4 FLUX_SOPS_KEY_NAME=${FLUX_SOPS_KEY_NAME:-"icn-site-vm"}
5 FLUX_SOPS_PRIVATE_KEY="$(readlink -f $(dirname ${BASH_SOURCE[0]}))/secrets/sops.asc"
6 SITE_NAMESPACE="${SITE_NAMESPACE:-metal3}"
9 gpg --with-colons --fingerprint $1 | awk -F: '/fpr/ {print $10;exit}'
12 function sops_encrypt {
14 local -r yaml_dir=$(dirname ${yaml})
17 local -r key_fp=$(_gpg_key_fp ${key_name})
19 local site_dir=${yaml_dir}
20 if [[ $# -eq 3 ]]; then
24 # Commit the public key to the repository so that team members who
25 # clone the repo can encrypt new files
26 echo "Creating ${yaml_dir}/sops.pub.asc with public key used to encrypt secrets"
27 gpg --export --armor "${key_fp}" >${site_dir}/sops.pub.asc
29 # Add .sops.yaml so users won't have to worry about specifying the
30 # proper key for the target cluster or namespace
31 echo "Creating ${site_dir}/.sops.yaml SOPS configuration file"
32 encrypted_regex="(bmcPassword|ca-key.pem|decryptionSecret|hashedPassword|emcoPassword|rootPassword)"
33 cat <<EOF > ${site_dir}/.sops.yaml
36 encrypted_regex: ^${encrypted_regex}$
40 if [[ $(grep -c $(echo ${encrypted_regex} | sed -e 's/(/\\(/g' -e 's/|/\\|/g' -e 's/)/\\)/') ${yaml}) -ne 0 ]]; then
41 sops --encrypt --in-place --config=${site_dir}/.sops.yaml ${yaml}
45 function sops_decrypt {
47 local -r yaml_dir=$(dirname ${yaml})
48 local site_dir=${yaml_dir}
49 if [[ $# -eq 2 ]]; then
53 if [[ $(grep -c "^sops:" ${yaml}) -ne 0 ]]; then
54 sops --decrypt --in-place --config=${site_dir}/.sops.yaml ${yaml}
58 function _site_source_name {
61 # Only alphanumeric and '-' are allowed in resource names
62 echo $(basename ${url})-${branch} | tr -d -c 'A-Za-z0-9-'
65 function _site_kustomization_name {
69 # Only alphanumeric and '-' are allowed in resource names
70 echo $(_site_source_name ${url} ${branch})-site-$(basename ${path}) | tr -d -c 'A-Za-z0-9-'
73 function flux_create_site {
79 local -r source_name=$(_site_source_name ${url} ${branch})
80 local -r kustomization_name=$(_site_kustomization_name ${url} ${branch} ${path})
81 local -r key_fp=$(gpg --with-colons --list-secret-keys ${key_name} | awk -F: '/fpr/ {print $10;exit}')
82 local -r secret_name="${key_name}-sops-gpg"
84 flux create source git ${source_name} --url=${url} --branch=${branch}
85 gpg --export-secret-keys --armor "$(_gpg_key_fp ${key_name})" |
86 kubectl -n flux-system create secret generic ${secret_name} --from-file=sops.asc=/dev/stdin --dry-run=client -o yaml |
88 kubectl create namespace ${SITE_NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -
89 flux create kustomization ${kustomization_name} --target-namespace=${SITE_NAMESPACE} --path=${path} --source=GitRepository/${source_name} --prune=true \
90 --decryption-provider=sops --decryption-secret=${secret_name}
93 function site_deploy {
94 flux_create_site ${SITE_REPO} ${SITE_BRANCH} ${SITE_PATH} ${FLUX_SOPS_KEY_NAME}
98 kubectl -n flux-system delete kustomization $(_site_kustomization_name ${SITE_REPO} ${SITE_BRANCH} ${SITE_PATH})
101 function _is_cluster_ready {
102 for yaml in ${SCRIPTDIR}/deployment/*.yaml; do
103 name=$(awk '/clusterName:/ {print $2}' ${yaml})
104 if [[ ! -z ${name} ]]; then
105 if [[ $(kubectl -n ${SITE_NAMESPACE} get cluster ${name} -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}') != "True" ]]; then
112 function _is_control_plane_ready {
113 # Checking the Cluster resource status is not sufficient, it
114 # reports the control plane as ready before the nodes forming the
115 # control plane are ready
116 for yaml in ${SCRIPTDIR}/deployment/*.yaml; do
117 name=$(awk '/clusterName:/ {print $2}' ${yaml})
118 if [[ ! -z ${name} ]]; then
119 local replicas=$(kubectl -n ${SITE_NAMESPACE} get kubeadmcontrolplane ${name} -o jsonpath='{.spec.replicas}')
120 if [[ $(kubectl --kubeconfig=${BUILDDIR}/${name}-admin.conf get nodes -l node-role.kubernetes.io/control-plane -o jsonpath='{range .items[*]}{.status.conditions[?(@.type=="Ready")].status}{"\n"}{end}' | grep -c True) != ${replicas} ]]; then
127 function site_wait_for_all_ready {
128 WAIT_FOR_INTERVAL=60s
130 wait_for _is_cluster_ready
131 for yaml in ${SCRIPTDIR}/deployment/*.yaml; do
132 name=$(awk '/clusterName:/ {print $2}' ${yaml})
133 if [[ ! -z ${name} ]]; then
134 clusterctl -n ${SITE_NAMESPACE} get kubeconfig ${name} >${BUILDDIR}/${name}-admin.conf
135 chmod 600 ${BUILDDIR}/${name}-admin.conf
138 wait_for _is_control_plane_ready
141 function site_insert_control_plane_network_identity_into_ssh_config {
142 # This enables logging into the control plane machines from this
143 # machine without specifying the identify file on the command line
145 if [[ ! $(which ipcalc) ]]; then
146 apt-get install -y ipcalc
149 # Create ssh config if it doesn't exist
150 mkdir -p ${HOME}/.ssh && chmod 700 ${HOME}/.ssh
151 touch ${HOME}/.ssh/config
152 chmod 600 ${HOME}/.ssh/config
153 # Add the entry for the control plane network, host value in ssh
154 # config is a wildcard
155 for yaml in ${SCRIPTDIR}/deployment/*.yaml; do
156 name=$(awk '/name:/ {NAME=$2} /chart: deploy\/cluster/ {print NAME; exit}' ${yaml})
157 if [[ ! -z ${name} ]]; then
158 endpoint=$(helm -n ${SITE_NAMESPACE} get values -a ${name} | awk '/controlPlaneEndpoint:/ {print $2}')
159 prefix=$(helm -n ${SITE_NAMESPACE} get values -a ${name} | awk '/controlPlanePrefix:/ {print $2}')
160 host=$(ipcalc ${endpoint}/${prefix} | awk '/Network:/ {sub(/\.0.*/,".*"); print $2}')
161 if [[ $(grep -c "Host ${host}" ${HOME}/.ssh/config) != 0 ]]; then
162 sed -i -e '/Host '"${host}"'/,+3 d' ${HOME}/.ssh/config
164 cat <<EOF >>${HOME}/.ssh/config
166 IdentityFile ${SCRIPTDIR}/id_rsa
167 StrictHostKeyChecking no
168 UserKnownHostsFile /dev/null
172 # Add the identity to authorized keys on this host to enable ssh
173 # logins via its control plane address
174 authorized_key=$(cat ${SCRIPTDIR}/id_rsa.pub)
175 sed -i -e '\!'"${authorized_key}"'!d' ${HOME}/.ssh/authorized_keys
176 cat ${SCRIPTDIR}/id_rsa.pub >> ~/.ssh/authorized_keys
179 function _is_cluster_deleted {
180 for yaml in ${SCRIPTDIR}/deployment/*.yaml; do
181 name=$(awk '/clusterName:/ {print $2}' ${yaml})
182 if [[ ! -z ${name} ]]; then
183 if kubectl -n ${SITE_NAMESPACE} get cluster ${name}; then
190 function site_wait_for_all_deleted {
191 WAIT_FOR_INTERVAL=60s
193 wait_for _is_cluster_deleted