panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Resolve shellcheck issues

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-04-26 16:04:02 +02:00
parent d0a1e12825
commit 99af475f1c
8 changed files with 70 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/namespace-override/post-install.sh
+5 -4
View File
@@ -3,7 +3,8 @@
set -x set -x
SCRIPT=$(readlink -f "$0") SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT") SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
k_wait () { k_wait () {
kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1 kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
@@ -30,7 +31,7 @@ cat <<EOF >>"$GITHUB_STEP_SUMMARY"
| spire-spiffe-oidc-discovery-provider | <pre>$(k_wait spire-server deployments.apps "${RELEASE}-spiffe-oidc-discovery-provider")</pre> | | spire-spiffe-oidc-discovery-provider | <pre>$(k_wait spire-server deployments.apps "${RELEASE}-spiffe-oidc-discovery-provider")</pre> |
EOF EOF
if [ $1 -ne 0 ]; then if [[ "$1" -ne 0 ]]; then
echo echo
echo '```' echo '```'
echo '==> Events of namespace spire-server' echo '==> Events of namespace spire-server'
@@ -53,8 +54,8 @@ if [ $1 -ne 0 ]; then
echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system' echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
kubectl --request-timeout=30s describe pods --namespace spire-system kubectl --request-timeout=30s describe pods --namespace spire-system
echo '========================================================================================================================' echo '========================================================================================================================'
kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done kubectl get pods -o name -n spire-server | while read -r line; do echo logs for "${line}"; kubectl logs -n spire-server "${line}"--all-containers=true --ignore-errors=true; done
kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done kubectl get pods -o name -n spire-system | while read -r line; do echo logs for "${line}"; kubectl logs -n spire-system "${line}" --all-containers=true --ignore-errors=true; done
echo '========================================================================================================================' echo '========================================================================================================================'
echo '```' echo '```'
fi | cat >> "$GITHUB_STEP_SUMMARY" fi | cat >> "$GITHUB_STEP_SUMMARY"
.github/tests/namespace-override/pre-install.sh
+2 -1
View File
@@ -1,3 +1,4 @@
#!/bin/bash #!/usr/bin/env bash
kubectl create namespace "spire-system" kubectl create namespace "spire-system"
kubectl create namespace "spire-server" kubectl create namespace "spire-server"
.github/tests/production-example/post-install.sh
+15 -9
View File
@@ -3,10 +3,16 @@
set -x set -x
SCRIPT=$(readlink -f "$0") SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT") SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
k_wait=(kubectl wait --for condition=available --timeout 30s --namespace) k_wait () {
k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace) kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
}
k_rollout_status () {
kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
}
function get_namespace_details { function get_namespace_details {
cat <<EOF >>"$GITHUB_STEP_SUMMARY" cat <<EOF >>"$GITHUB_STEP_SUMMARY"
@@ -38,14 +44,14 @@ cat <<EOF >>"$GITHUB_STEP_SUMMARY"
| workload | Status | | workload | Status |
| ------------------------------------ | ------ | | ------------------------------------ | ------ |
| spire-server | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" | | spire-server | "$(k_rollout_status spire-server statefulset spire-server)" |
| spire-controller-manager | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" | | spire-controller-manager | "$(k_rollout_status spire-server statefulset spire-controller-manager)" |
| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" | | spire-spiffe-oidc-discovery-provider | "$(k_wait spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
| spire-spiffe-csi-driver | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" | | spire-spiffe-csi-driver | "$(k_rollout_status spire-system daemonset spire-spiffe-csi-driver)" |
| spire-agent | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" | | spire-agent | "$(k_rollout_status spire-system daemonset spire-agent)" |
EOF EOF
if [ $1 -ne 0 ]; then if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server get_namespace_details spire-server
