new file: Dockerfile
new file: Makefile new file: entrypoint.sh Initial commit
This commit is contained in:
Jonathan Ervine
parent
97d95ac191
commit
b2d589706d
18
Dockerfile
Normal file
18
Dockerfile
Normal file
@ -0,0 +1,18 @@
|
||||
FROM harbor.ervine.dev/library/x86_64/suse//stepca
|
||||
|
||||
ENV CA_NAME="Home CA"
|
||||
ENV CA_DNS="127.0.0.1"
|
||||
ENV CA_ADDRESS=":9000"
|
||||
ENV CA_DEFAULT_PROVISIONER="admin"
|
||||
ENV CA_URL="https://127.0.0.1:9000"
|
||||
|
||||
ENV KUBE_LATEST_VERSION="v1.14.2"
|
||||
|
||||
USER root
|
||||
RUN curl -L https://storage.googleapis.com/kubernetes-release/release/${KUBE_LATEST_VERSION}/bin/linux/amd64/kubectl -o /usr/local/bin/kubectl \
|
||||
&& chmod +x /usr/local/bin/kubectl
|
||||
RUN apk --update add expect
|
||||
|
||||
COPY entrypoint.sh /home/step/
|
||||
RUN chmod +x /home/step/entrypoint.sh
|
||||
CMD ["/home/step/entrypoint.sh"]
|
||||
77
Makefile
Normal file
77
Makefile
Normal file
@ -0,0 +1,77 @@
|
||||
#!/bin/sh
|
||||
|
||||
all: artifacts
|
||||
|
||||
# Version flags
|
||||
VERSION ?= $(shell [ -d .git ] && git describe --tags --always --dirty="-dev")
|
||||
VERSION := $(shell echo $(VERSION) | sed 's/^v//')
|
||||
NOT_RC := $(shell echo $(VERSION) | grep -v -e -rc)
|
||||
|
||||
# If TRAVIS_TAG is set then we know this ref has been tagged.
|
||||
ifdef TRAVIS_TAG
|
||||
ifeq ($(NOT_RC),)
|
||||
PUSHTYPE=release-candidate
|
||||
else
|
||||
PUSHTYPE=release
|
||||
endif
|
||||
else
|
||||
PUSHTYPE=master
|
||||
endif
|
||||
|
||||
#########################################
|
||||
# Building Docker Image
|
||||
#########################################
|
||||
|
||||
DOCKER_BUILD=$Q docker build -t smallstep/$(1):latest -f $(2) .
|
||||
|
||||
docker: Dockerfile
|
||||
$(call DOCKER_BUILD,step-ca-bootstrap,Dockerfile)
|
||||
|
||||
.PHONY: docker
|
||||
|
||||
#################################################
|
||||
# Releasing Docker Images
|
||||
#################################################
|
||||
|
||||
DOCKER_TAG=docker tag smallstep/$(1):latest smallstep/$(1):$(2)
|
||||
DOCKER_PUSH=docker push smallstep/$(1):$(2)
|
||||
|
||||
docker-tag:
|
||||
$(call DOCKER_TAG,step-ca-bootstrap,$(VERSION))
|
||||
|
||||
docker-push-tag: docker-tag
|
||||
$(call DOCKER_PUSH,step-ca-bootstrap,$(VERSION))
|
||||
|
||||
docker-push-tag-latest:
|
||||
$(call DOCKER_PUSH,step-ca-bootstrap,latest)
|
||||
|
||||
# Rely on DOCKER_USERNAME and DOCKER_PASSWORD being set inside the CI or
|
||||
# equivalent environment
|
||||
docker-login:
|
||||
$Q docker login -u="$(DOCKER_USERNAME)" -p="$(DOCKER_PASSWORD)"
|
||||
|
||||
.PHONY: docker-login docker-tag docker-push-tag docker-push-tag-latest
|
||||
|
||||
#################################################
|
||||
# Targets for pushing the docker images
|
||||
#################################################
|
||||
|
||||
# For all builds we build the docker container
|
||||
docker-master: docker
|
||||
|
||||
# For all builds with a release candidate tag
|
||||
docker-release-candidate: docker-master docker-login docker-push-tag
|
||||
|
||||
# For all builds with a release tag
|
||||
docker-release: docker-release-candidate docker-push-tag-latest
|
||||
|
||||
.PHONY: docker-master docker-release-candidate docker-release
|
||||
|
||||
#################################################
|
||||
# Targets for creating step artifacts
|
||||
#################################################
|
||||
|
||||
# This command is called by travis directly *after* a successful build
|
||||
artifacts: docker-$(PUSHTYPE)
|
||||
|
||||
.PHONY: artifacts
|
||||
163
entrypoint.sh
Normal file
163
entrypoint.sh
Normal file
@ -0,0 +1,163 @@
|
||||
#!/bin/bash
|
||||
|
||||
echo "Welcome to Step Certificates configuration."
