mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-09-01 21:59:36 +00:00
78 lines
2.9 KiB
Bash
Executable File
78 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set -euo pipefail
|
|
|
|
# When the kubeconfig is generated by gcloud below, this env var asks gcloud to use the new
|
|
# gke-gcloud-auth-plugin client credentials auth plugin in the kubeconfig file.
|
|
# See https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke
|
|
export USE_GKE_GCLOUD_AUTH_PLUGIN=True
|
|
|
|
cd deploy-gke-cluster-output
|
|
gcloud auth activate-service-account "$GCP_SERVICE_ACCOUNT" --key-file <(echo "$GCP_JSON_KEY") --project "$GCP_PROJECT"
|
|
|
|
|
|
if [ -n "$KUBE_VERSION" ]; then
|
|
echo
|
|
echo "Trying to use Kubernetes version $KUBE_VERSION"
|
|
|
|
# Look up the latest GKE version for KUBE_VERSION.
|
|
GKE_VERSIONS="$(gcloud container get-server-config --zone "$CLUSTER_ZONE" --format json \
|
|
| jq -r '.validMasterVersions[]')"
|
|
echo
|
|
echo "Found all versions of Kubernetes supported by GKE:"
|
|
echo "$GKE_VERSIONS"
|
|
|
|
GKE_VERSION="$(echo "$GKE_VERSIONS" | grep -F "$KUBE_VERSION" \
|
|
| sort -rn \
|
|
| head -1)"
|
|
echo
|
|
echo "Selected GKE version $GKE_VERSION"
|
|
|
|
export VERSION_FLAG="--cluster-version=$GKE_VERSION"
|
|
else
|
|
export VERSION_FLAG="--release-channel=${GKE_CHANNEL:-"regular"}"
|
|
fi
|
|
|
|
# Include the zone of the cluster in its name. This will allow us to change our preferred zone for new
|
|
# clusters anytime we want, and the existing clusters can still be deleted because the old zone can
|
|
# be parsed out from the cluster name at deletion time.
|
|
CLUSTER_NAME="gke-$(openssl rand -hex 4)-zone-${CLUSTER_ZONE}"
|
|
|
|
# The cluster name becomes the name of the lock in the pool.
|
|
echo "$CLUSTER_NAME" > name
|
|
|
|
# Start the cluster
|
|
# Note that --enable-network-policy is required to enable NetworkPolicy resources. Otherwise they are ignored.
|
|
gcloud container clusters create "$CLUSTER_NAME" \
|
|
--zone "$CLUSTER_ZONE" \
|
|
"$VERSION_FLAG" \
|
|
--num-nodes 1 \
|
|
--machine-type e2-standard-4 \
|
|
--preemptible \
|
|
--issue-client-certificate \
|
|
--no-enable-basic-auth \
|
|
--enable-network-policy
|
|
|
|
# Get the cluster details back, including the admin certificate:
|
|
gcloud container clusters describe "$CLUSTER_NAME" --zone "$CLUSTER_ZONE" --format json \
|
|
> /tmp/cluster.json
|
|
|
|
# Make a new kubeconfig user "cluster-admin" using the admin cert.
|
|
jq -r .masterAuth.clientCertificate /tmp/cluster.json | base64 -d > /tmp/client.crt
|
|
jq -r .masterAuth.clientKey /tmp/cluster.json | base64 -d > /tmp/client.key
|
|
kubectl config set-credentials cluster-admin \
|
|
--client-certificate=/tmp/client.crt \
|
|
--client-key=/tmp/client.key
|
|
|
|
# Give the "client" user cluster-admin access
|
|
kubectl create clusterrolebinding test-client-is-admin --clusterrole cluster-admin --user client
|
|
|
|
# Set the kubeconfig context to use the cluster-admin user.
|
|
kubectl config set-context --current --user cluster-admin
|
|
|
|
# The kubeconfig file becomes the value of the lock in the pool.
|
|
kubectl config view --minify --flatten -o yaml > metadata
|