-
Notifications
You must be signed in to change notification settings - Fork 3
/
05_install_decapod.sh
executable file
·347 lines (286 loc) · 14 KB
/
05_install_decapod.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
#!/bin/bash
set -e
source lib/common.sh
if [ -z "$1" ] || [ -z "$2" ]; then
echo "usage: $0 <assets dir> <values.yaml for admin cluster>"
exit 1
fi
ASSET_DIR=$1
HELM_VALUE_FILE=$2
export KUBECONFIG=~/.kube/config
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
function github_create_repo() {
echo $GIT_SVC_TOKEN | gh auth login --with-token
echo "===== Current repo list ====="
gh repo list openinfradev | grep decapod-site
gh repo list ${GIT_SVC_USERNAME}
echo "===== Create and initialize ${GIT_SVC_USERNAME}/${CLUSTER_NAME} site and manifests repositories ====="
gh repo create ${GIT_SVC_USERNAME}/${CLUSTER_NAME} --public --confirm
cd ${CLUSTER_NAME}
echo -n ${GIT_SVC_TOKEN} | gh secret set API_GIT_SVC_TOKEN_GITHUB
}
function gitea_create_repo() {
curl -X 'POST' $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/v1/orgs/${GIT_SVC_USERNAME}/repos?token=${GIT_SVC_TOKEN} -H 'accept: application/json' -H 'Content-Type: application/json' -d "{ \"name\": \"${CLUSTER_NAME}\"}"
curl -X 'POST' $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/v1/orgs/${GIT_SVC_USERNAME}/repos?token=${GIT_SVC_TOKEN} -H 'accept: application/json' -H 'Content-Type: application/json' -d "{ \"name\": \"${CLUSTER_NAME}-manifests\"}"
curl -X 'POST' $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/v1/orgs/${GIT_SVC_USERNAME}/repos?token=${GIT_SVC_TOKEN} -H 'accept: application/json' -H 'Content-Type: application/json' -d "{ \"name\": \"decapod-bootstrap\"}"
export ARGO_GIT_SVC_TOKEN="Bearer $(kubectl -n argo get secret $SA_GIT_SVC_TOKEN -o=jsonpath='{.data.token}' | base64 --decode)"
curl -X 'POST' \
"${GIT_SVC_HTTP}://${GIT_SVC_BASE_URL}/api/v1/repos/${GIT_SVC_USERNAME}/${CLUSTER_NAME}/hooks?token=${GIT_SVC_TOKEN}" \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-d "{
\"active\": true,
\"branch_filter\": \"main\",
\"config\": {
\"content_type\": \"json\",
\"url\": \"http://argo-workflows-operator-server.argo:2746/api/v1/events/argo/gitea-webhook\"
},
\"events\": [
\"push\"
],
\"type\": \"gitea\",
\"authorization_header\": \"${ARGO_GIT_SVC_TOKEN}\"
}"
}
function create_admin_cluster_repo() {
if [ "$GIT_SVC_TYPE" = "gitea" ]; then
gitea_create_repo
else
GIT_SVC_HTTP=${GIT_SVC_URL%://*}
GIT_SVC_BASE_URL=${GIT_SVC_URL#*//}
github_create_repo
fi
git clone -b ${TKS_RELEASE} $GIT_SVC_HTTP://$(echo -n $GIT_SVC_TOKEN)@${GIT_SVC_BASE_URL}/${GIT_SVC_USERNAME}/decapod-site.git
cd decapod-site
echo "Decapod Site Repo Revision: "${TKS_RELEASE} >META
echo "Decapod Site Repo Commit: "$(git rev-parse HEAD) >>META
rm -rf .github
case $TKS_ADMIN_CLUSTER_INFRA_PROVIDER in
"aws")
if grep -Fq "eksEnabled: true" $SCRIPT_DIR/$HELM_VALUE_FILE; then
TEMPLATE_NAME="eks-reference"
else
TEMPLATE_NAME="aws-reference"
fi
;;
"byoh")
TEMPLATE_NAME="byoh-reference"
;;
esac
echo "Decapod template: $TEMPLATE_NAME" >>META
for dir in *-reference; do
[ "$dir" = "$TEMPLATE_NAME" ] && mv $dir $CLUSTER_NAME && continue
rm -rf $dir
done
rm -rf $CLUSTER_NAME/service-mesh
export DATABASE_HOST
export DATABASE_PORT
export DATABASE_USER
export DATABASE_PASSWORD
envsubst <$CLUSTER_NAME/decapod-controller/site-values.yaml >site-values.yaml.tmp && mv site-values.yaml.tmp $CLUSTER_NAME/decapod-controller/site-values.yaml
git config --global user.email "[email protected]"
git config --global user.name "SKTelecom TACO"
git add .
