Skip to content

Commit 31a5f2d

Browse files
davidhadasdavidhadas
authored
releaseUpdates (#188)
* releaseUpdates * nits
1 parent 18ffe65 commit 31a5f2d

File tree

5 files changed

+352
-1
lines changed

5 files changed

+352
-1
lines changed

‎hack/generate-yamls.sh‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,16 @@ rm -fr ${YAML_OUTPUT_DIR}/*.yaml
5151
# Generated Knative component YAML files
5252
readonly SECURED_HELLO_YAML=${YAML_OUTPUT_DIR}/secured-helloworld.yaml
5353
readonly SECURED_LAYERED_MYAPP_YAML=${YAML_OUTPUT_DIR}/secured-layered-myapp.yaml
54+
readonly TESTSRV_YAML=${YAML_OUTPUT_DIR}/testsrv.yaml
5455
readonly CREATE_SECRETS_YAML=${YAML_OUTPUT_DIR}/create-secrets.yaml
5556
readonly CONFIG_FEATURES_YAML=${YAML_OUTPUT_DIR}/config-features.yaml
5657
readonly GUARD_SERVICE_YAML=${YAML_OUTPUT_DIR}/guard-service.yaml
5758
readonly QUEUE_PROXY_YAML=${YAML_OUTPUT_DIR}/queue-proxy.yaml
5859
readonly GATE_ACCOUNT_YAML=${YAML_OUTPUT_DIR}/gate-account.yaml
5960
readonly SERVICE_ACCOUNT_YAML=${YAML_OUTPUT_DIR}/service-account.yaml
6061
readonly GUARDIAN_CRD_YAML=${YAML_OUTPUT_DIR}/guardian-crd.yaml
62+
readonly DEPLOY_KIND=${YAML_OUTPUT_DIR}/deploy-kind.sh
63+
readonly DEPLOY_KNATIVE_KIND=${YAML_OUTPUT_DIR}/deploy-knative-kind.sh
6164

6265
# Flags for all ko commands
6366
KO_YAML_FLAGS="-P"
@@ -85,38 +88,46 @@ echo "Building Knative Secuity-Guard"
8588
echo KO_YAML_FLAGS: ${KO_YAML_FLAGS}
8689
ko resolve ${KO_YAML_FLAGS} -f config-kubernetes/deploy/secured-helloworld.yaml | "${LABEL_YAML_CMD[@]}" > "${SECURED_HELLO_YAML}"
8790
ko resolve ${KO_YAML_FLAGS} -f config-kubernetes/deploy/secured-layered-myapp.yaml | "${LABEL_YAML_CMD[@]}" > "${SECURED_LAYERED_MYAPP_YAML}"
91+
ko resolve ${KO_YAML_FLAGS} -f test/e2e/services/httptest/deploy.yaml | "${LABEL_YAML_CMD[@]}" > "${TESTSRV_YAML}"
8892
ko resolve ${KO_YAML_FLAGS} -f config-kubernetes/deploy/create-secrets.yaml | "${LABEL_YAML_CMD[@]}" > "${CREATE_SECRETS_YAML}"
8993
ko resolve ${KO_YAML_FLAGS} -f config/deploy/config-features.yaml | "${LABEL_YAML_CMD[@]}" > "${CONFIG_FEATURES_YAML}"
9094
ko resolve ${KO_YAML_FLAGS} -f config/deploy/guard-service.yaml | "${LABEL_YAML_CMD[@]}" > "${GUARD_SERVICE_YAML}"
9195
ko resolve ${KO_YAML_FLAGS} -f config/deploy/queue-proxy.yaml | "${LABEL_YAML_CMD[@]}" > "${QUEUE_PROXY_YAML}"
9296
ko resolve ${KO_YAML_FLAGS} -f config/resources/gateAccount.yaml | "${LABEL_YAML_CMD[@]}" > "${GATE_ACCOUNT_YAML}"
9397
ko resolve ${KO_YAML_FLAGS} -f config/resources/serviceAccount.yaml | "${LABEL_YAML_CMD[@]}" > "${SERVICE_ACCOUNT_YAML}"
9498
ko resolve ${KO_YAML_FLAGS} -f config/resources/guardiansCrd.yaml | "${LABEL_YAML_CMD[@]}" > "${GUARDIAN_CRD_YAML}"
99+
cp hack/kind/deployKind.sh "${DEPLOY_KIND}"
100+
cp hack/kind/deployKnativeKind.sh "${DEPLOY_KNATIVE_KIND}"
95101
echo "All manifests generated"
96102

97103
# List generated YAML files
98104

99105
cat << EOF > ${YAML_LIST_FILE}
100106
${SECURED_HELLO_YAML}
101107
${SECURED_LAYERED_MYAPP_YAML}
108+
${TESTSRV_YAML}
102109
${CREATE_SECRETS_YAML}
103110
${CONFIG_FEATURES_YAML}
104111
${GUARD_SERVICE_YAML}
105112
${QUEUE_PROXY_YAML}
106113
${GATE_ACCOUNT_YAML}
107114
${SERVICE_ACCOUNT_YAML}
108115
${GUARDIAN_CRD_YAML}
109-
116+
${DEPLOY_KIND}
117+
${DEPLOY_KNATIVE_KIND}
110118
EOF
111119

