ""
|
||||
|
||||
if helm get manifest -n spire-server spire | grep -i example; then
|
||||
|
||||
@@ -3,16 +3,10 @@ spire-server:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
controllerType: ingress-nginx
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
|
||||
# className: nginx
|
||||
|
||||
hosts:
|
||||
|
||||
@@ -6,14 +6,7 @@ spire-server:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
|
||||
@@ -4,13 +4,7 @@ spiffe-oidc-discovery-provider:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
|
||||
@@ -1,15 +1,7 @@
|
||||
spire-server:
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
# Optional settings you may put in your own values.
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
controllerType: ingress-nginx
|
||||
|
||||
# className: nginx
|
||||
|
||||
|
||||
Reference in New Issue
Block a user