From d8eefee1236290e8a27a89dab7ec4b508fc72fd7 Mon Sep 17 00:00:00 2001 From: hashfyre Date: Wed, 10 Jan 2018 16:58:04 +0530 Subject: [PATCH 1/5] code-sanity --- update.sh | 88 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 45 insertions(+), 43 deletions(-) diff --git a/update.sh b/update.sh index 9a213fd..b4be9d6 100755 --- a/update.sh +++ b/update.sh @@ -1,69 +1,71 @@ #!/bin/bash set -euo pipefail -if [ ! -z ${PLUGIN_KUBERNETES_USER} ]; then - KUBERNETES_USER=${PLUGIN_KUBERNETES_USER:-default} +# check optional params +if [ ! -z ${PLUGIN_USER} ]; then + USER=${PLUGIN_USER:-default} fi -if [ ! -z ${PLUGIN_KUBERNETES_ENV} ]; then - KUBERNETES_ENV=${PLUGIN_KUBERNETES_ENV} +if [ ! -z ${PLUGIN_NAMESPACE} ]; then + NAMESPACE=${PLUGIN_NAMESPACE:-default} +fi - KUBERNETES_SERVER_VAR=KUBERNETES_SERVER_${KUBERNETES_ENV} - KUBERNETES_CERT_VAR=KUBERNETES_SERVER_CERT_${KUBERNETES_ENV} +# check required params +if [ ! -z ${PLUGIN_CLUSTER} ]; then + CLUSTER=${PLUGIN_CLUSTER} - KUBERNETES_SERVER=${!KUBERNETES_SERVER_VAR} - KUBERNETES_CERT=${!KUBERNETES_CERT_VAR} + SERVER_URL_VAR=SERVER_URL_${CLUSTER} + SERVER_CERT_VAR=SERVER_CERT_${CLUSTER} + CLIENT_CERT_VAR=CLIENT_CERT_${CLUSTER} + CLIENT_KEY_VAR=CLIENT_KEY_${CLUSTER} - if [[ -z "${KUBERNETES_SERVER}" ]]; then - echo "ERROR: drone secret ${KUBERNETES_SERVER_VAR} not added!" + SERVER_URL=${!SERVER_URL_VAR} + SERVER_CERT=${!SERVER_CERT_VAR} + CLIENT_CERT=${!CLIENT_CERT_VAR} + CLIENT_KEY=${!CLIENT_KEY_VAR} + + if [[ -z "${SERVER_URL}" ]]; then + echo "[ERROR] drone secret: ${SERVER_URL_VAR} not added!" exit 1 fi - if [[ -z "${KUBERNETES_CERT}" ]]; then - echo "ERROR: drone secret ${KUBERNETES_CERT_VAR} not added!" - echo "Inscure connection to the cluster will be used." + if [[ ! -z "${SERVER_CERT}" ]]; then + echo "[INFO] Using secure connection with tls-certificate." + echo ${SERVER_CERT} | base64 -d > ca.crt + kubectl config set-cluster default --server=${SERVER_URL} --certificate-authority=ca.crt + + if [[ ! -z "${CLIENT_CERT}" ]] && [[ ! -z "${CLIENT_KEY}" ]]; then + echo "[INFO] Setting client credentials with signed-certificate and key." + echo ${CLIENT_CERT} | base64 -d > client.crt + echo ${CLIENT_KEY} | base64 -d > client.key + kubectl config set-credentials ${USER} --client-certificate=client.crt --client-key=client.key + else + echo "[ERROR] Required plugin parameters:" + echo " - client_cert" + echo " - client_key" + echo "are not provided" + exit 1 + fi + else + echo "[WARNING] Required plugin parameter: ${SERVER_CERT_VAR} not added!" + echo "[WARNING] Using insecure connection to cluster" + kubectl config set-cluster default --server=${SERVER_URL} --insecure-skip-tls-verify=true fi else - echo "ERROR: kubernetes_env not provided" + echo "[ERROR] Required pipeline parameter: cluster not provided" exit 1 fi -if [ -z ${PLUGIN_NAMESPACE} ]; then - PLUGIN_NAMESPACE="default" -fi - -if [[ ! -z "${KUBERNETES_CLIENT_CERT}" ]] && [[ ! -z "${KUBERNETES_CLIENT_KEY}" ]]; then - echo "INFO: Setting client credentials with signed-certificate and key." - echo ${KUBERNETES_CLIENT_CERT} | base64 -d > client.crt - echo ${KUBERNETES_CLIENT_KEY} | base64 -d > client.key - kubectl config set-credentials ${KUBERNETES_USER} --client-certificate=client.crt --client-key=client.key -else - echo "ERROR: Provide the following authentication params:" - echo " - kubernetes_client_cert" - echo " - kubernetes_client_key" - echo "as drone secrets" - exit 1 -fi - -if [ ! -z "${KUBERNETES_CERT}" ]; then - echo "INFO: Using secure connection with tls-certificate." - echo ${KUBERNETES_CERT} | base64 -d > ca.crt - kubectl config set-cluster default --server=${KUBERNETES_SERVER} --certificate-authority=ca.crt -else - echo "WARNING: Using insecure connection to cluster" - kubectl config set-cluster default --server=${KUBERNETES_SERVER} --insecure-skip-tls-verify=true -fi - -kubectl config set-context default --cluster=default --user=${KUBERNETES_USER} +kubectl config set-context default --cluster=default --user=${USER} kubectl config use-context default # kubectl version IFS=',' read -r -a DEPLOYMENTS <<< "${PLUGIN_DEPLOYMENT}" IFS=',' read -r -a CONTAINERS <<< "${PLUGIN_CONTAINER}" for DEPLOY in ${DEPLOYMENTS[@]}; do - echo Deploying to ${KUBERNETES_ENV} + echo Deploying to ${CLUSTER} for CONTAINER in ${CONTAINERS[@]}; do - kubectl -n ${PLUGIN_NAMESPACE} set image deployment/${DEPLOY} \ + kubectl -n ${NAMESPACE} set image deployment/${DEPLOY} \ ${CONTAINER}="${PLUGIN_REPO}:${PLUGIN_TAG}" --record done done From 0fe0fc584f44ab3f857992313b508cb066737700 Mon Sep 17 00:00:00 2001 From: hashfyre Date: Wed, 10 Jan 2018 17:29:56 +0530 Subject: [PATCH 2/5] dockerfile: single run --- Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 86eb979..c6b2222 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ FROM alpine:3.4 -RUN apk --no-cache add curl ca-certificates bash -RUN curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl -RUN chmod +x /usr/local/bin/kubectl +RUN apk --no-cache add curl ca-certificates bash && \ + curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && \ + chmod +x /usr/local/bin/kubectl COPY update.sh /bin/ ENTRYPOINT ["/bin/bash"] CMD ["/bin/update.sh"] From 1e439538874a58c2beb44dc7f67781cd7f35904e Mon Sep 17 00:00:00 2001 From: hashfyre Date: Wed, 10 Jan 2018 17:30:40 +0530 Subject: [PATCH 3/5] script: ucase cluster --- update.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/update.sh b/update.sh index b4be9d6..6d06a96 100755 --- a/update.sh +++ b/update.sh @@ -12,13 +12,16 @@ fi # check required params if [ ! -z ${PLUGIN_CLUSTER} ]; then - CLUSTER=${PLUGIN_CLUSTER} + # convert cluster name to ucase and assign + CLUSTER=${PLUGIN_CLUSTER^^} + # create dynamic cert var names SERVER_URL_VAR=SERVER_URL_${CLUSTER} SERVER_CERT_VAR=SERVER_CERT_${CLUSTER} CLIENT_CERT_VAR=CLIENT_CERT_${CLUSTER} CLIENT_KEY_VAR=CLIENT_KEY_${CLUSTER} + # expand the var contents SERVER_URL=${!SERVER_URL_VAR} SERVER_CERT=${!SERVER_CERT_VAR} CLIENT_CERT=${!CLIENT_CERT_VAR} From 99ea3d19d5bb6b40e6c6211e1b8cbafb23614590 Mon Sep 17 00:00:00 2001 From: hashfyre Date: Wed, 10 Jan 2018 17:30:49 +0530 Subject: [PATCH 4/5] readme: update --- README.md | 176 +++++++++++++++++------------------------------------- 1 file changed, 56 insertions(+), 120 deletions(-) diff --git a/README.md b/README.md index a47fd03..2669c4b 100644 --- a/README.md +++ b/README.md @@ -1,140 +1,76 @@ -# Kubernetes plugin for drone.io [![Docker Repository on Quay](https://quay.io/repository/honestbee/drone-kubernetes/status "Docker Repository on Quay")](https://quay.io/repository/honestbee/drone-kubernetes) +# Kubernetes plugin for drone.io [![Docker Repository on Docker Cloud](https://cloud.docker.com/app/razorpay/repository/docker/razorpay/drone-kubernetes) +## Borrowed and distilled from [honestbee/drone-kubernetes](https://github.com/honestbee/drone-kubernetes) This plugin allows to update a Kubernetes deployment. + - Cert based auth for tls + - Insecure auth without tls + +This version deprecates token based auth ## Usage This pipeline will update the `my-deployment` deployment with the image tagged `DRONE_COMMIT_SHA:0:8` ```yaml - pipeline: - deploy: - image: quay.io/honestbee/drone-kubernetes - deployment: my-deployment - repo: myorg/myrepo - container: my-container - tag: - - mytag - - latest +pipeline: + deploy: + image: razorpay/drone-kubernetes + pull: true + secrets: + - docker_username + - docker_password + - server_url_ + - server_cert_ + - client_cert_ + - client_key_ + - ... + user: + cluster: + deployment: [] + repo: + container: [ ] + namespace: + tag: + - ${DRONE_REPO_BRANCH}-${DRONE_COMMIT_SHA} + - ... + when: + environment: + branch: [ ,... ] + event: + exclude: [push, pull_request, tag] + include: [deployment] ``` -Deploying containers across several deployments, eg in a scheduler-worker setup. Make sure your container `name` in your manifest is the same for each pod. - -```yaml - pipeline: - deploy: - image: quay.io/honestbee/drone-kubernetes - deployment: [server-deploy, worker-deploy] - repo: myorg/myrepo - container: my-container - tag: - - mytag - - latest -``` - -Deploying multiple containers within the same deployment. - -```yaml - pipeline: - deploy: - image: quay.io/honestbee/drone-kubernetes - deployment: my-deployment - repo: myorg/myrepo - container: [container1, container2] - tag: - - mytag - - latest -``` - -**NOTE**: Combining multi container deployments across multiple deployments is not recommended - -This more complex example demonstrates how to deploy to several environments based on