Skip to content

Commit bd73fcf

Browse files
maelvlsmaelvls
committed
e2e/test.sh: gather vars at the top and group gcloud/ko commands
Grouping gcloud/ko commands makes it much easier to comment out commands that I want to skip when the script fails mid-way.
1 parent f7b4a05 commit bd73fcf

File tree

1 file changed

+59
-64
lines changed

1 file changed

+59
-64
lines changed

‎hack/e2e/test.sh‎

Lines changed: 59 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ set -o nounset
3131
set -o errexit
3232
set -o pipefail
3333
set -o xtrace
34+
script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
35+
root_dir=$(cd "${script_dir}/../.." && pwd)
36+
export TERM=dumb
3437

3538
# Your Venafi Cloud API key.
3639
: ${VEN_API_KEY?}
@@ -51,22 +54,6 @@ set -o xtrace
5154
# E.g. ttl.sh/63773370-0bcf-4ac0-bd42-5515616089ff
5255
: ${OCI_BASE?}
5356

54-
export VERSION=$(git describe --tags --always --match='v*' --abbrev=14 --dirty)
55-
export KO_DOCKER_REPO=$OCI_BASE/images/venafi-agent
56-
export TERM=dumb
57-
58-
script_dir=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
59-
root_dir=$(cd "${script_dir}/../.." && pwd)
60-
61-
cd "${script_dir}"
62-
63-
pushd "${root_dir}"
64-
ko build --bare --tags "${VERSION}"
65-
helm package deploy/charts/venafi-kubernetes-agent --version "${VERSION}" --app-version "${VERSION}"
66-
helm push venafi-kubernetes-agent-${VERSION}.tgz "oci://${OCI_BASE}/charts"
67-
popd
68-
69-
export USE_GKE_GCLOUD_AUTH_PLUGIN=True
7057
# Required gcloud environment variables
7158
# https://cloud.google.com/sdk/docs/configurations#setting_configuration_properties
7259
: ${CLOUDSDK_CORE_PROJECT?}
@@ -75,26 +62,36 @@ export USE_GKE_GCLOUD_AUTH_PLUGIN=True
7562
# The name of the cluster to create
7663
: ${CLUSTER_NAME?}
7764

65+
# IMPORTANT: we pick the first team as the owning team for the registry and
66+
# workload identity service account as it doesn't matter.
67+
68+
version=$(git describe --tags --always --match='v*' --abbrev=14 --dirty)
69+
70+
cd "${script_dir}"
71+
72+
pushd "${root_dir}"
73+
KO_DOCKER_REPO=$OCI_BASE/images/venafi-agent ko build --bare --tags "${version}"
74+
helm package deploy/charts/venafi-kubernetes-agent --version "${version}" --app-version "${version}"
75+
helm push "venafi-kubernetes-agent-${version}.tgz" "oci://${OCI_BASE}/charts"
76+
popd
77+
78+
export USE_GKE_GCLOUD_AUTH_PLUGIN=True
7879
if ! gcloud container clusters get-credentials "${CLUSTER_NAME}"; then
79-
gcloud container clusters create "${CLUSTER_NAME}" \
80-
--preemptible \
81-
--machine-type e2-small \
82-
--num-nodes 3
80+
gcloud container clusters create "${CLUSTER_NAME}" \
81+
--preemptible \
82+
--machine-type e2-small \
83+
--num-nodes 3
8384
fi
8485
kubectl create ns venafi || true
8586

86-
# Let's pick the first team as the owning team as it doesn't matter for this
87-
# test.
88-
owningTeamID=$(curl --fail-with-body -sS https://api.venafi.cloud/v1/teams -H "tppl-api-key: $VEN_API_KEY" | jq '.teams[0].id' -r)
89-
9087
# Pull secret for Venafi OCI registry
9188
if ! kubectl get secret venafi-image-pull-secret -n venafi; then
92-
venctl iam service-accounts registry create \
93-
--api-key "${VEN_API_KEY_PULL}" \
94-
--no-prompts \
95-
--owning-team "${owningTeamID}" \
96-
--name "venafi-kubernetes-agent-e2e-registry-${RANDOM}" \
97-
--scopes enterprise-cert-manager,enterprise-venafi-issuer,enterprise-approver-policy \
89+
venctl iam service-accounts registry create \
90+
--api-key "${VEN_API_KEY_PULL}" \
91+
--no-prompts \
92+
--owning-team "$(curl --fail-with-body -sS "https://${VEN_API_HOST}/v1/teams" -H "tppl-api-key: $VEN_API_KEY_PULL" | jq '.teams[0].id' -r)" \
93+
--name "venafi-kubernetes-agent-e2e-registry-${RANDOM}" \
94+
--scopes enterprise-cert-manager,enterprise-venafi-issuer,enterprise-approver-policy \
9895
| jq '{
9996
"apiVersion": "v1",
10097
"kind": "Secret",
@@ -118,37 +115,35 @@ fi
118115

