diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1caa81d --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +.DS_STORE +tmp diff --git a/Dockerfile b/Dockerfile index 86eb979..c6b2222 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ FROM alpine:3.4 -RUN apk --no-cache add curl ca-certificates bash -RUN curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl -RUN chmod +x /usr/local/bin/kubectl +RUN apk --no-cache add curl ca-certificates bash && \ + curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && \ + chmod +x /usr/local/bin/kubectl COPY update.sh /bin/ ENTRYPOINT ["/bin/bash"] CMD ["/bin/update.sh"] diff --git a/README.md b/README.md index 8ec9b97..b616d33 100644 --- a/README.md +++ b/README.md @@ -1,122 +1,76 @@ -# Kubernetes plugin for drone.io [![Docker Repository on Quay](https://quay.io/repository/honestbee/drone-kubernetes/status "Docker Repository on Quay")](https://quay.io/repository/honestbee/drone-kubernetes) +# Kubernetes plugin for drone.io [Docker Repository on Docker Cloud](https://cloud.docker.com/app/razorpay/repository/docker/razorpay/drone-kubernetes) +## Borrowed and distilled from [honestbee/drone-kubernetes](https://github.com/honestbee/drone-kubernetes) This plugin allows to update a Kubernetes deployment. + - Cert based auth for tls + - Insecure auth without tls -## Usage +This version deprecates token based auth + +## Usage This pipeline will update the `my-deployment` deployment with the image tagged `DRONE_COMMIT_SHA:0:8` ```yaml - pipeline: - deploy: - image: quay.io/honestbee/drone-kubernetes - deployment: my-deployment - repo: myorg/myrepo - container: my-container - tag: - - mytag - - latest +pipeline: + deploy: + image: razorpay/drone-kubernetes + pull: true + secrets: + - docker_username + - docker_password + - server_url_ + - server_cert_ + - client_cert_ + - client_key_ + - ... + user: + cluster: + deployment: [] + repo: + container: [ ] + namespace: + tag: + - ${DRONE_REPO_BRANCH}-${DRONE_COMMIT_SHA} + - ... + when: + environment: + branch: [ ,... ] + event: + exclude: [push, pull_request, tag] + include: [deployment] ``` -Deploying containers across several deployments, eg in a scheduler-worker setup. Make sure your container `name` in your manifest is the same for each pod. - -```yaml - pipeline: - deploy: - image: quay.io/honestbee/drone-kubernetes - deployment: [server-deploy, worker-deploy] - repo: myorg/myrepo - container: my-container - tag: - - mytag - - latest -``` - -Deploying multiple containers within the same deployment. - -```yaml - pipeline: - deploy: - image: quay.io/honestbee/drone-kubernetes - deployment: my-deployment - repo: myorg/myrepo - container: [container1, container2] - tag: - - mytag - - latest -``` - -**NOTE**: Combining multi container deployments across multiple deployments is not recommended - -This more complex example demonstrates how to deploy to several environments based on the branch, in a `app` namespace - -```yaml - pipeline: - deploy-staging: - image: quay.io/honestbee/drone-kubernetes - kubernetes_server: ${KUBERNETES_SERVER_STAGING} - kubernetes_cert: ${KUBERNETES_CERT_STAGING} - kubernetes_token: ${KUBERNETES_TOKEN_STAGING} - deployment: my-deployment - repo: myorg/myrepo - container: my-container - namespace: app - tag: - - mytag - - latest - when: - branch: [ staging ] - - deploy-prod: - image: quay.io/honestbee/drone-kubernetes - kubernetes_server: ${KUBERNETES_SERVER_PROD} - kubernetes_token: ${KUBERNETES_TOKEN_PROD} - # notice: no tls verification will be done, warning will is printed - deployment: my-deployment - repo: myorg/myrepo - container: my-container - namespace: app - tag: - - mytag - - latest - when: - branch: [ master ] -``` ## Required secrets -```bash - drone secret add --image=honestbee/drone-kubernetes \ - your-user/your-repo KUBERNETES_SERVER https://mykubernetesapiserver + - server_url + - tls: + - server_cert + - `kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.crt:' > ca.crt` + - `kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.key:' > ca.key` + - client_cert + - client_key + - ``` + openssl genrsa -out client.key + openssl req -new -key client.key -out client.csr -subj "/CN=drone/O=org" + openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 500 + ``` + - ``` + cat ca.crt | base64 > car.crt.enc + cat client.crt | base64 > client.crt.enc + cat client.key | base64 > client.key.enc + ``` + - ``` + drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name server_url_ -value https://k8s.org.com.:443 + drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name server_cert_ -value @./ca.crt.enc + drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name client_cert_ -value @./client.crt.enc + drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name client_key_ -value @./client.key.enc + ``` - drone secret