-
Notifications
You must be signed in to change notification settings - Fork 545
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Per Goncalves da Silva <[email protected]>
- Loading branch information
Per Goncalves da Silva
committed
Jun 17, 2024
1 parent
442c42d
commit 94e5712
Showing
10 changed files
with
471 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -x | ||
|
|
||
| help=" | ||
| generate_registry_cert.sh is a script to generate the self-signed certificates used by the internal registry. | ||
| Usage: | ||
| generate_registry_cert.sh [NAMESPACE] [NAME] | ||
| Argument Descriptions: | ||
| - NAMESPACE is the namespace that should be created and is the namespace in which the image registry will be created | ||
| - NAME is the name that should be used for the image registry Deployment and Service | ||
| " | ||
|
|
||
| if [[ "$#" -ne 2 ]]; then | ||
| echo "Illegal number of arguments passed" | ||
| echo "${help}" | ||
| exit 1 | ||
| fi | ||
|
|
||
| namespace=$1 | ||
| name=$2 | ||
|
|
||
| # Generate ECDSA private key | ||
| openssl ecparam -genkey -name prime256v1 -out tls.key | ||
|
|
||
| # Create CSR configuration file (csr.conf) | ||
| cat <<EOF > csr.conf | ||
| [ req ] | ||
| prompt = no | ||
| distinguished_name = dn | ||
| x509_extensions = v3_req | ||
| req_extensions = req_ext | ||
| [ dn ] | ||
| CN = ${name}.${namespace}.svc | ||
| [ req_ext ] | ||
| subjectAltName = @alt_names | ||
| [ alt_names ] | ||
| DNS.1 = ${name}.${namespace}.svc | ||
| DNS.2 = ${name}.${namespace}.cluster.local | ||
| EOF | ||
|
|
||
| # Generate CSR | ||
| openssl req -new -key tls.key -out tls.csr -config csr.conf | ||
|
|
||
| # Create certificate configuration file (cert.conf) | ||
| cat <<EOF > cert.conf | ||
| [ req ] | ||
| prompt = no | ||
| distinguished_name = dn | ||
| x509_extensions = v3_req | ||
| req_extensions = req_ext | ||
| [ dn ] | ||
| CN = ${name}.${namespace}.svc | ||
| [ v3_req ] | ||
| subjectAltName = @alt_names | ||
| basicConstraints = CA:TRUE | ||
| [ alt_names ] | ||
| DNS.1 = ${name}.${namespace}.svc | ||
| DNS.2 = ${name}.${namespace}.cluster.local | ||
| EOF | ||
|
|
||
| # Generate self-signed certificate | ||
| openssl req -x509 -key tls.key -in tls.csr -out tls.crt -days 3650 -config cert.conf | ||
|
|
||
| # Remove temporary files | ||
| rm -rf cert.conf csr.conf tls.csr |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| #! /bin/bash | ||
|
|
||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
|
|
||
| set -x | ||
|
|
||
| help=" | ||
| image_registry.sh is a script to stand up an image registry within a cluster. | ||
| Usage: | ||
| image_registry.sh [NAMESPACE] [NAME] | ||
| Argument Descriptions: | ||
| - NAMESPACE is the namespace that should be created and is the namespace in which the image registry will be created | ||
| - NAME is the name that should be used for the image registry Deployment and Service | ||
| " | ||
|
|
||
| if [[ "$#" -ne 2 ]]; then | ||
| echo "Illegal number of arguments passed" | ||
| echo "${help}" | ||
| exit 1 | ||
| fi | ||
|
|
||
| namespace=$1 | ||
| name=$2 | ||
|
|
||
| # Generate self-signed TLS certificate | ||
| ./scripts/generate_registry_cert.sh "${namespace}" "${name}" | ||
|
|
||
| # Read and base64 encode the certificate and key files | ||
| CERT_FILE=$(cat "tls.crt" | base64 | tr -d '\n') | ||
| KEY_FILE=$(cat "tls.key" | base64 | tr -d '\n') | ||
|
|
||
| kubectl apply -f - << EOF | ||
| apiVersion: v1 | ||
| kind: Namespace | ||
| metadata: | ||
| name: ${namespace} | ||
| --- | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: ${namespace}-registry | ||
| namespace: ${namespace} | ||
| type: Opaque | ||
| data: | ||
| tls.crt: "${CERT_FILE}" | ||
| tls.key: "${KEY_FILE}" | ||
| --- | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: ${name} | ||
| namespace: ${namespace} | ||
| labels: | ||
| app: registry | ||
| spec: | ||
| replicas: 1 | ||
| selector: | ||
| matchLabels: | ||
| app: registry | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: registry | ||
| spec: | ||
| containers: | ||
| - name: registry | ||
| image: registry:2 | ||
| volumeMounts: | ||
| - name: certs-vol | ||
| mountPath: "/certs" | ||
| env: | ||
| - name: REGISTRY_HTTP_TLS_CERTIFICATE | ||
| value: "/certs/tls.crt" | ||
| - name: REGISTRY_HTTP_TLS_KEY | ||
| value: "/certs/tls.key" | ||
| volumes: | ||
| - name: certs-vol | ||
| secret: | ||
| secretName: ${namespace}-registry | ||
| --- | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: ${name} | ||
| namespace: ${namespace} | ||
| spec: | ||
| selector: | ||
| app: registry | ||
| ports: | ||
| - port: 5000 | ||
| targetPort: 5000 | ||
| EOF | ||
|
|
||
| kubectl wait --for=condition=Available -n "${namespace}" "deploy/${name}" --timeout=60s | ||
|
|
||
| # Alternatively, just generate the pair once and save it to the repo. But then in 10 years we might need to generate a new certificate! | ||
| rm -rf tls.crt tls.key |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| #! /bin/bash | ||
|
|
||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
|
|
||
| help=" | ||
| build-push-e2e-catalog.sh is a script to build and push the e2e catalog image using kaniko. | ||
| Usage: | ||
| build-push-e2e-catalog.sh [NAMESPACE] [TAG] | ||
| Argument Descriptions: | ||
| - NAMESPACE is the namespace the kaniko Job should be created in | ||
| - TAG is the full tag used to build and push the catalog image | ||
| " | ||
|
|
||
| if [[ "$#" -ne 2 ]]; then | ||
| echo "Illegal number of arguments passed" | ||
| echo "${help}" | ||
| exit 1 | ||
| fi | ||
|
|
||
| namespace=$1 | ||
| tag=$2 | ||
|
|
||
| OPM_VERSION=${OPM_VERSION:-"latest"} | ||
|
|
||
| echo "${namespace}" "${tag}" | ||
|
|
||
| # Delete existing configmaps | ||
| kubectl delete configmap -n "${namespace}" test-catalog.dockerfile --ignore-not-found | ||
| kubectl delete configmap -n "${namespace}" test-catalog.build-contents --ignore-not-found | ||
|
|
||
| kubectl create configmap -n "${namespace}" --from-file=test/images/test-catalog/dockerfile test-catalog.dockerfile | ||
| kubectl create configmap -n "${namespace}" --from-file=test/images/test-catalog/configs test-catalog.build-contents | ||
|
|
||
| kubectl apply -f - << EOF | ||
| apiVersion: batch/v1 | ||
| kind: Job | ||
| metadata: | ||
| name: kaniko | ||
| namespace: "${namespace}" | ||
| spec: | ||
| template: | ||
| spec: | ||
| containers: | ||
| - name: kaniko | ||
| image: gcr.io/kaniko-project/executor:latest | ||
| args: [ "--build-arg=OPM_VERSION=${OPM_VERSION}", | ||
| "--dockerfile=/workspace/dockerfile", | ||
| "--context=/workspace", | ||
| "--destination=${tag}", | ||
| "--verbosity=trace", | ||
| "--skip-tls-verify"] | ||
| volumeMounts: | ||
| - name: dockerfile | ||
| mountPath: /workspace/ | ||
| - name: build-contents | ||
| mountPath: /workspace/configs/ | ||
| restartPolicy: Never | ||
| volumes: | ||
| - name: dockerfile | ||
| configMap: | ||
| name: test-catalog.dockerfile | ||
| items: | ||
| - key: dockerfile | ||
| path: dockerfile | ||
| - name: build-contents | ||
| configMap: | ||
| name: test-catalog.build-contents | ||
| EOF | ||
|
|
||
| kubectl wait --for=condition=Complete -n "${namespace}" jobs/kaniko --timeout=60s |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| /expected_all.json | ||
| ..* |
Oops, something went wrong.