the branch, in a `app` namespace - -```yaml - pipeline: - deploy-qa: - image: quay.io/honestbee/drone-kubernetes - kubernetes_user: ${KUBERNETES_USER} - kubernetes_server: ${KUBERNETES_SERVER_QA} - kubernetes_cert: ${KUBERNETES_CERT_QA} - kubernetes_client_cert: ${PLUGIN_KUBERNETES_CLIENT_CERT} - kubernetes_client_key: ${PLUGIN_KUBERNETES_CLIENT_KEY} - deployment: my-deployment - repo: myorg/myrepo - container: my-container - namespace: app - tag: - - mytag - - latest - when: - branch: [ qa ] - - deploy-staging: - image: quay.io/honestbee/drone-kubernetes - kubernetes_user: ${KUBERNETES_USER} - kubernetes_server: ${KUBERNETES_SERVER_STAGING} - kubernetes_cert: ${KUBERNETES_CERT_STAGING} - kubernetes_token: ${KUBERNETES_TOKEN_STAGING} - deployment: my-deployment - repo: myorg/myrepo - container: my-container - namespace: app - tag: - - mytag - - latest - when: - branch: [ staging ] - - deploy-prod: - image: quay.io/honestbee/drone-kubernetes - kubernetes_server: ${KUBERNETES_SERVER_PROD} - kubernetes_token: ${KUBERNETES_TOKEN_PROD} - # notice: no tls verification will be done, warning will is printed - deployment: my-deployment - repo: myorg/myrepo - container: my-container - namespace: app - tag: - - mytag - - latest - when: - branch: [ master ] -``` ## Required secrets -```bash - drone secret add --image=honestbee/drone-kubernetes \ - your-user/your-repo KUBERNETES_SERVER https://mykubernetesapiserver - - drone secret add --image=honestbee/drone-kubernetes \ - your-user/your-repo KUBERNETES_CERT - - drone secret add --image=honestbee/drone-kubernetes \ - your-user/your-repo KUBERNETES_TOKEN eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJ... -``` + - server_url + - tls: + - server_cert + - `kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.crt:' > ca.crt` + - `kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.key:' > ca.key` + - client_cert + - client_key + - ``` + openssl genrsa -out client.key + openssl req -new -key client.key -out client.csr -subj "/CN=drone/O=org" + openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 500 + ``` + - ``` + cat ca.crt | base64 > car.crt.enc + cat client.crt | base64 > client.crt.enc + cat client.key | base64 > client.key.enc + ``` + - ``` + drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name server_url_ -value https://k8s.org.com.:443 + drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name server_cert_ -value @./ca.crt.enc + drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name client_cert_ -value @./client.crt.enc + drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name client_key_ -value @./client.key.enc + ``` When using TLS Verification, ensure Server Certificate used by kubernetes API server is signed for SERVER url ( could be a reason for failures if using aliases of kubernetes cluster ) -## How to get token -1. After deployment inspect you pod for name of (k8s) secret with **token** and **ca.crt** -```bash -kubectl describe po/[ your pod name ] | grep SecretName | grep token -``` -(When you use **default service account**) - -2. Get data from you (k8s) secret -```bash -kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.crt:|token:' -``` -3. Copy-paste contents of ca.crt into your drone's **KUBERNETES_CERT** secret -4. Decode base64 encoded token -```bash -echo [ your k8s base64 encoded token ] | base64 -d && echo'' -``` -5. Copy-paste decoded token into your drone's **KUBERNETES_TOKEN** secret - ### RBAC When using a version of kubernetes with RBAC (role-based access control) From 78e44f22aaf1acfc795f945ebf332ba62ecc4692 Mon Sep 17 00:00:00 2001 From: hashfyre Date: Wed, 10 Jan 2018 17:39:49 +0530 Subject: [PATCH 5/5] fix badge --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 2669c4b..b616d33 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# Kubernetes plugin for drone.io [![Docker Repository on Docker Cloud](https://cloud.docker.com/app/razorpay/repository/docker/razorpay/drone-kubernetes) +# Kubernetes plugin for drone.io [Docker Repository on Docker Cloud](https://cloud.docker.com/app/razorpay/repository/docker/razorpay/drone-kubernetes) ## Borrowed and distilled from [honestbee/drone-kubernetes](https://github.com/honestbee/drone-kubernetes) This plugin allows to update a Kubernetes deployment.