112120
cat << EOF > "${YAML_ENV_FILE}"
113121
export SECURED_HELLO_YAML=${SECURED_HELLO_YAML}
114122
export SECURED_LAYERED_MYAPP_YAML=${SECURED_LAYERED_MYAPP_YAML}
123+
export TESTSRV_YAML=${TESTSRV_YAML}
115124
export CREATE_SECRETS_YAML=${CREATE_SECRETS_YAML}
116125
export CONFIG_FEATURES_YAML=${CONFIG_FEATURES_YAML}
117126
export GUARD_SERVICE_YAML=${GUARD_SERVICE_YAML}
118127
export QUEUE_PROXY_YAML=${QUEUE_PROXY_YAML}
119128
export GATE_ACCOUNT_YAML=${GATE_ACCOUNT_YAML}
120129
export SERVICE_ACCOUNT_YAML=${SERVICE_ACCOUNT_YAML}
121130
export GUARDIAN_CRD_YAML=${GUARDIAN_CRD_YAML}
131+
export DEPLOY_KIND=${DEPLOY_KIND}
132+
export DEPLOY_KNATIVE_KIND=${DEPLOY_KNATIVE_KIND}
122133
EOF

‎hack/kind/deployKind.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2022 The Knative Authors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Create Kind cluster
18+
kind delete cluster --name k8s
19+
kind create cluster --config ./hack/kind/kind-config.yaml
20+
kubectl cluster-info --context kind-k8s
21+
kubectl create namespace knative-serving
22+
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
23+
24+
#Create K8s resources CRD, ServiceAccounts etc.
25+
kubectl apply -f https://raw.githubusercontent.com/knative-sandbox/security-guard/release-0.5/config/resources/gateAccount.yaml
26+
kubectl apply -f https://raw.githubusercontent.com/knative-sandbox/security-guard/release-0.5/config/resources/serviceAccount.yaml
27+
kubectl apply -f https://raw.githubusercontent.com/knative-sandbox/security-guard/release-0.5/config/resources/guardiansCrd.yaml
28+
29+
# start create-secrets
30+
kubectl apply -f https://github.com/knative-sandbox/security-guard/releases/download/v0.5.0/create-secrets.yaml
31+
32+
# start guard-service
33+
kubectl apply -f https://github.com/knative-sandbox/security-guard/releases/download/v0.5.0/guard-service.yaml
34+
35+
# wait for keys to be ready
36+
kubectl wait --namespace knative-serving --for=condition=complete job/create-knative-secrets --timeout=120s
37+
38+
# wait for ingress to be ready
39+
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller --timeout=120s
40+
41+
# Copying secert to namespace: \"default\"
42+
REPLACE_NS="s/ namespace: .*/ namespace: default/"
43+
REPLACE_NAME="s/ name: knative-serving-certs/ name: default-serving-certs/"
44+
kubectl get secret knative-serving-certs --namespace=knative-serving -o yaml |sed "${REPLACE_NS}" |sed "${REPLACE_NAME}" |sed "s/ selfLink: .*/ /"|sed "s/ uid: .*/ /" |sed "s/ resourceVersion: .*/ /" |kubectl apply -f -
45+
46+
#add hellowworld - protected using a guard sidecar (the recommended pattern)
47+
kubectl apply -f https://github.com/knative-sandbox/security-guard/releases/download/v0.5.0/secured-helloworld.yaml
48+
49+
#add myapp - protected using a separate guard pod (non-recommended pattern)
50+
kubectl apply -f https://github.com/knative-sandbox/security-guard/releases/download/v0.5.0/secured-layered-myapp.yaml

‎hack/kind/deployKnativeKind.sh‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2022 The Knative Authors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
export KO_DOCKER_REPO=ko.local
18+
19+
# Knative install using quickstart
20+
kn quickstart kind -n k8s --install-serving
21+
22+
#Create K8s resources CRD, ServiceAccounts etc.
23+
kubectl apply -f https://raw.githubusercontent.com/knative-sandbox/security-guard/release-0.5/config/resources/gateAccount.yaml
24+
kubectl apply -f https://raw.githubusercontent.com/knative-sandbox/security-guard/release-0.5/config/resources/serviceAccount.yaml
25+
kubectl apply -f https://raw.githubusercontent.com/knative-sandbox/security-guard/release-0.5/config/resources/guardiansCrd.yaml
26+
27+
# Kind seem to sometime need some extra time
28+
sleep 10
29+
30+
# adjust knative to use guard
31+
kubectl apply -f https://github.com/knative-sandbox/security-guard/releases/download/v0.5.0/queue-proxy.yaml
32+
kubectl apply -f https://github.com/knative-sandbox/security-guard/releases/download/v0.5.0/config-features.yaml
33+
34+
# start guard-service
35+
kubectl apply -f https://github.com/knative-sandbox/security-guard/releases/download/v0.5.0/guard-service.yaml
36+
37+
# Activate internal encryption
38+
kubectl patch configmap config-network -n knative-serving --type=merge -p '{"data": {"internal-encryption": "true"}}'
39+
40+
# Restart activator pod
41+
kubectl rollout restart deployment activator -n knative-serving

‎test/e2e/services/httptest/deploy.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: testsrv
5+
labels:
6+
app: testsrv
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
app: testsrv
12+
template:
13+
metadata:
14+
labels:
15+
app: testsrv
16+
spec:
17+
containers:
18+
- name: testsrv
19+
image: ko://knative.dev/security-guard/test/e2e/services/httptest
20+
imagePullPolicy: IfNotPresent
21+
ports:
22+
- containerPort: 8080
23+
---
24+
apiVersion: v1
25+
kind: Service
26+
metadata:
27+
name: testsrv
28+
namespace: knative-serving
29+
spec:
30+
selector:
31+
app: testsrv
32+
ports:
33+
- name: http
34+
protocol: TCP
35+
port: 8080

0 commit comments

Comments
 (0)