Faisal Memon
9273f11f0a
* Add root-level spire-lib chart Signed-off-by: Faisal Memon <[email protected]> * Make spire consume root-level spire-lib Signed-off-by: Faisal Memon <[email protected]> * Prepare chart dependencies in CI Signed-off-by: Faisal Memon <[email protected]> * Document DCO requirement in CODEX Signed-off-by: Faisal Memon <[email protected]> * Centralize local chart dependency prep Signed-off-by: Faisal Memon <[email protected]> * Exclude spire-lib from chart-testing install Signed-off-by: Faisal Memon <[email protected]> * Rename CODEX guide to AGENTS Signed-off-by: Faisal Memon <[email protected]> * Add make target for chart dependencies Signed-off-by: Faisal Memon <[email protected]> --------- Signed-off-by: Faisal Memon <[email protected]>
78 lines
3.3 KiB
Bash
Executable File
78 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -xe
|
|
|
|
SCRIPT="$(readlink -f "$0")"
|
|
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
|
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
|
|
|
# shellcheck source=/dev/null
|
|
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
|
# shellcheck source=/dev/null
|
|
source "${TESTDIR}/common.sh"
|
|
|
|
"${SCRIPTPATH}/../../.github/scripts/prepare-local-chart-deps.sh"
|
|
|
|
CLEANUP=1
|
|
|
|
for i in "$@"; do
|
|
case $i in
|
|
-c)
|
|
CLEANUP=0
|
|
shift # past argument=value
|
|
;;
|
|
esac
|
|
done
|
|
|
|
teardown() {
|
|
print_helm_releases
|
|
print_spire_workload_status spire-server spire-system
|
|
|
|
if [[ "$1" -ne 0 ]]; then
|
|
get_namespace_details spire-server spire-system
|
|
fi
|
|
|
|
if [ "${CLEANUP}" -eq 1 ]; then
|
|
helm uninstall --namespace spire-mgmt spire-b 2>/dev/null || true
|
|
helm uninstall --namespace spire-mgmt spire-a 2>/dev/null || true
|
|
kubectl delete ns spire-mgmt 2>/dev/null || true
|
|
fi
|
|
}
|
|
|
|
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
|
|
|
helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
|
--namespace ingress-nginx \
|
|
--create-namespace \
|
|
--set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
|
|
--set controller.ingressClassResource.default=true \
|
|
--wait
|
|
|
|
IP=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o yaml | yq e .spec.clusterIPs[0] -)
|
|
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
|
|
kubectl get configmap -n kube-system coredns -o yaml | grep a-org || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP spire-server-federation.a-org.local\n $IP spire-server-federation.b-org.local\n" | kubectl apply -f -
|
|
|
|
kubectl rollout restart -n kube-system deployment/coredns
|
|
kubectl rollout status -w --timeout=1m deploy/coredns -n kube-system
|
|
|
|
kubectl create namespace spire-mgmt --dry-run=client -o yaml | kubectl apply -f -
|
|
kubectl label namespace spire-mgmt pod-security.kubernetes.io/enforce=restricted || true
|
|
|
|
helm upgrade --install --namespace spire-mgmt --values "${SCRIPTPATH}/a-values.yaml" \
|
|
--wait spire-a charts/spire
|
|
|
|
helm upgrade --install --namespace spire-mgmt --values "${SCRIPTPATH}/b-values.yaml" \
|
|
--wait spire-b charts/spire
|
|
|
|
kubectl exec -it -n spire-server spire-a-server-0 -c spire-server -- spire-server bundle show -format spiffe | kubectl exec -i -n spire-server spire-b-server-0 -c spire-server -- spire-server bundle set -format spiffe -id spiffe://a-org.local
|
|
kubectl exec -it -n spire-server spire-b-server-0 -c spire-server -- spire-server bundle show -format spiffe | kubectl exec -i -n spire-server spire-a-server-0 -c spire-server -- spire-server bundle set -format spiffe -id spiffe://b-org.local
|
|
|
|
kubectl exec -it -n spire-server spire-b-server-0 -c spire-server -- spire-server bundle list
|
|
kubectl exec -it -n spire-server spire-a-server-0 -c spire-server -- spire-server bundle list
|
|
|
|
kubectl apply -f "${SCRIPTPATH}/server-svc.yaml"
|
|
kubectl apply -f "${SCRIPTPATH}/server-pod.yaml"
|
|
kubectl apply -f "${SCRIPTPATH}/client-pod.yaml"
|
|
|
|
kubectl wait --for=condition=Ready pod/client --timeout 5m
|