diff --git a/scripts/cert-manager/cluster-issuers/letsencrypt/README.md b/scripts/cert-manager/cluster-issuers/letsencrypt/README.md deleted file mode 100644 index 4f1dbc560..000000000 --- a/scripts/cert-manager/cluster-issuers/letsencrypt/README.md +++ /dev/null @@ -1,11 +0,0 @@ -# Lets Encrypt cluster issuer - -Scripts for managing secrets required by Flux to install Lets Encrypt cluster issuers. - -## Bootstrap - -Run script [`./bootstrap.sh`](./bootstrap.sh), see script header for more how. - -Bootstrap will -1. Create a Kubernetes secret with info required by Flux to install ACME cluster DNS01 issuer for Lets Encrypt - diff --git a/scripts/cert-manager/cluster-issuers/letsencrypt/bootstrap.sh b/scripts/cert-manager/cluster-issuers/letsencrypt/bootstrap.sh deleted file mode 100755 index 4a0bddce4..000000000 --- a/scripts/cert-manager/cluster-issuers/letsencrypt/bootstrap.sh +++ /dev/null @@ -1,203 +0,0 @@ -#!/usr/bin/env bash - - -####################################################################################### -### PURPOSE -### - -# Bootstrap secrets required by Flux to install cluster issuer for Lets Encrypt ACME dns01 - - -####################################################################################### -### PRECONDITIONS -### - -# - AKS cluster is available -# - User has role cluster-admin - - -####################################################################################### -### INPUTS -### - -# Required: -# - RADIX_ZONE_ENV : Path to *.env file -# - CLUSTER_NAME : Ex: "test-2", "weekly-93" - -# Optional: -# - USER_PROMPT : Is human interaction is required to run script? true/false. Default is true. -# - STAGING : Use Lets Encrypt staging api? true/false. Default is false. - - -####################################################################################### -### HOW TO USE -### - -# NORMAL -# RADIX_ZONE_ENV=../../../radix-zone/radix_zone_dev.env CLUSTER_NAME="weekly-2" ./bootstrap.sh - -# STAGING -# RADIX_ZONE_ENV=../../../radix-zone/radix_zone_dev.env CLUSTER_NAME="weekly-2" STAGING=true ./bootstrap.sh - -####################################################################################### -### START -### - -echo "" -echo "Start bootstrap of Lets Encrypt secrets for Flux... " - - -####################################################################################### -### Check for prerequisites binaries -### - -echo "" -printf "Check for necessary executables... " -hash kubectl 2> /dev/null || { echo -e "\nERROR: kubectl not found in PATH. Exiting..." >&2; exit 1; } -printf "All is good." -echo "" - - -####################################################################################### -### Read inputs and configs -### - -# Required inputs - -if [[ -z "$RADIX_ZONE_ENV" ]]; then - echo "ERROR: Please provide RADIX_ZONE_ENV" >&2 - exit 1 -else - if [[ ! -f "$RADIX_ZONE_ENV" ]]; then - echo "ERROR: RADIX_ZONE_ENV=$RADIX_ZONE_ENV is invalid, the file does not exist." >&2 - exit 1 - fi - source "$RADIX_ZONE_ENV" -fi - -if [[ -z "$CLUSTER_NAME" ]]; then - echo "ERROR: Please provide CLUSTER_NAME" >&2 - exit 1 -fi - -if [[ -z "$LETS_ENCRYPT_ACME_ACCOUNT_EMAIL" ]]; then - echo "ERROR: Please provide LETS_ENCRYPT_ACME_ACCOUNT_EMAIL" >&2 - exit 1 -fi - -# Source util scripts - -source ${RADIX_PLATFORM_REPOSITORY_PATH}/scripts/utility/util.sh - -# Optional inputs - -if [[ -z "$USER_PROMPT" ]]; then - USER_PROMPT=true -fi - -# Optional inputs - -if [[ -z "$USER_PROMPT" ]]; then - USER_PROMPT=true -fi - -if [[ -z "$STAGING" ]]; then - STAGING=false -fi - -# Script vars - -WORK_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" -if [[ $STAGING == false ]]; then - ACME_URL="https://acme-v02.api.letsencrypt.org/directory" -else - ACME_URL="https://acme-staging-v02.api.letsencrypt.org/directory" -fi - -####################################################################################### -### Prepare az session -### - -printf "Logging you in to Azure if not already logged in... " -az account show >/dev/null || az login >/dev/null -az account set --subscription "$AZ_SUBSCRIPTION_ID" >/dev/null -printf "Done.\n" - - -####################################################################################### -### Verify task at hand -### - -echo -e "" -echo -e "Bootstrap of Lets Encrypt secret for Flux will use the following configuration:" -echo -e "" -echo -e " > WHERE:" -echo -e " ------------------------------------------------------------------" -echo -e " - CLUSTER_NAME : $CLUSTER_NAME" -echo -e " - RADIX_ZONE : $RADIX_ZONE" -echo -e "" -echo -e " > WHAT:" -echo -e " -------------------------------------------------------------------" -echo -e " - ACME_URL : $ACME_URL" -echo -e " - LETS_ENCRYPT_ACME_ACCOUNT_EMAIL : $LETS_ENCRYPT_ACME_ACCOUNT_EMAIL" -echo -e "" -echo -e " > WHO:" -echo -e " -------------------------------------------------------------------" -echo -e " - AZ_SUBSCRIPTION : $(az account show --query name -otsv)" -echo -e " - AZ_USER : $(az account show --query user.name -o tsv)" -echo -e "" - -echo "" - -if [[ $USER_PROMPT == true ]]; then - while true; do - read -p "Is this correct? (Y/n) " yn - case $yn in - [Yy]* ) break;; - [Nn]* ) echo ""; echo "Quitting."; exit 0;; - * ) echo "Please answer yes or no.";; - esac - done - echo "" -fi - -####################################################################################### -### Connect kubectl -### - -# Exit if cluster does not exist -printf "Connecting kubectl..." -get_credentials "$AZ_RESOURCE_GROUP_CLUSTERS" "$CLUSTER_NAME" || { - # Send message to stderr - echo -e "ERROR: Cluster \"$CLUSTER_NAME\" not found." >&2 - exit 1 -} -printf "...Done.\n" - -####################################################################################### -### Verify cluster access -### -verify_cluster_access - -####################################################################################### -### Bootstrap Lets Encrypt secret for Flux -### - -printf "\nCreating secret for Flux...\n" - -# Create secret for flux - -cat </dev/null || { - echo -e "\nERROR: Azure-CLI not found in PATH. Exiting..." >&2 - exit 1 -} -hash kubectl 2>/dev/null || { - echo -e "\nERROR: kubectl not found in PATH. Exiting..." >&2 - exit 1 -} -hash jq 2>/dev/null || { - echo -e "\nERROR: jq not found in PATH. Exiting..." >&2 - exit 1 -} -printf "All is good." -echo "" - -####################################################################################### -### Read inputs and configs -### - -# Required inputs - -if [[ -z "$RADIX_ZONE_ENV" ]]; then - echo "ERROR: Please provide RADIX_ZONE_ENV" >&2 - exit 1 -else - if [[ ! -f "$RADIX_ZONE_ENV" ]]; then - echo "ERROR: RADIX_ZONE_ENV=$RADIX_ZONE_ENV is invalid, the file does not exist." >&2 - exit 1 - fi - source "$RADIX_ZONE_ENV" -fi - -if [[ -z "$CLUSTER_NAME" ]]; then - echo "ERROR: Please provide CLUSTER_NAME" >&2 - exit 1 -fi -# Source util scripts - -source ${RADIX_PLATFORM_REPOSITORY_PATH}/scripts/utility/util.sh - -####################################################################################### -### Prepare az session -### - -printf "Logging you in to Azure if not already logged in... " -az account show >/dev/null || az login >/dev/null -az account set --subscription "$AZ_SUBSCRIPTION_ID" >/dev/null -printf "Done.\n" - - -####################################################################################### -### Verify cluster access -### - -# Exit if cluster does not exist -printf "Connecting kubectl..." -get_credentials "$AZ_RESOURCE_GROUP_CLUSTERS" "$CLUSTER_NAME" || { - # Send message to stderr - echo -e "ERROR: Cluster \"$CLUSTER_NAME\" not found." >&2 - exit 0 -} -printf "...Done.\n" - -verify_cluster_access - -printf "Installing registry sp secret in k8s cluster...\n" - -az keyvault secret download \ - --vault-name "$AZ_RESOURCE_KEYVAULT" \ - --name "radix-cr-cicd" \ - --file sp_credentials.json - -# create secret for authenticating to ACR via az cli -# kubectl create secret generic radix-sp-acr-azure --from-file=sp_credentials.json --dry-run=client -o yaml | kubectl apply -f - - -# create secret for authenticating to ACR via buildah client (same value as other ACR secret) -# username="$(jq .id sp_credentials.json --raw-output)" -# password="$(jq .password sp_credentials.json --raw-output)" -# kubectl create secret generic radix-sp-buildah-azure \ -# --from-literal=username=$username \ -# --from-literal=password=$password \ -# --dry-run=client -o yaml | kubectl apply -f - - -kubectl create secret docker-registry radix-docker \ - --docker-server="$AZ_RESOURCE_CONTAINER_REGISTRY.azurecr.io" \ - --docker-username="$(jq -r '.id' sp_credentials.json)" \ - --docker-password="$(jq -r '.password' sp_credentials.json)" \ - --docker-email=radix@statoilsrm.onmicrosoft.com \ - --dry-run=client -o yaml | - kubectl apply -f - - -rm -f sp_credentials.json - -printf "\nDone\n" - -### Adding buildah cache repo secret - -printf "Installing app registry secret in k8s cluster...\n" - -az keyvault secret download \ - --vault-name "$AZ_RESOURCE_KEYVAULT" \ - --name "${AZ_SYSTEM_USER_APP_REGISTRY_SECRET_KEY}" \ - --file acr_password.json - -# create secret for authenticating to ACR via buildah client (same value as other ACR secret) -acr_password="$(cat acr_password.json )" - -kubectl create secret generic radix-app-registry \ - --from-literal="username=$AZ_SYSTEM_USER_APP_REGISTRY_USERNAME" \ - --from-literal="password=$acr_password" \ - --dry-run=client -o yaml | - kubectl apply -f - -rm -f acr_password.json - -printf "\nDone\n" diff --git a/scripts/install_base_components.sh b/scripts/install_base_components.sh index 058902801..dd69c0d0c 100755 --- a/scripts/install_base_components.sh +++ b/scripts/install_base_components.sh @@ -246,41 +246,10 @@ printf "%s► Execute %s%s\n" "${grn}" "$WORKDIR_PATH/scripts/ingress-nginx/boot (MIGRATION_STRATEGY="${MIGRATION_STRATEGY}" USER_PROMPT="false" ./ingress-nginx/bootstrap.sh) wait -####################################################################################### -### Install Lets Encrypt issuer values for Flux -### - -echo "" -printf "%s► Execute %s%s\n" "${grn}" "$WORKDIR_PATH/scripts/cert-manager/cluster-issuers/letsencrypt/bootstrap.sh" "${normal}" -(USER_PROMPT="$USER_PROMPT" ./cert-manager/cluster-issuers/letsencrypt/bootstrap.sh) -wait - -####################################################################################### -### Create storage classes -### - -echo "Creating storage classes" -kubectl apply --filename manifests/storageclass-retain.yaml -kubectl apply --filename manifests/storageclass-retain-nocache.yaml -echo "" - - ####################################################################################### ### For network security policy applied by operator to work, the namespace hosting prometheus and nginx-ingress-controller need to be labeled kubectl label ns default purpose=radix-base-ns --overwrite -####################################################################################### -# Create radix platform shared configs and secrets -# Create 4 secrets for Radix platform: radix-sp-acr-azure, radix-sp-buildah-azure and radix-docker - -echo "" -echo "Start on radix platform shared configs and secrets..." -echo "" -printf "%s► Execute %s%s\n" "${grn}" "$WORKDIR_PATH/scripts/config-and-secrets/bootstrap-acr.sh" "${normal}" -(CLUSTER_NAME=$CLUSTER_NAME ./config-and-secrets/bootstrap-acr.sh) -wait - -echo "Done." ####################################################################################### ### Install Radix CICD Canary