mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-09-06 16:17:08 +00:00
97 lines
4.3 KiB
Bash
Executable File
97 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ -z "${PINNIPED_GCP_PROJECT:-}" ]]; then
|
|
echo "PINNIPED_GCP_PROJECT env var must be set"
|
|
exit 1
|
|
fi
|
|
|
|
# See https://github.com/concourse/registry-image-resource#in-fetch-the-images-rootfs-and-metadata
|
|
digest=$(cat ci-build-image/digest)
|
|
|
|
pinniped_ci="$PWD/pinniped-ci"
|
|
pinniped_cluster_capability_file="$PWD/pinniped/test/cluster_capabilities/gke.yaml"
|
|
|
|
gcloud auth activate-service-account "$GKE_USERNAME" --key-file <(echo "$GKE_JSON_KEY") --project "$PINNIPED_GCP_PROJECT"
|
|
|
|
# https://cloud.google.com/blog/products/containers-kubernetes/kubectl-auth-changes-in-gke
|
|
export USE_GKE_GCLOUD_AUTH_PLUGIN=True
|
|
gcloud container clusters get-credentials "$GKE_CLUSTER_NAME" --zone us-west1-c --project "$PINNIPED_GCP_PROJECT"
|
|
|
|
pushd pinniped >/dev/null
|
|
|
|
# Create the image pull secret to template using ytt
|
|
image_pull_secret=$(kubectl create secret docker-registry dummy \
|
|
--docker-server="$CI_BUILD_IMAGE_SERVER" \
|
|
--docker-username="$CI_BUILD_IMAGE_USERNAME" \
|
|
--docker-password="$CI_BUILD_IMAGE_PASSWORD" \
|
|
--dry-run=client -o json | jq -r '.data[".dockerconfigjson"]')
|
|
|
|
if [[ "${TMC_API_TOKEN:-}" == "" ]]; then
|
|
# If the TMC API token is not set, then assume that we want to use the local user authenticator
|
|
# instead of the TMC webhook authenticator.
|
|
export DEPLOY_LOCAL_USER_AUTHENTICATOR="yes"
|
|
fi
|
|
|
|
# This script uses the API token from the environment variable TMC_API_TOKEN,
|
|
# and the cluster name from the environment variable TMC_CLUSTER_NAME.
|
|
#
|
|
# Set the serving cert parameters to 1h20m and 1h so that we can validate that
|
|
# an aggressive cert rotation schedule doesn't mess up the cluster too bad.
|
|
CONCIERGE_NAMESPACE=concierge-acceptance \
|
|
SUPERVISOR_NAMESPACE=supervisor-acceptance \
|
|
SUPERVISOR_LOAD_BALANCER=yes \
|
|
SUPERVISOR_LOAD_BALANCER_DNS_NAME="$LOAD_BALANCER_DNS_NAME" \
|
|
SUPERVISOR_LOAD_BALANCER_STATIC_IP="$RESERVED_LOAD_BALANCER_STATIC_IP" \
|
|
SUPERVISOR_INGRESS=yes \
|
|
SUPERVISOR_INGRESS_DNS_NAME="$INGRESS_DNS_ENTRY_GCLOUD_NAME" \
|
|
SUPERVISOR_INGRESS_STATIC_IP_NAME="$INGRESS_STATIC_IP_GCLOUD_NAME" \
|
|
SUPERVISOR_INGRESS_PATH_PATTERN='/*' \
|
|
IMAGE_PULL_SECRET="$image_pull_secret" \
|
|
IMAGE_REPO="$CI_BUILD_IMAGE_NAME" \
|
|
IMAGE_DIGEST="$digest" \
|
|
API_SERVING_CERT_DURATION=4800 \
|
|
API_SERVING_CERT_RENEW_BEFORE=3600 \
|
|
PINNIPED_TEST_CLUSTER_CAPABILITY_FILE="$pinniped_cluster_capability_file" \
|
|
"$pinniped_ci/pipelines/shared-helpers/prepare-cluster-for-integration-tests.sh"
|
|
|
|
if [[ "${TMC_API_TOKEN:-}" != "" ]]; then
|
|
# Create a long-lived webhook IDP allowing TMC login via the TUA organization.
|
|
source /tmp/integration-test-env
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: authentication.concierge.pinniped.dev/v1alpha1
|
|
kind: WebhookAuthenticator
|
|
metadata:
|
|
name: tua-tmc
|
|
spec:
|
|
endpoint: ${PINNIPED_TEST_WEBHOOK_ENDPOINT}
|
|
tls:
|
|
certificateAuthorityData: ${PINNIPED_TEST_WEBHOOK_CA_BUNDLE}
|
|
EOF
|
|
fi
|
|
|
|
popd >/dev/null
|
|
|
|
# Copy the env vars file that was output by the previous script which are needed during integration tests
|
|
cp /tmp/integration-test-env integration-test-env-vars/
|
|
|
|
# So that the tests can avoid using the GKE auth plugin, create an admin kubeconfig which uses certs (without the plugin).
|
|
# Get the cluster details back, including the admin certificate:
|
|
gcloud container clusters describe "$GKE_CLUSTER_NAME" --zone us-west1-c --format json >/tmp/cluster.json
|
|
# Make a new kubeconfig user "cluster-admin" using the admin cert.
|
|
jq -r .masterAuth.clientCertificate /tmp/cluster.json | base64 -d >/tmp/client.crt
|
|
jq -r .masterAuth.clientKey /tmp/cluster.json | base64 -d >/tmp/client.key
|
|
kubectl config set-credentials cluster-admin --client-certificate=/tmp/client.crt --client-key=/tmp/client.key
|
|
# Give the "client" user cluster-admin access in an idempotent way.
|
|
kubectl create clusterrolebinding test-client-is-admin --clusterrole cluster-admin --user client --dry-run=client -o yaml | kubectl apply -f -
|
|
# Set the kubeconfig context to use the cluster-admin user.
|
|
kubectl config set-context --current --user cluster-admin
|
|
# Write out the admin kubeconfig file to the task's output directory.
|
|
kubectl config view --minify --flatten -o yaml >kubeconfig/kubeconfig
|
|
# Give it the appropriate permissions.
|
|
chmod 0644 kubeconfig/kubeconfig
|