|
||||
|
||||
STEPPATH=/home/step
|
||||
|
||||
# assert_variable exists if the given variable is not set.
|
||||
function assert_variable () {
|
||||
if [ -z "$1" ];
|
||||
then
|
||||
echo "Error: variable $1 has not been set."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# check required variables
|
||||
assert_variable "$NAMESPACE"
|
||||
assert_variable "$PREFIX"
|
||||
assert_variable "$LABELS"
|
||||
assert_variable "$CA_URL"
|
||||
assert_variable "$CA_NAME"
|
||||
assert_variable "$CA_DNS"
|
||||
assert_variable "$CA_ADDRESS"
|
||||
assert_variable "$CA_PROVISIONER"
|
||||
|
||||
# check autocert required variables
|
||||
if [ "$AUTOCERT" == "true" ]; then
|
||||
assert_variable "$AUTOCERT_SERVICE"
|
||||
assert_variable "$AUTOCERT_LABEL"
|
||||
fi
|
||||
|
||||
# generate password if necessary
|
||||
CA_PASSWORD=${CA_PASSWORD:-$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32 ; echo '')}
|
||||
CA_PROVISIONER_PASSWORD=${CA_PROVISIONER_PASSWORD:-$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32 ; echo '')}
|
||||
|
||||
echo -e "\e[1mChecking cluster permissions...\e[0m"
|
||||
|
||||
function permission_error () {
|
||||
# TODO: Figure out the actual service account instead of assuming default.
|
||||
echo
|
||||
echo -e "\033[0;31mPERMISSION ERROR\033[0m"
|
||||
echo "Set permissions by running the following command, then try again:"
|
||||
echo -e "\e[1m"
|
||||
echo " kubectl create clusterrolebinding autocert-init-binding \\"
|
||||
echo " --clusterrole cluster-admin \\"
|
||||
echo " --user \"system:serviceaccount:default:default\""
|
||||
echo -e "\e[0m"
|
||||
echo "Once setup is complete you can remove this binding by running:"
|
||||
echo -e "\e[1m"
|
||||
echo " kubectl delete clusterrolebinding autocert-init-binding"
|
||||
echo -e "\e[0m"
|
||||
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Use the service account context
|
||||
kubectl config set-cluster cfc --server=https://kubernetes.default --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
kubectl config set-context cfc --cluster=cfc
|
||||
kubectl config set-credentials user --token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
|
||||
kubectl config set-context cfc --user=user
|
||||
kubectl config use-context cfc
|
||||
|
||||
echo -n "Checking for permission to create configmaps in $NAMESPACE namespace: "
|
||||
kubectl auth can-i create configmaps --namespace $NAMESPACE
|
||||
if [ $? -ne 0 ]; then
|
||||
permission_error "create configmaps"
|
||||
fi
|
||||
|
||||
echo -n "Checking for permission to create secrets in $NAMESPACE namespace: "
|
||||
kubectl auth can-i create secrets --namespace $NAMESPACE
|
||||
if [ $? -ne 0 ]; then
|
||||
permission_error "create secrets"
|
||||
fi
|
||||
|
||||
if [ "$AUTOCERT" == "true" ]; then
|
||||
echo -n "Checking for permission to create mutatingwebhookconfiguration in $NAMESPACE namespace: "
|
||||
kubectl auth can-i create mutatingwebhookconfiguration --namespace $NAMESPACE
|
||||
if [ $? -ne 0 ]; then
|
||||
permission_error "create mutatingwebhookconfiguration"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Setting this here on purpose, after the above section which explicitly checks