git commit -m "new repo for ${CLUSTER_NAME}"
git remote add new_admin $GIT_SVC_HTTP://$(echo -n $GIT_SVC_TOKEN)@${GIT_SVC_BASE_URL}/${GIT_SVC_USERNAME}/${CLUSTER_NAME}
git push new_admin ${TKS_RELEASE}:main
cd ..
}
function install_postgresql_on_admin_cluster() {
export KUBECONFIG=$SCRIPT_DIR/output/kubeconfig_$CLUSTER_NAME
kubectl create ns tks-db || true
export DATABASE_PASSWORD
cat templates/helm-postgresql.vo.template | envsubst >helm-values/postgresql.vo
helm upgrade -i postgresql $ASSET_DIR/postgresql-helm/postgresql -f $SCRIPT_DIR/helm-values/postgresql.vo -n tks-db
./util/wait_for_all_pods_in_ns.sh tks-db
export KUBECONFIG=~/.kube/config
}
function install_gitea_on_admin_cluster() {
export KUBECONFIG=$SCRIPT_DIR/output/kubeconfig_$CLUSTER_NAME
kubectl create ns gitea || true
if [ -z "$DATABASE_HOST" ]; then
DATABASE_HOST=postgresql.tks-db.svc
fi
export DATABASE_HOST
export DATABASE_PORT
export DATABASE_USER
export DATABASE_PASSWORD
export GITEA_ADMIN_USER
export GITEA_ADMIN_PASSWORD
cat templates/helm-gitea.vo.template | envsubst >helm-values/gitea.vo
helm upgrade -i gitea $ASSET_DIR/gitea-helm/gitea -f $SCRIPT_DIR/helm-values/gitea.vo -n gitea
./util/wait_for_all_pods_in_ns.sh gitea
JQ_ASSETS_DIR="$ASSET_DIR/jq/$(ls $ASSET_DIR/jq | grep jq)"
chmod +x $JQ_ASSETS_DIR/jq-linux64
GIT_SVC_HTTP="http"
GITEA_NODE_PORT=$(kubectl get -n gitea -o jsonpath="{.spec.ports[0].nodePort}" services gitea-http)
GITEA_NODE_IP=$(kubectl get no -ojsonpath='{.items[0].status.addresses[0].address}')
GIT_SVC_BASE_URL="$GITEA_NODE_IP:$GITEA_NODE_PORT"
if [ -n ${GIT_SVC_TOKEN+x} ]; then
curl -u $GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/v1/users/$GITEA_ADMIN_USER/tokens/tks-admin
sed -i '/GIT_SVC_TOKEN/d' $SCRIPT_DIR/conf.sh
fi
export GIT_SVC_TOKEN=$(curl -sH "Content-Type: application/json" -d '{"name":"tks-admin", "scopes":["repo","admin:org","admin:repo_hook","admin:org_hook","delete_repo","package","admin:application"]}' -u $GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/v1/users/$GITEA_ADMIN_USER/tokens | $JQ_ASSETS_DIR/jq-linux64 -r .sha1)
echo GIT_SVC_TOKEN=$GIT_SVC_TOKEN >>$SCRIPT_DIR/conf.sh
curl -X 'POST' $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/v1/orgs?token=${GIT_SVC_TOKEN} -H 'accept: application/json' -H 'Content-Type: application/json' -d "{ \"username\": \"$GIT_SVC_USERNAME\" }"
export KUBECONFIG=~/.kube/config
}
function clone_or_create_decapod_repos() {
curl -X 'POST' $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/v1/repos/migrate?token=${GIT_SVC_TOKEN} -H 'accept: application/json' -H 'Content-Type: application/json' \
-d "{
\"clone_addr\": \"https://github.com/openinfradev/decapod-base-yaml.git\",
\"mirror\": true,
\"mirror_interval\": \"10m0s\",
\"repo_name\": \"decapod-base-yaml\",
\"repo_owner\": \"$GIT_SVC_USERNAME\",
\"service\": \"github\",
\"uid\": 0,
\"wiki\": false
}"
curl -X 'POST' $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/v1/repos/migrate?token=${GIT_SVC_TOKEN} -H 'accept: application/json' -H 'Content-Type: application/json' \
-d "{
\"clone_addr\": \"https://github.com/openinfradev/decapod-site.git\",
\"mirror\": true,
\"mirror_interval\": \"10m0s\",
\"repo_name\": \"decapod-site\",
\"repo_owner\": \"$GIT_SVC_USERNAME\",
\"service\": \"github\",
\"uid\": 0,
\"wiki\": false
}"
}
chmod +x $ASSET_DIR/argo-workflows/$ARGOWF_VERSION/argo-linux-amd64
sudo cp $ASSET_DIR/argo-workflows/$ARGOWF_VERSION/argo-linux-amd64 /usr/local/bin/argo
chmod +x $ASSET_DIR/argo-cd/$ARGOCD_VERSION/argocd-linux-amd64
sudo cp $ASSET_DIR/argo-cd/$ARGOCD_VERSION/argocd-linux-amd64 /usr/local/bin/argocd
if [ -z "$DATABASE_HOST" ]; then
log_info "Installing Postgresql on the admin cluster..."
install_postgresql_on_admin_cluster
fi
if [ "$GIT_SVC_TYPE" = "gitea" ]; then
log_info "Installing Gitea on the admin cluster..."
install_gitea_on_admin_cluster
fi
log_info "Cloning/Creating Decapod Base and Site git repos..."
clone_or_create_decapod_repos
log_info "Creating Admin cluster git repos..."
rm -rf git_tmps
mkdir git_tmps
cd git_tmps
create_admin_cluster_repo
cd ..
rm -rf git_tmps
export KUBECONFIG=$SCRIPT_DIR/output/kubeconfig_$CLUSTER_NAME
gum spin --spinner dot --title "Rendering decapod-manifests for $CLUSTER_NAME..." -- ./util/decapod-render-manifests.sh $CLUSTER_NAME
log_info "Installing Decapod-bootstrap..."
kubectl create ns argo || true
if [ "$GIT_SVC_TYPE" = "gitea" ]; then
cd $ASSET_DIR/decapod-bootstrap
GIT_SVC_HTTP=${GIT_SVC_URL%://*}
GIT_SVC_BASE_URL=${GIT_SVC_URL#*//}
./generate_yamls.sh --site $CLUSTER_NAME --bootstrap-git $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/${GIT_SVC_USERNAME}/decapod-bootstrap --manifests-git $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/${GIT_SVC_USERNAME}/${CLUSTER_NAME}-manifests
git config --global user.email "[email protected]"
git config --global user.name "SKTelecom TKS"
git add .
git commit -m "${CLUSTER_NAME}"
GIT_SVC_HTTP="http"
GITEA_NODE_PORT=$(kubectl get -n gitea -o jsonpath="{.spec.ports[0].nodePort}" services gitea-http)
GITEA_NODE_IP=$(kubectl get no -ojsonpath='{.items[0].status.addresses[0].address}')
GIT_SVC_BASE_URL="$GITEA_NODE_IP:$GITEA_NODE_PORT"
git remote add gitea $GIT_SVC_HTTP://$(echo -n $GIT_SVC_TOKEN)@${GIT_SVC_BASE_URL}/${GIT_SVC_USERNAME}/decapod-bootstrap
git push gitea main:main
cd -
fi
helm upgrade -i argo-cd $ASSET_DIR/argo-cd-helm/argo-cd -f $ASSET_DIR/decapod-bootstrap/argocd-install/values-override.yaml -n argo
gum spin --spinner dot --title "Wait for argo CD ready..." -- util/wait_for_all_pods_in_ns.sh argo
helm upgrade -i argo-cd-apps $ASSET_DIR/argocd-apps-helm/argocd-apps -f $ASSET_DIR/decapod-bootstrap/argocd-apps-install/values-override.yaml -n argo
log_info "Wait for decapod bootstrap to finish..."
set +e
while (true); do
kubectl get deploy -n argo argo-workflows-operator-server >/dev/null 2>&1
status=$?
if test $status -eq 0; then
break
fi
echo -n .
sleep 10
done
set -e
log_info "All applications for bootstrap have been installed successfully"
log_info "Creating workflow templates from decapod and tks-flow..."
kubectl apply -R -f $ASSET_DIR/decapod-flow/templates -n argo
for dir in $(ls -l $ASSET_DIR/tks-flow/ | grep "^d" | grep -v dockerfiles | awk '{print $9}'); do
kubectl apply -R -f $ASSET_DIR/tks-flow/$dir -n argo
done
log_info "Creating aws secret..."
argo submit --from wftmpl/tks-create-aws-conf-secret -n argo -p aws_access_key_id=$AWS_ACCESS_KEY_ID -p aws_secret_access_key=$AWS_SECRET_ACCESS_KEY -p aws_account_id=$AWS_ACCOUNT_ID -p aws_user=$AWS_USER --watch
log_info "Create a Git service token secret..."
argo submit --from wftmpl/tks-create-git-svc-token-secret -n argo -p user=$GIT_SVC_USERNAME -p token=$GIT_SVC_TOKEN -p git_svc_type=$GIT_SVC_TYPE -p git_svc_url=$GIT_SVC_URL --watch
ARGOCD_PASSWD=$(kubectl -n argo get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
log_info "Run prepare-argocd workflow..."
argo submit --from wftmpl/prepare-argocd -n argo -p argo_server=argo-cd-argocd-server.argo.svc:80 -p argo_password=$ARGOCD_PASSWD --watch
log_info "Add tks-admin cluster to argocd..."
CURRENT_CONTEXT=$(kubectl config current-context)
function argocd_add_admin_cluster() {
argocd login --plaintext $ARGOCD_SERVER:$ARGOCD_PORT --username admin --password $ARGOCD_PASSWD
argocd cluster add $CURRENT_CONTEXT --name tks-admin -y
argocd cluster list
}
case $TKS_ADMIN_CLUSTER_INFRA_PROVIDER in
"aws")
if grep -Fq "eksEnabled: true" $SCRIPT_DIR/$HELM_VALUE_FILE; then
kubectl patch svc -n argo argo-cd-argocd-server -p '{"spec":{"type":"LoadBalancer"}}'
sleep 5
ARGOCD_SERVER=$(kubectl get svc -n argo argo-cd-argocd-server -ojsonpath='{.status.loadBalancer.ingress[0].hostname}')
set +e
while (true); do
nslookup $ARGOCD_SERVER >/dev/null 2>&1
status=$?
if test $status -eq 0; then
break
fi
sleep 5
done
set -e
ARGOCD_PORT=80
argocd_add_admin_cluster
kubectl patch svc -n argo argo-cd-argocd-server -p '{"spec":{"type":"NodePort"}}'
else
ARGOCD_SERVER=localhost
ARGOCD_PORT=30080
kubectl port-forward -n argo svc/argo-cd-argocd-server 30080:80 2>&1 >/dev/null &
ARGOCD_KUBECTL_PID=$!
