From 611859f04a3f018bfec31086e485bca711dda7c4 Mon Sep 17 00:00:00 2001 From: Monis Khan Date: Thu, 16 Jul 2020 23:52:53 -0400 Subject: [PATCH 1/2] Update dockerfile to use netrc Signed-off-by: Monis Khan --- Dockerfile | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/Dockerfile b/Dockerfile index c787c9b2..9624812f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,23 @@ FROM golang:1.14-alpine as build-env + +# It is important that these ARG's are defined after the FROM statement +ARG ACCESS_TOKEN_USR="nothing" +ARG ACCESS_TOKEN_PWD="nothing" + +# git is required to fetch go dependencies +RUN apk add --no-cache ca-certificates git + +# Create a netrc file using the credentials specified using --build-arg +RUN printf "machine github.com\n\ + login ${ACCESS_TOKEN_USR}\n\ + password ${ACCESS_TOKEN_PWD}\n\ + \n\ + machine api.github.com\n\ + login ${ACCESS_TOKEN_USR}\n\ + password ${ACCESS_TOKEN_PWD}\n"\ + >> /root/.netrc +RUN chmod 600 /root/.netrc + RUN mkdir /work RUN mkdir /work/out WORKDIR /work From 260a271859e525cad9293ee11f197d01dc795b1a Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Fri, 17 Jul 2020 14:42:02 -0700 Subject: [PATCH 2/2] Add RBAC for autoregistration - Also fix mistakes in the deployment.yaml - Also hardcode the ownerRef kind and version because otherwise we get an error Signed-off-by: Monis Khan --- deploy/deployment.yaml | 45 +++++++++------- deploy/rbac.yaml | 51 +++++++++++++++++++ internal/autoregistration/autoregistration.go | 4 +- 3 files changed, 79 insertions(+), 21 deletions(-) create mode 100644 deploy/rbac.yaml diff --git a/deploy/deployment.yaml b/deploy/deployment.yaml index 4a0e087f..71713551 100644 --- a/deploy/deployment.yaml +++ b/deploy/deployment.yaml @@ -9,6 +9,12 @@ metadata: name: #@ data.values.namespace --- apiVersion: v1 +kind: ServiceAccount +metadata: + name: #@ data.values.app_name + "-service-account" + namespace: #@ data.values.namespace +--- +apiVersion: v1 kind: ConfigMap metadata: name: #@ data.values.app_name + "-config" @@ -39,6 +45,7 @@ spec: labels: app: #@ data.values.app_name spec: + serviceAccountName: #@ data.values.app_name + "-service-account" containers: - name: placeholder-name #@ if data.values.image_digest: @@ -48,25 +55,25 @@ spec: #@ end imagePullPolicy: IfNotPresent command: - - ./app - - --config=/etc/config/placeholder-config.yaml - - --downward-api-path=/etc/podinfo + - ./app + args: + - --config=/etc/config/placeholder-config.yaml + - --downward-api-path=/etc/podinfo volumeMounts: - - name: config-volume - mountPath: /etc/config + - name: config-volume + mountPath: /etc/config + - name: podinfo + mountPath: /etc/podinfo volumes: - - name: config-volume - configMap: - name: #@ data.values.app_name + "-config" + - name: config-volume + configMap: + name: #@ data.values.app_name + "-config" - name: podinfo - mountPath: /etc/podinfo - volumes: - - name: podinfo - downwardAPI: - items: - - path: "labels" - fieldRef: - fieldPath: metadata.labels - - path: "namespace" - fieldRef: - fieldPath: metadata.namespace + downwardAPI: + items: + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "namespace" + fieldRef: + fieldPath: metadata.namespace diff --git a/deploy/rbac.yaml b/deploy/rbac.yaml new file mode 100644 index 00000000..dda81a1b --- /dev/null +++ b/deploy/rbac.yaml @@ -0,0 +1,51 @@ +#@ load("@ytt:data", "data") + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: #@ data.values.app_name + "-aggregated-api-server-cluster-role" +rules: + - apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] + - apiGroups: [apiregistration.k8s.io] + resources: [apiservices] + verbs: [create, get, list, patch, update, watch] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: #@ data.values.app_name + "-aggregated-api-server-cluster-role-binding" +subjects: + - kind: ServiceAccount + name: #@ data.values.app_name + "-service-account" + namespace: #@ data.values.namespace +roleRef: + kind: ClusterRole + name: #@ data.values.app_name + "-aggregated-api-server-cluster-role" + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: #@ data.values.app_name + "-aggregated-api-server-role" + namespace: #@ data.values.namespace +rules: + - apiGroups: [""] + resources: [services] + verbs: [create, get, list, patch, update, watch] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: #@ data.values.app_name + "-aggregated-api-server-role-binding" + namespace: #@ data.values.namespace +subjects: + - kind: ServiceAccount + name: #@ data.values.app_name + "-service-account" + namespace: #@ data.values.namespace +roleRef: + kind: Role + name: #@ data.values.app_name + "-aggregated-api-server-role" + apiGroup: rbac.authorization.k8s.io diff --git a/internal/autoregistration/autoregistration.go b/internal/autoregistration/autoregistration.go index e5098e50..a7a36f03 100644 --- a/internal/autoregistration/autoregistration.go +++ b/internal/autoregistration/autoregistration.go @@ -64,8 +64,8 @@ func Setup(ctx context.Context, options SetupOptions) error { Port: &svc.Spec.Ports[0].Port, } apiSvc.ObjectMeta.OwnerReferences = []metav1.OwnerReference{{ - APIVersion: ns.APIVersion, - Kind: ns.Kind, + APIVersion: "v1", // TODO why did we need to hardcode this to avoid errors? was ns.APIVersion + Kind: "Namespace", // TODO why did we need to hardcode this to avoid errors? was ns.Kind UID: ns.UID, Name: ns.Name, }}