panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #242 from spiffe/shellcheck

Browse Source
This commit is contained in:
Marco Franssen
2023-04-26 16:06:08 +02:00
committed by GitHub
parent 8abd75ef7b 99af475f1c
commit 9afb6f80ac
9 changed files with 100 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/tests/namespace-override/post-install.sh
+5 -4
View File
@@ -3,7 +3,8 @@
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
k_wait () {
kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
@@ -30,7 +31,7 @@ cat <<EOF >>"$GITHUB_STEP_SUMMARY"
| spire-spiffe-oidc-discovery-provider | <pre>$(k_wait spire-server deployments.apps "${RELEASE}-spiffe-oidc-discovery-provider")</pre> |
EOF
if [ $1 -ne 0 ]; then
if [[ "$1" -ne 0 ]]; then
echo
echo '```'
echo '==> Events of namespace spire-server'
@@ -53,8 +54,8 @@ if [ $1 -ne 0 ]; then
echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system'
kubectl --request-timeout=30s describe pods --namespace spire-system
echo '========================================================================================================================'
kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done
kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done
kubectl get pods -o name -n spire-server | while read -r line; do echo logs for "${line}"; kubectl logs -n spire-server "${line}"--all-containers=true --ignore-errors=true; done
kubectl get pods -o name -n spire-system | while read -r line; do echo logs for "${line}"; kubectl logs -n spire-system "${line}" --all-containers=true --ignore-errors=true; done
echo '========================================================================================================================'
echo '```'
fi | cat >> "$GITHUB_STEP_SUMMARY"
.github/tests/namespace-override/pre-install.sh
+2 -1
View File
@@ -1,3 +1,4 @@
#!/bin/bash
#!/usr/bin/env bash
kubectl create namespace "spire-system"
kubectl create namespace "spire-server"
.github/tests/production-example/post-install.sh
+15 -9
View File
@@ -3,10 +3,16 @@
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
k_wait () {
kubectl wait --for condition=available --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
}
k_rollout_status () {
kubectl rollout status --watch --timeout 30s --namespace "$1" "$2" "$3" | tail -n 1
}
function get_namespace_details {
cat <<EOF >>"$GITHUB_STEP_SUMMARY"
@@ -38,14 +44,14 @@ cat <<EOF >>"$GITHUB_STEP_SUMMARY"
| workload | Status |
| ------------------------------------ | ------ |
| spire-server | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" |
| spire-controller-manager | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" |
| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
| spire-spiffe-csi-driver | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" |
| spire-agent | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" |
| spire-server | "$(k_rollout_status spire-server statefulset spire-server)" |
| spire-controller-manager | "$(k_rollout_status spire-server statefulset spire-controller-manager)" |
| spire-spiffe-oidc-discovery-provider | "$(k_wait spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
| spire-spiffe-csi-driver | "$(k_rollout_status spire-system daemonset spire-spiffe-csi-driver)" |
| spire-agent | "$(k_rollout_status spire-system daemonset spire-agent)" |
EOF
if [ $1 -ne 0 ]; then
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-systen
fi
.github/tests/prometheus/pre-install.sh
+5 -1
View File
@@ -1,3 +1,7 @@
#!/usr/bin/env bash
helm install kube-prometheus-stack kube-prometheus-stack --version $VERSION_KUBE_PROMETHEUS_STACK --repo $HELM_REPO_KUBE_PROMETHEUS_STACK -n "$scenario" --wait
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install kube-prometheus-stack kube-prometheus-stack --version "${VERSION_KUBE_PROMETHEUS_STACK}" --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" -n "${scenario}" --wait
.github/tests/spire-oidc-insecure/pre-install.sh
+5 -1
View File
@@ -1,4 +1,8 @@
#!/usr/bin/env bash