sleep 3
argocd_add_admin_cluster
kill $ARGOCD_KUBECTL_PID
fi
;;
"byoh")
ARGOCD_SERVER=$(kubectl get no -ojsonpath='{.items[0].status.addresses[?(@.type == "InternalIP")].address}')
ARGOCD_PORT=30080
argocd_add_admin_cluster
# BYOH
curl -v --user tks_admin:$GIT_SVC_TOKEN -X DELETE $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/packages/decapod10/generic/byoh_hostagent/$BYOH_TKS_VERSION/byoh-hostagent-linux-amd64 || true
curl -v --user tks_admin:$GIT_SVC_TOKEN --upload-file output/byoh-hostagent $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/packages/decapod10/generic/byoh_hostagent/$BYOH_TKS_VERSION/byoh-hostagent-linux-amd64
curl -v --user tks_admin:$GIT_SVC_TOKEN -X DELETE $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/packages/decapod10/generic/imgpkg/$IMGPKG_VERSION/imgpkg || true
curl -v --user tks_admin:$GIT_SVC_TOKEN --upload-file output/imgpkg $GIT_SVC_HTTP://${GIT_SVC_BASE_URL}/api/packages/decapod10/generic/imgpkg/$IMGPKG_VERSION/imgpkg
;;
esac
log_info "Copying TKS admin cluster kubeconfig secret to argo namespace"
# Create TKS Kubeconfig for admin cluster
TKS_KUBECONFIG_ADMIN="$SCRIPT_DIR/output/tks-kubeconfig_$CLUSTER_NAME"
cat $KUBECONFIG | sed '/exec:/,+15d' >$TKS_KUBECONFIG_ADMIN
API_SERVER=$(grep server $TKS_KUBECONFIG_ADMIN | awk '{print tolower($2)}')
ARGOCD_CLUSTER_SECRET=$(kubectl get secret -n argo | grep ${API_SERVER#*\/\/} | awk '{print $1}')
CLIENT_TOKEN=$(kubectl get secret -n argo $ARGOCD_CLUSTER_SECRET -ojsonpath='{.data.config}' | base64 -d | $JQ_ASSETS_DIR/jq-linux64 -r .bearerToken)
echo " token: ${CLIENT_TOKEN}" >>$TKS_KUBECONFIG_ADMIN
kubectl delete secret tks-admin-kubeconfig-secret -n argo || true
kubectl create secret generic tks-admin-kubeconfig-secret -n argo --from-file=value=$TKS_KUBECONFIG_ADMIN
kubectl delete secret byoh-hostagent-install-template -n argo || true
cp templates/install_byoh_hostagent.sh.template templates/install_byoh_hostagent.sh.template.orig
HOSTAGENT_CHECKSUM=$(sha1sum output/byoh-hostagent | awk '{print $1}')
IMGPKG_BIN_CHECKSUM=$(sha1sum output/imgpkg | awk '{print $1}')
export HOSTAGENT_CHECKSUM IMGPKG_BIN_CHECKSUM BYOH_TKS_VERSION IMGPKG_VERSION GIT_SVC_USERNAME GITEA_NODE_PORT GITEA_NODE_IP
envsubst '$HOSTAGENT_CHECKSUM $IMGPKG_BIN_CHECKSUM $BYOH_TKS_VERSION $IMGPKG_VERSION $GIT_SVC_USERNAME $GITEA_NODE_IP $GITEA_NODE_PORT' <templates/install_byoh_hostagent.sh.template.orig >templates/install_byoh_hostagent.sh.template
kubectl create secret generic byoh-hostagent-install-template -n argo --from-file=agent-install-template=templates/install_byoh_hostagent.sh.template
log_info "...Done"