get_namespace_details spire-systen get_namespace_details spire-systen
fi fi
.github/tests/prometheus/pre-install.sh
+5 -1
View File
@@ -1,3 +1,7 @@
#!/usr/bin/env bash #!/usr/bin/env bash
helm install kube-prometheus-stack kube-prometheus-stack --version $VERSION_KUBE_PROMETHEUS_STACK --repo $HELM_REPO_KUBE_PROMETHEUS_STACK -n "$scenario" --wait SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install kube-prometheus-stack kube-prometheus-stack --version "${VERSION_KUBE_PROMETHEUS_STACK}" --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" -n "${scenario}" --wait
.github/tests/spire-oidc-insecure/pre-install.sh
+5 -1
View File
@@ -1,4 +1,8 @@
#!/usr/bin/env bash #!/usr/bin/env bash
helm install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough= SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario" kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario"
.github/tests/upstream-authority-cert-manager/pre-install.sh
+5 -1
View File
@@ -1,5 +1,9 @@
#!/usr/bin/env bash #!/usr/bin/env bash
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
kubectl apply -f $SCRIPT_DIR/cert-manager-ca.yaml -n "$scenario" kubectl apply -f "${SCRIPT_DIR}/cert-manager-ca.yaml" -n "$scenario"
.github/workflows/scripts/update-versions.sh
+11 -11
View File
@@ -1,24 +1,24 @@
#!/usr/bin/env bash #!/usr/bin/env bash
SCRIPT=$(readlink -f "$0") SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT") SCRIPTPATH=$(dirname "${SCRIPT}")
CHARTJSON=$SCRIPTPATH/../../tests/charts.json CHARTJSON="${SCRIPTPATH}/../../tests/charts.json"
jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do
ENTRYQUERY='.[] | select(.name == "'$CHART'")' ENTRYQUERY='.[] | select(.name == "'$CHART'")'
REPO_URL="$(jq -r "$ENTRYQUERY | .repo" "${CHARTJSON}")" REPO_URL="$(jq -r "$ENTRYQUERY | .repo" "${CHARTJSON}")"
VERSION="$(jq -r "$ENTRYQUERY | .version" "${CHARTJSON}")" VERSION="$(jq -r "$ENTRYQUERY | .version" "${CHARTJSON}")"
echo Processing: ${CHART} echo Processing: "${CHART}"
echo " repo: $REPO_URL" echo " repo: ${REPO_URL}"
echo " current version: $VERSION" echo " current version: ${VERSION}"
helm repo add "$CHART" "$REPO_URL" > /dev/null helm repo add "${CHART}" "${REPO_URL}" > /dev/null
helm repo update "$CHART" > /dev/null helm repo update "${CHART}" > /dev/null
LATEST_VERSION=$(helm search repo --regexp "$CHART/$CHART\v" -o json | jq -r '.[0].version') LATEST_VERSION=$(helm search repo --regexp "${CHART}/${CHART}\v" -o json | jq -r '.[0].version')
echo " latest version: $LATEST_VERSION" echo " latest version: ${LATEST_VERSION}"
if [ "x$VERSION" != "x$LATEST_VERSION" ]; then if [ "x${VERSION}" != "x${LATEST_VERSION}" ]; then
echo " New version found!" echo " New version found!"
jq "( $ENTRYQUERY ).version |= "'"${LATEST_VERSION}"' "${CHARTJSON}" > /tmp/$$ jq "(${ENTRYQUERY}).version |= "'"${LATEST_VERSION}"' "${CHARTJSON}" > /tmp/$$
mv /tmp/$$ "${CHARTJSON}" mv /tmp/$$ "${CHARTJSON}"
fi fi
done done
helm-docs.sh
+22 -22
View File
@@ -6,31 +6,31 @@ SCRIPTPATH=$(dirname "$0")
HELM_DOCS_VERSION="1.11.0" HELM_DOCS_VERSION="1.11.0"
case "$(uname -s)" in case "$(uname -s)" in
Linux*) Linux*)
machine=Linux machine=Linux
shasum=sha256sum shasum=sha256sum
exe=helm-docs exe=helm-docs
;; ;;
Darwin*) Darwin*)
machine=Darwin machine=Darwin
shasum=shasum shasum=shasum
exe=helm-docs exe=helm-docs
;; ;;
MINGW64*) MINGW64*)
machine=Windows machine=Windows
shasum=sha256sum shasum=sha256sum
exe=helm-docs.exe exe=helm-docs.exe
;; ;;
esac esac
function install_helm_docs { function install_helm_docs {
curl -LO https://github.com/norwoodj/helm-docs/releases/download/v"${HELM_DOCS_VERSION}"/helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz curl -LO "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
curl -L --output /tmp/checksums_helm-docs.txt https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt curl -L --output /tmp/checksums_helm-docs.txt "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt"
grep helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz /tmp/checksums_helm-docs.txt | $shasum -c - grep "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" /tmp/checksums_helm-docs.txt | $shasum -c -
mkdir -p "$SCRIPTPATH/bin" mkdir -p "$SCRIPTPATH/bin"
tar -xf helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz ${exe} tar -xf "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" "${exe}"
mv ${exe} "$SCRIPTPATH/bin/" mv "${exe}" "$SCRIPTPATH/bin/"
rm helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz rm "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
} }
if [ ! -f "$SCRIPTPATH/bin/${exe}" ] ; then if [ ! -f "$SCRIPTPATH/bin/${exe}" ] ; then