add --image=honestbee/drone-kubernetes \ - your-user/your-repo KUBERNETES_CERT - - drone secret add --image=honestbee/drone-kubernetes \ - your-user/your-repo KUBERNETES_TOKEN eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJ... -``` - -When using TLS Verification, ensure Server Certificate used by kubernetes API server +When using TLS Verification, ensure Server Certificate used by kubernetes API server is signed for SERVER url ( could be a reason for failures if using aliases of kubernetes cluster ) -## How to get token -1. After deployment inspect you pod for name of (k8s) secret with **token** and **ca.crt** -```bash -kubectl describe po/[ your pod name ] | grep SecretName | grep token -``` -(When you use **default service account**) - -2. Get data from you (k8s) secret -```bash -kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.crt:|token:' -``` -3. Copy-paste contents of ca.crt into your drone's **KUBERNETES_CERT** secret -4. Decode base64 encoded token -```bash -echo [ your k8s base64 encoded token ] | base64 -d && echo'' -``` -5. Copy-paste decoded token into your drone's **KUBERNETES_TOKEN** secret - ### RBAC When using a version of kubernetes with RBAC (role-based access control) @@ -171,7 +125,7 @@ kubectl -n web get secrets kubectl -n web get secret/drone-deploy-token-XXXXX -o yaml | egrep 'ca.crt:|token:' ``` -## To do +## To do Replace the current kubectl bash script with a go implementation. diff --git a/update.sh b/update.sh index 98df6a9..6d06a96 100755 --- a/update.sh +++ b/update.sh @@ -1,40 +1,74 @@ #!/bin/bash +set -euo pipefail -if [ -z ${PLUGIN_NAMESPACE} ]; then - PLUGIN_NAMESPACE="default" +# check optional params +if [ ! -z ${PLUGIN_USER} ]; then + USER=${PLUGIN_USER:-default} fi -if [ ! -z ${PLUGIN_KUBERNETES_TOKEN} ]; then - KUBERNETES_TOKEN=$PLUGIN_KUBERNETES_TOKEN +if [ ! -z ${PLUGIN_NAMESPACE} ]; then + NAMESPACE=${PLUGIN_NAMESPACE:-default} fi -if [ ! -z ${PLUGIN_KUBERNETES_SERVER} ]; then - KUBERNETES_SERVER=$PLUGIN_KUBERNETES_SERVER -fi +# check required params +if [ ! -z ${PLUGIN_CLUSTER} ]; then + # convert cluster name to ucase and assign + CLUSTER=${PLUGIN_CLUSTER^^} -if [ ! -z ${PLUGIN_KUBERNETES_CERT} ]; then - KUBERNETES_CERT=${PLUGIN_KUBERNETES_CERT} -fi + # create dynamic cert var names + SERVER_URL_VAR=SERVER_URL_${CLUSTER} + SERVER_CERT_VAR=SERVER_CERT_${CLUSTER} + CLIENT_CERT_VAR=CLIENT_CERT_${CLUSTER} + CLIENT_KEY_VAR=CLIENT_KEY_${CLUSTER} -kubectl config set-credentials default --token=${KUBERNETES_TOKEN} -if [ ! -z ${KUBERNETES_CERT} ]; then - echo ${KUBERNETES_CERT} | base64 -d > ca.crt - kubectl config set-cluster default --server=${KUBERNETES_SERVER} --certificate-authority=ca.crt + # expand the var contents + SERVER_URL=${!SERVER_URL_VAR} + SERVER_CERT=${!SERVER_CERT_VAR} + CLIENT_CERT=${!CLIENT_CERT_VAR} + CLIENT_KEY=${!CLIENT_KEY_VAR} + + if [[ -z "${SERVER_URL}" ]]; then + echo "[ERROR] drone secret: ${SERVER_URL_VAR} not added!" + exit 1 + fi + + if [[ ! -z "${SERVER_CERT}" ]]; then + echo "[INFO] Using secure connection with tls-certificate." + echo ${SERVER_CERT} | base64 -d > ca.crt + kubectl config set-cluster default --server=${SERVER_URL} --certificate-authority=ca.crt + + if [[ ! -z "${CLIENT_CERT}" ]] && [[ ! -z "${CLIENT_KEY}" ]]; then + echo "[INFO] Setting client credentials with signed-certificate and key." + echo ${CLIENT_CERT} | base64 -d > client.crt + echo ${CLIENT_KEY} | base64 -d > client.key + kubectl config set-credentials ${USER} --client-certificate=client.crt --client-key=client.key + else + echo "[ERROR] Required plugin parameters:" + echo " - client_cert" + echo " - client_key" + echo "are not provided" + exit 1 + fi + else + echo "[WARNING] Required plugin parameter: ${SERVER_CERT_VAR} not added!" + echo "[WARNING] Using insecure connection to cluster" + kubectl config set-cluster default --server=${SERVER_URL} --insecure-skip-tls-verify=true + fi else - echo "WARNING: Using insecure connection to cluster" - kubectl config set-cluster default --server=${KUBERNETES_SERVER} --insecure-skip-tls-verify=true + echo "[ERROR] Required pipeline parameter: cluster not provided" + exit 1 fi -kubectl config set-context default --cluster=default --user=default +kubectl config set-context default --cluster=default --user=${USER} kubectl config use-context default # kubectl version IFS=',' read -r -a DEPLOYMENTS <<< "${PLUGIN_DEPLOYMENT}" IFS=',' read -r -a CONTAINERS <<< "${PLUGIN_CONTAINER}" for DEPLOY in ${DEPLOYMENTS[@]}; do - echo Deploying to $KUBERNETES_SERVER + echo Deploying to ${CLUSTER} for CONTAINER in ${CONTAINERS[@]}; do - kubectl -n ${PLUGIN_NAMESPACE} set image deployment/${DEPLOY} \ - ${CONTAINER}=${PLUGIN_REPO}:${PLUGIN_TAG} --record + kubectl -n ${NAMESPACE} set image deployment/${DEPLOY} \ + ${CONTAINER}="${PLUGIN_REPO}:${PLUGIN_TAG}" --record done done