Skip to content

Commit bd67a58

Browse files
maelvlsmaelvls
authored
Merge pull request #575 from jetstack/refactor-and-test-config
VC-36043: Better error messages, warnings, and flag descriptions, no more unexpected "unauthenticated" mode, and it is now possible to use the `--period` flag without also giving the `period` field
2 parents 52f018d + 8c87b6c commit bd67a58

File tree

24 files changed

+1832
-1091
lines changed

24 files changed

+1832
-1091
lines changed

‎cmd/agent.go

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,11 @@ import (
44
"fmt"
55
"os"
66

7+
"github.com/spf13/cobra"
8+
79
"github.com/jetstack/preflight/pkg/agent"
810
"github.com/jetstack/preflight/pkg/logs"
911
"github.com/jetstack/preflight/pkg/permissions"
10-
"github.com/spf13/cobra"
1112
)
1213

1314
var agentCmd = &cobra.Command{
@@ -39,11 +40,16 @@ var agentRBACCmd = &cobra.Command{
3940
if err != nil {
4041
logs.Log.Fatalf("Failed to read config file: %s", err)
4142
}
42-
cfg, err := agent.ParseConfig(b, false)
43+
cfg, err := agent.ParseConfig(b)
4344
if err != nil {
4445
logs.Log.Fatalf("Failed to parse config file: %s", err)
4546
}
4647

48+
err = agent.ValidateDataGatherers(cfg.DataGatherers)
49+
if err != nil {
50+
logs.Log.Fatalf("Failed to validate data gatherers: %s", err)
51+
}
52+
4753
out := permissions.GenerateFullManifest(cfg.DataGatherers)
4854
fmt.Print(out)
4955
},

‎cmd/echo.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
package cmd
22

33
import (
4-
"github.com/jetstack/preflight/pkg/echo"
54
"github.com/spf13/cobra"
5+
6+
"github.com/jetstack/preflight/pkg/echo"
67
)
78

89
var echoCmd = &cobra.Command{

‎deploy/charts/venafi-kubernetes-agent/templates/deployment.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@ spec:
6565
{{- else }}
6666
- "--client-id"
6767
- {{ .Values.config.clientId | quote }}
68+
- "--private-key-path"
69+
- "/etc/venafi/agent/key/{{ .Values.authentication.secretKey }}"
6870
{{- end }}
6971
- "-p"
7072
- "0h1m0s"

‎hack/e2e/test.sh

Lines changed: 61 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,16 @@ set -o nounset
3131
set -o errexit
3232
set -o pipefail
3333
set -o xtrace
34+
script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
35+
root_dir=$(cd "${script_dir}/../.." && pwd)
36+
export TERM=dumb
3437

3538
# Your Venafi Cloud API key.
3639
: ${VEN_API_KEY?}
3740
# Separate API Key for getting a pull secret, if your main venafi cloud tenant
3841
# doesn't allow you to create registry service accounts.
3942
: ${VEN_API_KEY_PULL?}
4043

41-
# The Venafi Cloud team which will be the owner of the generated Venafi service
42-
# accounts.
43-
: ${VEN_OWNING_TEAM?}
44-
4544
# The Venafi Cloud zone (application/issuing_template) which will be used by the
4645
# issuer an policy.
4746
: ${VEN_ZONE?}
@@ -55,22 +54,6 @@ set -o xtrace
5554
# E.g. ttl.sh/63773370-0bcf-4ac0-bd42-5515616089ff
5655
: ${OCI_BASE?}
5756

58-
export VERSION=$(git describe --tags --always --match='v*' --abbrev=14 --dirty)
59-
export KO_DOCKER_REPO=$OCI_BASE/images/venafi-agent
60-
export TERM=dumb
61-
62-
script_dir=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
63-
root_dir=$(cd "${script_dir}/../.." && pwd)
64-
65-
cd "${script_dir}"
66-
67-
pushd "${root_dir}"
68-
ko build --bare --tags "${VERSION}"
69-
helm package deploy/charts/venafi-kubernetes-agent --version "${VERSION}" --app-version "${VERSION}"
70-
helm push venafi-kubernetes-agent-${VERSION}.tgz "oci://${OCI_BASE}/charts"
71-
popd
72-
73-
export USE_GKE_GCLOUD_AUTH_PLUGIN=True
7457
# Required gcloud environment variables
7558
# https://cloud.google.com/sdk/docs/configurations#setting_configuration_properties
7659
: ${CLOUDSDK_CORE_PROJECT?}
@@ -79,22 +62,36 @@ export USE_GKE_GCLOUD_AUTH_PLUGIN=True
7962
# The name of the cluster to create
8063
: ${CLUSTER_NAME?}
8164

