mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-09-19 22:44:18 +00:00
87 lines
2.9 KiB
Bash
Executable File
87 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set -euo pipefail
|
|
|
|
# Install and configure cert-manager to generate letsencrypt TLS certs for the supervisor
|
|
# which can be used for manual testing on the cluster. In order to use it, create a
|
|
# FederationDomain which specifies an issuer with the same name DNS name as the certificate
|
|
# and also specifies the same secretName as used below in the Certificate CR.
|
|
# The DNS record for the DNS name use here should be manually created elsewhere to point
|
|
# to the Supervisor's load balancer IP address.
|
|
#
|
|
# See sample-federation-domain.yaml in this directory for an example FederationDomain
|
|
# which will use these letsencrypt certs, which you can apply to the acceptance cluster.
|
|
|
|
if [[ -z "${PINNIPED_GCP_PROJECT:-}" ]]; then
|
|
echo "PINNIPED_GCP_PROJECT env var must be set"
|
|
exit 1
|
|
fi
|
|
|
|
# Use the kubeconfig from the task inputs.
|
|
export KUBECONFIG="$(pwd)/kubeconfig/kubeconfig"
|
|
|
|
# Load some deployment related env vars, like PINNIPED_TEST_SUPERVISOR_NAMESPACE, from the task inputs.
|
|
source integration-test-env-vars/integration-test-env
|
|
|
|
# Install or update cert-manager. This will create a "cert-manager" namespace.
|
|
kapp deploy --yes --app cert-manager --diff-changes \
|
|
--file "https://github.com/cert-manager/cert-manager/releases/download/v1.10.1/cert-manager.yaml"
|
|
|
|
# Configure a DNS admin account for cert-manager to use.
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: cert-manager-credentials
|
|
namespace: cert-manager
|
|
type: Opaque
|
|
data:
|
|
cert-manager-dns-admin.json: $(echo "$CERT_MANAGER_DNS_ADMIN_JSON_KEY" | base64 -w 0)
|
|
EOF
|
|
|
|
# Configure cert-manager to use letsencrypt.
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
email: tanzu-user-authentication@groups.vmware.com
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
solvers:
|
|
- dns01:
|
|
cloudDNS:
|
|
project: "$PINNIPED_GCP_PROJECT"
|
|
serviceAccountSecretRef:
|
|
key: cert-manager-dns-admin.json
|
|
name: cert-manager-credentials
|
|
EOF
|
|
|
|
# Configure cert-manager to create a serving cert for the Supervisor.
|
|
# Save it into a Secret (secretName below) that can be used for manual testing.
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: supervisor-letsencrypt-tls-certificate
|
|
namespace: ${PINNIPED_TEST_SUPERVISOR_NAMESPACE}
|
|
spec:
|
|
dnsNames:
|
|
# This name can be set up as a DNS A record in our DNS account
|
|
# to point at the IP of the Supervisor load balancer Service.
|
|
- le.test.pinniped.dev
|
|
issuerRef:
|
|
kind: ClusterIssuer
|
|
name: letsencrypt-prod
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
secretName: supervisor-letsencrypt-tls-certificate
|
|
EOF
|