Specify ingress controller type (#43)

* Specify ingress controller type Signed-off-by: Kevin Fox <[email protected]> * Fix indenting, docs Signed-off-by: Kevin Fox <[email protected]> * Fix spacing Signed-off-by: Kevin Fox <[email protected]> * Fix missing brackets Signed-off-by: Kevin Fox <[email protected]> * Fix missing brackets Signed-off-by: Kevin Fox <[email protected]> * Add ingress-nginx support Signed-off-by: Kevin Fox <[email protected]> * Use the right example values for test version to upgrade from. Signed-off-by: Kevin Fox <[email protected]> * Fix var in wrong location Signed-off-by: Kevin Fox <[email protected]> * Fix missing arg Signed-off-by: Kevin Fox <[email protected]> * Try this to checkout the right version Signed-off-by: Kevin Fox <[email protected]> * Switch to upgrading from 0.14.0 Signed-off-by: Kevin Fox <[email protected]> * Install crds Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Enable unset ingress controller type to use with openshift later Signed-off-by: Kevin Fox <[email protected]> * Fix docs after merge issue Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2023-10-24 20:18:53 +00:00
parent 0b174345ab
commit 7924323a8f
19 changed files with 270 additions and 224 deletions
@@ -2,7 +2,7 @@

 set -xe

-UPGRADE_VERSION=v0.13.0
+UPGRADE_VERSION=v0.14.0
 UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened

 SCRIPT="$(readlink -f "$0")"
@@ -48,30 +48,42 @@ teardown() {

 trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT

-kubectl create namespace spire-system 2>/dev/null || true
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
-kubectl create namespace "${ns}" 2>/dev/null || true
-kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
+if [[ -n "$UPGRADE_ARGS" ]]; then
+  pushd "${SCRIPTPATH}"
+  git clone https://github.com/spiffe/helm-charts-hardened "${UPGRADE_VERSION}"
+  pushd "${UPGRADE_VERSION}"
+  git checkout "${UPGRADE_VERSION/v/spire-}"
+  helm install --create-namespace -n spire-system spire-crds charts/spire-crds
+  ./examples/production/run-tests.sh -c
+  popd
+  popd
+  # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
+else

-"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
-  --namespace cert-manager \
-  --create-namespace \
-  --set installCRDs=true \
-  --wait
+  kubectl create namespace spire-system 2>/dev/null || true
+  kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
+  kubectl create namespace "${ns}" 2>/dev/null || true
+  kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true

-kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
+  "${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
+    --namespace cert-manager \
+    --create-namespace \
+    --set installCRDs=true \
+    --wait

-"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
-  --namespace ingress-nginx \
-  --create-namespace \
-  --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
-  --set controller.ingressClassResource.default=true \
- --wait
+  kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server

-ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
-echo "$ip" oidc-discovery.production.other
+  "${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
+    --namespace ingress-nginx \
+    --create-namespace \
+    --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
+    --set controller.ingressClassResource.default=true \
+    --wait

-cat > /tmp/dummydns <<EOF
+  ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
+  echo "$ip" oidc-discovery.production.other
+
+  cat > /tmp/dummydns <<EOF
 spiffe-oidc-discovery-provider:
  tests:
    hostAliases:
@@ -91,6 +103,8 @@ spire-server:
          - "spire-server-federation.production.other"
 EOF

+fi
+
 install_and_test() {
  # Can't pass an array to a function. We completely control the string so its safe.
  # shellcheck disable=SC2086
@@ -110,23 +124,6 @@ install_and_test() {
    helm test --namespace "${ns}" spire
 }

-if [[ -n "$UPGRADE_ARGS" ]]; then
-  install_and_test spire "$UPGRADE_ARGS"
-
-  # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
-  kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
-  kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
-  kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
-  kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
-  kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
-  kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
-  kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
-  kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
-  kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
-
-  helm upgrade --install -n spire-server spire-crds charts/spire-crds
-fi
-
 install_and_test charts/spire ""

 if helm get manifest -n spire-server spire | grep -i example; then