65+
# IMPORTANT: we pick the first team as the owning team for the registry and
66+
# workload identity service account as it doesn't matter.
67+
68+
version=$(git describe --tags --always --match='v*' --abbrev=14 --dirty)
69+
70+
cd "${script_dir}"
71+
72+
pushd "${root_dir}"
73+
KO_DOCKER_REPO=$OCI_BASE/images/venafi-agent ko build --bare --tags "${version}"
74+
helm package deploy/charts/venafi-kubernetes-agent --version "${version}" --app-version "${version}"
75+
helm push "venafi-kubernetes-agent-${version}.tgz" "oci://${OCI_BASE}/charts"
76+
popd
77+
78+
export USE_GKE_GCLOUD_AUTH_PLUGIN=True
8279
if ! gcloud container clusters get-credentials "${CLUSTER_NAME}"; then
83-
gcloud container clusters create "${CLUSTER_NAME}" \
84-
--preemptible \
85-
--machine-type e2-small \
86-
--num-nodes 3
80+
gcloud container clusters create "${CLUSTER_NAME}" \
81+
--preemptible \
82+
--machine-type e2-small \
83+
--num-nodes 3
8784
fi
8885
kubectl create ns venafi || true
8986

9087
# Pull secret for Venafi OCI registry
9188
if ! kubectl get secret venafi-image-pull-secret -n venafi; then
92-
venctl iam service-accounts registry create \
93-
--api-key "${VEN_API_KEY_PULL}" \
94-
--no-prompts \
95-
--owning-team "${VEN_OWNING_TEAM}" \
96-
--name "venafi-kubernetes-agent-e2e-registry-${RANDOM}" \
97-
--scopes enterprise-cert-manager,enterprise-venafi-issuer,enterprise-approver-policy \
89+
venctl iam service-accounts registry create \
90+
--api-key "${VEN_API_KEY_PULL}" \
91+
--no-prompts \
92+
--owning-team "$(curl --fail-with-body -sS "https://${VEN_API_HOST}/v1/teams" -H "tppl-api-key: $VEN_API_KEY_PULL" | jq '.teams[0].id' -r)" \
93+
--name "venafi-kubernetes-agent-e2e-registry-${RANDOM}" \
94+
--scopes enterprise-cert-manager,enterprise-venafi-issuer,enterprise-approver-policy \
9895
| jq '{
9996
"apiVersion": "v1",
10097
"kind": "Secret",
@@ -118,35 +115,35 @@ fi
118115

119116
export VENAFI_KUBERNETES_AGENT_CLIENT_ID="not-used-but-required-by-venctl"
120117
venctl components kubernetes apply \
121-
--cert-manager \
122-
--venafi-enhanced-issuer \
123-
--approver-policy-enterprise \
124-
--venafi-kubernetes-agent \
125-
--venafi-kubernetes-agent-version "${VERSION}" \
126-
--venafi-kubernetes-agent-values-files "${script_dir}/values.venafi-kubernetes-agent.yaml" \
127-
--venafi-kubernetes-agent-custom-image-registry "${OCI_BASE}/images" \
128-
--venafi-kubernetes-agent-custom-chart-repository "oci://${OCI_BASE}/charts"
118+
--cert-manager \
119+
--venafi-enhanced-issuer \
120+
--approver-policy-enterprise \
121+
--venafi-kubernetes-agent \
122+
--venafi-kubernetes-agent-version "${version}" \
123+
--venafi-kubernetes-agent-values-files "${script_dir}/values.venafi-kubernetes-agent.yaml" \
124+
--venafi-kubernetes-agent-custom-image-registry "${OCI_BASE}/images" \
125+
--venafi-kubernetes-agent-custom-chart-repository "oci://${OCI_BASE}/charts"
129126

130127
kubectl apply -n venafi -f venafi-components.yaml
131128

132129
subject="system:serviceaccount:venafi:venafi-components"
133130
audience="https://${VEN_API_HOST}"
134131
issuerURL="$(kubectl create token -n venafi venafi-components | step crypto jwt inspect --insecure | jq -r '.payload.iss')"
135132
openidDiscoveryURL="${issuerURL}/.well-known/openid-configuration"
136-
jwksURI=$(curl -fsSL ${openidDiscoveryURL} | jq -r '.jwks_uri')
133+
jwksURI=$(curl --fail-with-body -sSL ${openidDiscoveryURL} | jq -r '.jwks_uri')
137134

138135
# Create the Venafi agent service account if one does not already exist
139136
while true; do
140-
tenantID=$(curl -fsSL -H "tppl-api-key: $VEN_API_KEY" https://${VEN_API_HOST}/v1/serviceaccounts \
141-
| jq -r '.[] | select(.issuerURL==$issuerURL and .subject == $subject) | .companyId' \
142-
--arg issuerURL "${issuerURL}" \
143-
--arg subject "${subject}")
137+
tenantID=$(curl --fail-with-body -sSL -H "tppl-api-key: $VEN_API_KEY" https://${VEN_API_HOST}/v1/serviceaccounts \
138+
| jq -r '.[] | select(.issuerURL==$issuerURL and .subject == $subject) | .companyId' \
139+
--arg issuerURL "${issuerURL}" \
140+
--arg subject "${subject}")
144141

145-
if [[ "${tenantID}" != "" ]]; then
146-
break
147-
fi
142+
if [[ "${tenantID}" != "" ]]; then
143+
break
144+
fi
148145

149-
jq -n '{
146+
jq -n '{
150147
"name": "venafi-kubernetes-agent-e2e-agent-\($random)",
151148
"authenticationType": "rsaKeyFederated",
152149
"scopes": ["kubernetes-discovery-federated", "certificate-issuance"],
@@ -155,19 +152,19 @@ while true; do
155152
"issuerURL": $issuerURL,
156153
"jwksURI": $jwksURI,
157154
"applications": [$applications.applications[].id],
158-
"owner": $teams.teams[] | select(.name==$teamName) | .id
155+
"owner": $owningTeamID
159156
}' \
160-
--arg random "${RANDOM}" \
161-
--arg teamName "${VEN_OWNING_TEAM}" \
162-
--arg subject "${subject}" \
163-
--arg audience "${audience}" \
164-
--arg issuerURL "${issuerURL}" \
165-
--arg jwksURI "${jwksURI}" \
166-
--argjson teams "$(curl https://${VEN_API_HOST}/v1/teams -fsSL -H tppl-api-key:\ ${VEN_API_KEY})" \
167-
--argjson applications "$(curl https://${VEN_API_HOST}/outagedetection/v1/applications -fsSL -H tppl-api-key:\ ${VEN_API_KEY})" \
168-
| curl https://${VEN_API_HOST}/v1/serviceaccounts \
169-
-H "tppl-api-key: $VEN_API_KEY" \
170-
-fsSL --json @-
157+
--arg random "${RANDOM}" \
158+
--arg subject "${subject}" \
159+
--arg audience "${audience}" \
160+
--arg issuerURL "${issuerURL}" \
161+
--arg jwksURI "${jwksURI}" \
162+
--arg owningTeamID "$(curl --fail-with-body -sS "https://${VEN_API_HOST}/v1/teams" -H "tppl-api-key: $VEN_API_KEY" | jq '.teams[0].id' -r)" \
163+
--argjson applications "$(curl https://${VEN_API_HOST}/outagedetection/v1/applications --fail-with-body -sSL -H tppl-api-key:\ ${VEN_API_KEY})" \
164+
| curl https://${VEN_API_HOST}/v1/serviceaccounts \
165+
-H "tppl-api-key: $VEN_API_KEY" \
166+
--fail-with-body \
167+
-sSL --json @-
171168
done
172169

173170
kubectl apply -n venafi -f - <<EOF
@@ -188,14 +185,14 @@ spec:
188185
tenantID: ${tenantID}
189186
EOF
190187

191-
envsubst < application-team-1.yaml | kubectl apply -f -
188+
envsubst <application-team-1.yaml | kubectl apply -f -
192189
kubectl -n team-1 wait certificate app-0 --for=condition=Ready
193190

194191
# Wait for log message indicating success.
195192
# Filter out distracting data gatherer errors and warnings.
196193
# Show other useful log messages on stderr.
197194
kubectl logs deployments/venafi-kubernetes-agent \
198-
--follow \
199-
--namespace venafi \
200-
| tee >(grep -v -e "reflector\.go" -e "datagatherer" -e "data gatherer" > /dev/stderr) \
201-
| grep -q "Data sent successfully"
195+
--follow \
196+
--namespace venafi \
197+
| tee >(grep -v -e "reflector\.go" -e "datagatherer" -e "data gatherer" >/dev/stderr) \
198+
| grep -q "Data sent successfully"

0 commit comments

Comments
 (0)