mirror of
https://github.com/honestbee/drone-kubernetes.git
synced 2025-11-04 09:18:05 +00:00
Merge 78e44f22aa into b71e43dc6d
This commit is contained in:
Hashfyre
GitHub
commit
f74a7c7e37
4 changed files with 118 additions and 128 deletions
2
.gitignore
vendored
Normal file
2
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
.DS_STORE
|
||||
tmp
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
FROM alpine:3.4
|
||||
RUN apk --no-cache add curl ca-certificates bash
|
||||
RUN curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
|
||||
RUN chmod +x /usr/local/bin/kubectl
|
||||
RUN apk --no-cache add curl ca-certificates bash && \
|
||||
curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && \
|
||||
chmod +x /usr/local/bin/kubectl
|
||||
COPY update.sh /bin/
|
||||
ENTRYPOINT ["/bin/bash"]
|
||||
CMD ["/bin/update.sh"]
|
||||
|
|
|
|||
158
README.md
158
README.md
|
|
@ -1,122 +1,76 @@
|
|||
# Kubernetes plugin for drone.io [](https://quay.io/repository/honestbee/drone-kubernetes)
|
||||
# Kubernetes plugin for drone.io [Docker Repository on Docker Cloud](https://cloud.docker.com/app/razorpay/repository/docker/razorpay/drone-kubernetes)
|
||||
## Borrowed and distilled from [honestbee/drone-kubernetes](https://github.com/honestbee/drone-kubernetes)
|
||||
|
||||
This plugin allows to update a Kubernetes deployment.
|
||||
- Cert based auth for tls
|
||||
- Insecure auth without tls
|
||||
|
||||
This version deprecates token based auth
|
||||
|
||||
## Usage
|
||||
|
||||
This pipeline will update the `my-deployment` deployment with the image tagged `DRONE_COMMIT_SHA:0:8`
|
||||
|
||||
```yaml
|
||||
pipeline:
|
||||
deploy:
|
||||
image: quay.io/honestbee/drone-kubernetes
|
||||
deployment: my-deployment
|
||||
repo: myorg/myrepo
|
||||
container: my-container
|
||||
tag:
|
||||
- mytag
|
||||
- latest
|
||||
pipeline:
|
||||
deploy:
|
||||
image: razorpay/drone-kubernetes
|
||||
pull: true
|
||||
secrets:
|
||||
- docker_username
|
||||
- docker_password
|
||||
- server_url_<cluster>
|
||||
- server_cert_<cluster>
|
||||
- client_cert_<cluster>
|
||||
- client_key_<cluster>
|
||||
- ...
|
||||
user: <kubernetes-user with a cluster-rolebinding>
|
||||
cluster: <kubernetes-cluster>
|
||||
deployment: [<kubernetes-deployements, ...>]
|
||||
repo: <org/repo>
|
||||
container: [ <containers,...> ]
|
||||
namespace: <kubernetes-namespace>
|
||||
tag:
|
||||
- ${DRONE_REPO_BRANCH}-${DRONE_COMMIT_SHA}
|
||||
- ...
|
||||
when:
|
||||
environment: <kubernetes-cluster>
|
||||
branch: [ <branches>,... ]
|
||||
event:
|
||||
exclude: [push, pull_request, tag]
|
||||
include: [deployment]
|
||||
```
|
||||
|
||||
Deploying containers across several deployments, eg in a scheduler-worker setup. Make sure your container `name` in your manifest is the same for each pod.
|
||||
|
||||
```yaml
|
||||
pipeline:
|
||||
deploy:
|
||||
image: quay.io/honestbee/drone-kubernetes
|
||||
deployment: [server-deploy, worker-deploy]
|
||||
repo: myorg/myrepo
|
||||
container: my-container
|
||||
tag:
|
||||
- mytag
|
||||
- latest
|
||||
```
|
||||
|
||||
Deploying multiple containers within the same deployment.