119116
export VENAFI_KUBERNETES_AGENT_CLIENT_ID="not-used-but-required-by-venctl"
120117
venctl components kubernetes apply \
121-
--cert-manager \
122-
--venafi-enhanced-issuer \
123-
--approver-policy-enterprise \
124-
--venafi-kubernetes-agent \
125-
--venafi-kubernetes-agent-version "${VERSION}" \
126-
--venafi-kubernetes-agent-values-files "${script_dir}/values.venafi-kubernetes-agent.yaml" \
127-
--venafi-kubernetes-agent-custom-image-registry "${OCI_BASE}/images" \
128-
--venafi-kubernetes-agent-custom-chart-repository "oci://${OCI_BASE}/charts"
118+
--cert-manager \
119+
--venafi-enhanced-issuer \
120+
--approver-policy-enterprise \
121+
--venafi-kubernetes-agent \
122+
--venafi-kubernetes-agent-version "${version}" \
123+
--venafi-kubernetes-agent-values-files "${script_dir}/values.venafi-kubernetes-agent.yaml" \
124+
--venafi-kubernetes-agent-custom-image-registry "${OCI_BASE}/images" \
125+
--venafi-kubernetes-agent-custom-chart-repository "oci://${OCI_BASE}/charts"
129126

130127
kubectl apply -n venafi -f venafi-components.yaml
131128

132-
133129
subject="system:serviceaccount:venafi:venafi-components"
134130
audience="https://${VEN_API_HOST}"
135131
issuerURL="$(kubectl create token -n venafi venafi-components | step crypto jwt inspect --insecure | jq -r '.payload.iss')"
136132
openidDiscoveryURL="${issuerURL}/.well-known/openid-configuration"
137133
jwksURI=$(curl --fail-with-body -sSL ${openidDiscoveryURL} | jq -r '.jwks_uri')
138134

139-
140135
# Create the Venafi agent service account if one does not already exist
141136
while true; do
142-
tenantID=$(curl --fail-with-body -sSL -H "tppl-api-key: $VEN_API_KEY" https://${VEN_API_HOST}/v1/serviceaccounts \
143-
| jq -r '.[] | select(.issuerURL==$issuerURL and .subject == $subject) | .companyId' \
144-
--arg issuerURL "${issuerURL}" \
145-
--arg subject "${subject}")
137+
tenantID=$(curl --fail-with-body -sSL -H "tppl-api-key: $VEN_API_KEY" https://${VEN_API_HOST}/v1/serviceaccounts \
138+
| jq -r '.[] | select(.issuerURL==$issuerURL and .subject == $subject) | .companyId' \
139+
--arg issuerURL "${issuerURL}" \
140+
--arg subject "${subject}")
146141

147-
if [[ "${tenantID}" != "" ]]; then
148-
break
149-
fi
142+
if [[ "${tenantID}" != "" ]]; then
143+
break
144+
fi
150145

151-
jq -n '{
146+
jq -n '{
152147
"name": "venafi-kubernetes-agent-e2e-agent-\($random)",
153148
"authenticationType": "rsaKeyFederated",
154149
"scopes": ["kubernetes-discovery-federated", "certificate-issuance"],
@@ -159,17 +154,17 @@ while true; do
159154
"applications": [$applications.applications[].id],
160155
"owner": $owningTeamID
161156
}' \
162-
--arg random "${RANDOM}" \
163-
--arg subject "${subject}" \
164-
--arg audience "${audience}" \
165-
--arg issuerURL "${issuerURL}" \
166-
--arg jwksURI "${jwksURI}" \
167-
--arg owningTeamID "{$owningTeamID}" \
168-
--argjson applications "$(curl https://${VEN_API_HOST}/outagedetection/v1/applications --fail-with-body -sSL -H tppl-api-key:\ ${VEN_API_KEY})" \
169-
| curl https://${VEN_API_HOST}/v1/serviceaccounts \
170-
-H "tppl-api-key: $VEN_API_KEY" \
171-
--fail-with-body \
172-
-sSL --json @-
157+
--arg random "${RANDOM}" \
158+
--arg subject "${subject}" \
159+
--arg audience "${audience}" \
160+
--arg issuerURL "${issuerURL}" \
161+
--arg jwksURI "${jwksURI}" \
162+
--arg owningTeamID "$(curl --fail-with-body -sS "https://${VEN_API_HOST}/v1/teams" -H "tppl-api-key: $VEN_API_KEY" | jq '.teams[0].id' -r)" \
163+
--argjson applications "$(curl https://${VEN_API_HOST}/outagedetection/v1/applications --fail-with-body -sSL -H tppl-api-key:\ ${VEN_API_KEY})" \
164+
| curl https://${VEN_API_HOST}/v1/serviceaccounts \
165+
-H "tppl-api-key: $VEN_API_KEY" \
166+
--fail-with-body \
167+
-sSL --json @-
173168
done
174169

175170
kubectl apply -n venafi -f - <<EOF
@@ -190,14 +185,14 @@ spec:
190185
tenantID: ${tenantID}
191186
EOF
192187

193-
envsubst < application-team-1.yaml | kubectl apply -f -
188+
envsubst <application-team-1.yaml | kubectl apply -f -
194189
kubectl -n team-1 wait certificate app-0 --for=condition=Ready
195190

196191
# Wait for log message indicating success.
197192
# Filter out distracting data gatherer errors and warnings.
198193
# Show other useful log messages on stderr.
199194
kubectl logs deployments/venafi-kubernetes-agent \
200-
--follow \
201-
--namespace venafi \
202-
| tee >(grep -v -e "reflector\.go" -e "datagatherer" -e "data gatherer" > /dev/stderr) \
203-
| grep -q "Data sent successfully"
195+
--follow \
196+
--namespace venafi \
197+
| tee >(grep -v -e "reflector\.go" -e "datagatherer" -e "data gatherer" >/dev/stderr) \
198+
| grep -q "Data sent successfully"

0 commit comments

Comments
 (0)