|
||||
# for and handles exit errors.
|
||||
set -e
|
||||
|
||||
TMP_CA_PASSWORD=$(mktemp /tmp/autocert.XXXXXX)
|
||||
TMP_CA_PROVISIONER_PASSWORD=$(mktemp /tmp/autocert.XXXXXX)
|
||||
|
||||
echo $CA_PASSWORD > $TMP_CA_PASSWORD
|
||||
echo $CA_PROVISIONER_PASSWORD > $TMP_CA_PROVISIONER_PASSWORD
|
||||
|
||||
step ca init \
|
||||
--name "$CA_NAME" \
|
||||
--dns "$CA_DNS" \
|
||||
--address "$CA_ADDRESS" \
|
||||
--password-file "$TMP_CA_PASSWORD" \
|
||||
--provisioner "$CA_DEFAULT_PROVISIONER" \
|
||||
--provisioner-password-file "$TMP_CA_PROVISIONER_PASSWORD" \
|
||||
--with-ca-url "$CA_URL"
|
||||
|
||||
rm -f $TMP_CA_PASSWORD $TMP_CA_PROVISIONER_PASSWORD
|
||||
|
||||
echo
|
||||
echo -e "\e[1mCreating configmaps and secrets in $NAMESPACE namespace ...\e[0m"
|
||||
|
||||
function kbreplace() {
|
||||
kubectl $@ -o yaml --dry-run | kubectl replace -f -
|
||||
}
|
||||
|
||||
# Replace secrets created on helm install
|
||||
# It allows to properly remove them on help delete
|
||||
kbreplace -n $NAMESPACE create configmap $PREFIX-config --from-file $(step path)/config
|
||||
kbreplace -n $NAMESPACE create configmap $PREFIX-certs --from-file $(step path)/certs
|
||||
kbreplace -n $NAMESPACE create configmap $PREFIX-secrets --from-file $(step path)/secrets
|
||||
|
||||
kbreplace -n $NAMESPACE create secret generic $PREFIX-ca-password --from-literal "password=${CA_PASSWORD}"
|
||||
kbreplace -n $NAMESPACE create secret generic $PREFIX-provisioner-password --from-literal "password=${CA_PROVISIONER_PASSWORD}"
|
||||
|
||||
# Label all configmaps and secrets
|
||||
kubectl -n $NAMESPACE label configmap $PREFIX-config $LABELS
|
||||
kubectl -n $NAMESPACE label configmap $PREFIX-certs $LABELS
|
||||
kubectl -n $NAMESPACE label configmap $PREFIX-secrets $LABELS
|
||||
kubectl -n $NAMESPACE label secret $PREFIX-ca-password $LABELS
|
||||
kubectl -n $NAMESPACE label secret $PREFIX-provisioner-password $LABELS
|
||||
|
||||
# Replace webhook if necessary
|
||||
if [ "$AUTOCERT" == "true" ]; then
|
||||
CA_BUNDLE=$(cat $(step path)/certs/root_ca.crt | base64 | tr -d '\n')
|
||||
cat <<EOF | kubectl replace -f -
|
||||
apiVersion: admissionregistration.k8s.io/v1beta1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: $PREFIX-webhook-config
|
||||
webhooks:
|
||||
- name: $AUTOCERT_LABEL
|
||||
clientConfig:
|
||||
service:
|
||||
name: $AUTOCERT_SERVICE
|
||||
namespace: $NAMESPACE
|
||||
path: "/mutate"
|
||||
caBundle: $CA_BUNDLE
|
||||
rules:
|
||||
- operations: ["CREATE"]
|
||||
apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
failurePolicy: Ignore
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
$AUTOCERT_LABEL: enabled
|
||||
EOF
|
||||
kubectl -n $NAMESPACE label mutatingwebhookconfiguration $PREFIX-webhook-config $LABELS
|
||||
fi
|
||||
|
||||
FINGERPRINT=$(step certificate fingerprint $(step path)/certs/root_ca.crt)
|
||||
|
||||
echo
|
||||
echo -e "\e[1mStep Certificates installed!\e[0m"
|
||||
echo
|
||||
echo "CA URL: ${CA_URL}"
|
||||
echo "CA Fingerprint: ${FINGERPRINT}"
|
||||
echo
|
||||
Loading…
Reference in New Issue
Block a user