|
||||
|
||||
```yaml
|
||||
pipeline:
|
||||
deploy:
|
||||
image: quay.io/honestbee/drone-kubernetes
|
||||
deployment: my-deployment
|
||||
repo: myorg/myrepo
|
||||
container: [container1, container2]
|
||||
tag:
|
||||
- mytag
|
||||
- latest
|
||||
```
|
||||
|
||||
**NOTE**: Combining multi container deployments across multiple deployments is not recommended
|
||||
|
||||
This more complex example demonstrates how to deploy to several environments based on the branch, in a `app` namespace
|
||||
|
||||
```yaml
|
||||
pipeline:
|
||||
deploy-staging:
|
||||
image: quay.io/honestbee/drone-kubernetes
|
||||
kubernetes_server: ${KUBERNETES_SERVER_STAGING}
|
||||
kubernetes_cert: ${KUBERNETES_CERT_STAGING}
|
||||
kubernetes_token: ${KUBERNETES_TOKEN_STAGING}
|
||||
deployment: my-deployment
|
||||
repo: myorg/myrepo
|
||||
container: my-container
|
||||
namespace: app
|
||||
tag:
|
||||
- mytag
|
||||
- latest
|
||||
when:
|
||||
branch: [ staging ]
|
||||
|
||||
deploy-prod:
|
||||
image: quay.io/honestbee/drone-kubernetes
|
||||
kubernetes_server: ${KUBERNETES_SERVER_PROD}
|
||||
kubernetes_token: ${KUBERNETES_TOKEN_PROD}
|
||||
# notice: no tls verification will be done, warning will is printed
|
||||
deployment: my-deployment
|
||||
repo: myorg/myrepo
|
||||
container: my-container
|
||||
namespace: app
|
||||
tag:
|
||||
- mytag
|
||||
- latest
|
||||
when:
|
||||
branch: [ master ]
|
||||
```
|
||||
|
||||
## Required secrets
|
||||
|
||||
```bash
|
||||
drone secret add --image=honestbee/drone-kubernetes \
|
||||
your-user/your-repo KUBERNETES_SERVER https://mykubernetesapiserver
|
||||
|
||||
drone secret add --image=honestbee/drone-kubernetes \
|
||||
your-user/your-repo KUBERNETES_CERT <base64 encoded CA.crt>
|
||||
|
||||
drone secret add --image=honestbee/drone-kubernetes \
|
||||
your-user/your-repo KUBERNETES_TOKEN eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJ...
|
||||
```
|
||||
- server_url
|
||||
- tls:
|
||||
- server_cert
|
||||
- `kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.crt:' > ca.crt`
|
||||
- `kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.key:' > ca.key`
|
||||
- client_cert
|
||||
- client_key
|
||||
- ```
|
||||
openssl genrsa -out client.key
|
||||
openssl req -new -key client.key -out client.csr -subj "/CN=drone/O=org"
|
||||
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 500
|
||||
```
|
||||
- ```
|
||||
cat ca.crt | base64 > car.crt.enc
|
||||
cat client.crt | base64 > client.crt.enc
|
||||
cat client.key | base64 > client.key.enc
|
||||
```
|
||||
- ```
|
||||
drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name server_url_<cluster> -value https://k8s.org.com.:443
|
||||
drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name server_cert_<cluster> -value @./ca.crt.enc
|
||||
drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name client_cert_<cluster> -value @./client.crt.enc
|
||||
drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name client_key_<cluster> -value @./client.key.enc
|
||||
```
|
||||
|
||||
When using TLS Verification, ensure Server Certificate used by kubernetes API server
|
||||
is signed for SERVER url ( could be a reason for failures if using aliases of kubernetes cluster )
|
||||
|
||||
## How to get token
|
||||
1. After deployment inspect you pod for name of (k8s) secret with **token** and **ca.crt**
|
||||
```bash
|
||||
kubectl describe po/[ your pod name ] | grep SecretName | grep token
|
||||
```
|
||||
(When you use **default service account**)
|
||||
|
||||
2. Get data from you (k8s) secret
|
||||
```bash
|
||||
kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.crt:|token:'
|
||||
```
|
||||
3. Copy-paste contents of ca.crt into your drone's **KUBERNETES_CERT** secret
|
||||
4. Decode base64 encoded token
|
||||
```bash
|
||||
echo [ your k8s base64 encoded token ] | base64 -d && echo''
|
||||
```
|
||||
5. Copy-paste decoded token into your drone's **KUBERNETES_TOKEN** secret
|
||||
|
||||
### RBAC
|
||||
|
||||