helm install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario"
.github/tests/upstream-authority-cert-manager/pre-install.sh
+5 -1
View File
@@ -1,5 +1,9 @@
#!/usr/bin/env bash
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "${SCRIPT}")
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
kubectl apply -f $SCRIPT_DIR/cert-manager-ca.yaml -n "$scenario"
kubectl apply -f "${SCRIPT_DIR}/cert-manager-ca.yaml" -n "$scenario"
.github/workflows/scripts/update-versions.sh
+11 -11
View File
@@ -1,24 +1,24 @@
#!/usr/bin/env bash
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
SCRIPTPATH=$(dirname "${SCRIPT}")
CHARTJSON=$SCRIPTPATH/../../tests/charts.json
CHARTJSON="${SCRIPTPATH}/../../tests/charts.json"
jq -r ".[].name" "${CHARTJSON}" | while read -r CHART; do
ENTRYQUERY='.[] | select(.name == "'$CHART'")'
REPO_URL="$(jq -r "$ENTRYQUERY | .repo" "${CHARTJSON}")"
VERSION="$(jq -r "$ENTRYQUERY | .version" "${CHARTJSON}")"
echo Processing: ${CHART}
echo " repo: $REPO_URL"
echo " current version: $VERSION"
helm repo add "$CHART" "$REPO_URL" > /dev/null
helm repo update "$CHART" > /dev/null
LATEST_VERSION=$(helm search repo --regexp "$CHART/$CHART\v" -o json | jq -r '.[0].version')
echo " latest version: $LATEST_VERSION"
if [ "x$VERSION" != "x$LATEST_VERSION" ]; then
echo Processing: "${CHART}"
echo " repo: ${REPO_URL}"
echo " current version: ${VERSION}"
helm repo add "${CHART}" "${REPO_URL}" > /dev/null
helm repo update "${CHART}" > /dev/null
LATEST_VERSION=$(helm search repo --regexp "${CHART}/${CHART}\v" -o json | jq -r '.[0].version')
echo " latest version: ${LATEST_VERSION}"
if [ "x${VERSION}" != "x${LATEST_VERSION}" ]; then
echo " New version found!"
jq "( $ENTRYQUERY ).version |= "'"${LATEST_VERSION}"' "${CHARTJSON}" > /tmp/$$
jq "(${ENTRYQUERY}).version |= "'"${LATEST_VERSION}"' "${CHARTJSON}" > /tmp/$$
mv /tmp/$$ "${CHARTJSON}"
fi
done
.github/workflows/shellcheck.yaml
+30
View File
@@ -0,0 +1,30 @@
name: Shellcheck
on:
workflow_dispatch:
pull_request:
types: [synchronize, opened, reopened, edited]
paths:
- .github/workflows/shellcheck.yaml
- '**/*.sh'
concurrency:
group: ${{ github.ref }}-shellcheck
cancel-in-progress: true
env:
SHELLCHECK_VERSION: v0.9.0
jobs:
checks:
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/[email protected]
- name: Run Shellcheck
uses: ludeeus/[email protected]
with:
format: gcc
version: ${{ env.SHELLCHECK_VERSION }}
helm-docs.sh
+22 -22
View File
@@ -6,31 +6,31 @@ SCRIPTPATH=$(dirname "$0")
HELM_DOCS_VERSION="1.11.0"
case "$(uname -s)" in
Linux*)
machine=Linux
shasum=sha256sum
exe=helm-docs
;;
Darwin*)
machine=Darwin
shasum=shasum
exe=helm-docs
;;
MINGW64*)
machine=Windows
shasum=sha256sum
exe=helm-docs.exe
;;
Linux*)
machine=Linux
shasum=sha256sum
exe=helm-docs
;;
Darwin*)
machine=Darwin
shasum=shasum
exe=helm-docs
;;
MINGW64*)
machine=Windows
shasum=sha256sum
exe=helm-docs.exe
;;
esac
function install_helm_docs {
curl -LO https://github.com/norwoodj/helm-docs/releases/download/v"${HELM_DOCS_VERSION}"/helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz
curl -L --output /tmp/checksums_helm-docs.txt https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt
grep helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz /tmp/checksums_helm-docs.txt | $shasum -c -
mkdir -p "$SCRIPTPATH/bin"
tar -xf helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz ${exe}
mv ${exe} "$SCRIPTPATH/bin/"
rm helm-docs_"${HELM_DOCS_VERSION}"_${machine}_x86_64.tar.gz
curl -LO "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
curl -L --output /tmp/checksums_helm-docs.txt "https://github.com/norwoodj/helm-docs/releases/download/v${HELM_DOCS_VERSION}/checksums.txt"
grep "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" /tmp/checksums_helm-docs.txt | $shasum -c -
mkdir -p "$SCRIPTPATH/bin"
tar -xf "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz" "${exe}"
mv "${exe}" "$SCRIPTPATH/bin/"
rm "helm-docs_${HELM_DOCS_VERSION}_${machine}_x86_64.tar.gz"
}
if [ ! -f "$SCRIPTPATH/bin/${exe}" ] ; then