When using a version of kubernetes with RBAC (role-based access control)
|
||||
|
|
|
|||
74
update.sh
74
update.sh
|
|
@ -1,40 +1,74 @@
|
|||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
if [ -z ${PLUGIN_NAMESPACE} ]; then
|
||||
PLUGIN_NAMESPACE="default"
|
||||
# check optional params
|
||||
if [ ! -z ${PLUGIN_USER} ]; then
|
||||
USER=${PLUGIN_USER:-default}
|
||||
fi
|
||||
|
||||
if [ ! -z ${PLUGIN_KUBERNETES_TOKEN} ]; then
|
||||
KUBERNETES_TOKEN=$PLUGIN_KUBERNETES_TOKEN
|
||||
if [ ! -z ${PLUGIN_NAMESPACE} ]; then
|
||||
NAMESPACE=${PLUGIN_NAMESPACE:-default}
|
||||
fi
|
||||
|
||||
if [ ! -z ${PLUGIN_KUBERNETES_SERVER} ]; then
|
||||
KUBERNETES_SERVER=$PLUGIN_KUBERNETES_SERVER
|
||||
fi
|
||||
# check required params
|
||||
if [ ! -z ${PLUGIN_CLUSTER} ]; then
|
||||
# convert cluster name to ucase and assign
|
||||
CLUSTER=${PLUGIN_CLUSTER^^}
|
||||
|
||||
if [ ! -z ${PLUGIN_KUBERNETES_CERT} ]; then
|
||||
KUBERNETES_CERT=${PLUGIN_KUBERNETES_CERT}
|
||||
fi
|
||||
# create dynamic cert var names
|
||||
SERVER_URL_VAR=SERVER_URL_${CLUSTER}
|
||||
SERVER_CERT_VAR=SERVER_CERT_${CLUSTER}
|
||||
CLIENT_CERT_VAR=CLIENT_CERT_${CLUSTER}
|
||||
CLIENT_KEY_VAR=CLIENT_KEY_${CLUSTER}
|
||||
|
||||
kubectl config set-credentials default --token=${KUBERNETES_TOKEN}
|
||||
if [ ! -z ${KUBERNETES_CERT} ]; then
|
||||
echo ${KUBERNETES_CERT} | base64 -d > ca.crt
|
||||
kubectl config set-cluster default --server=${KUBERNETES_SERVER} --certificate-authority=ca.crt
|
||||
# expand the var contents
|
||||
SERVER_URL=${!SERVER_URL_VAR}
|
||||
SERVER_CERT=${!SERVER_CERT_VAR}
|
||||
CLIENT_CERT=${!CLIENT_CERT_VAR}
|
||||
CLIENT_KEY=${!CLIENT_KEY_VAR}
|
||||
|
||||
if [[ -z "${SERVER_URL}" ]]; then
|
||||
echo "[ERROR] drone secret: ${SERVER_URL_VAR} not added!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -z "${SERVER_CERT}" ]]; then
|
||||
echo "[INFO] Using secure connection with tls-certificate."
|
||||
echo ${SERVER_CERT} | base64 -d > ca.crt
|
||||
kubectl config set-cluster default --server=${SERVER_URL} --certificate-authority=ca.crt
|
||||
|
||||
if [[ ! -z "${CLIENT_CERT}" ]] && [[ ! -z "${CLIENT_KEY}" ]]; then
|
||||
echo "[INFO] Setting client credentials with signed-certificate and key."
|
||||
echo ${CLIENT_CERT} | base64 -d > client.crt
|
||||
echo ${CLIENT_KEY} | base64 -d > client.key
|
||||
kubectl config set-credentials ${USER} --client-certificate=client.crt --client-key=client.key
|
||||
else
|
||||
echo "[ERROR] Required plugin parameters:"
|
||||
echo " - client_cert"
|
||||
echo " - client_key"
|
||||
echo "are not provided"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "[WARNING] Required plugin parameter: ${SERVER_CERT_VAR} not added!"
|
||||
echo "[WARNING] Using insecure connection to cluster"
|
||||
kubectl config set-cluster default --server=${SERVER_URL} --insecure-skip-tls-verify=true
|
||||
fi
|
||||
else
|
||||
echo "WARNING: Using insecure connection to cluster"
|
||||
kubectl config set-cluster default --server=${KUBERNETES_SERVER} --insecure-skip-tls-verify=true
|
||||
echo "[ERROR] Required pipeline parameter: cluster not provided"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
kubectl config set-context default --cluster=default --user=default
|
||||
kubectl config set-context default --cluster=default --user=${USER}
|
||||
kubectl config use-context default
|
||||
|
||||
# kubectl version
|
||||
IFS=',' read -r -a DEPLOYMENTS <<< "${PLUGIN_DEPLOYMENT}"
|
||||
IFS=',' read -r -a CONTAINERS <<< "${PLUGIN_CONTAINER}"
|
||||
for DEPLOY in ${DEPLOYMENTS[@]}; do
|
||||
echo Deploying to $KUBERNETES_SERVER
|
||||
echo Deploying to ${CLUSTER}
|
||||
for CONTAINER in ${CONTAINERS[@]}; do
|
||||
kubectl -n ${PLUGIN_NAMESPACE} set image deployment/${DEPLOY} \
|
||||
${CONTAINER}=${PLUGIN_REPO}:${PLUGIN_TAG} --record
|
||||
kubectl -n ${NAMESPACE} set image deployment/${DEPLOY} \
|
||||
${CONTAINER}="${PLUGIN_REPO}:${PLUGIN_TAG}" --record
|
||||
done
|
||||
done
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue