devspace.yaml

version: v2beta1
name: provider-natssecrets

vars:
  ca_root:
    command: echo $HOME/.devspace/ca/
  creds_dir:
    command: echo .devspace/creds/

commands:
  help: |-
    #!/bin/bash
    set -e
    GREEN='\033[0;32m'
    BRED='\033[3;31m'
    BGREEN='\033[1;32m'
    GREY='\033[0;36m'
    BOLD='\033[1m'
    NC='\033[0m' # No Color
    echo -e "${BGREEN}Usage of ${BRED}edgefarm.core:${NC}"
    echo -e "${GREEN} General cluster commands:${NC}"
    echo -e "${BOLD}  devspace run create-kind-cluster                    ${GREY}Creates a local running Kubernetes cluster with kind${NC}"
    echo -e "${BOLD}  devspace run delete-kind-cluster                    ${GREY}Deletes the local running Kubernetes cluster with kind${NC}"
    echo -e "${BOLD}  devspace run-pipeline init                          ${GREY}Deploy some basic resources to the cluster${NC}"
    echo -e "${GREEN} EdgeFarm related commands:${NC}"
    echo -e "${BOLD}  devspace run-pipeline deploy-vault                  ${GREY}Deploy the vault with NATS secrets plugin${NC}"
    echo -e "${BOLD}  devspace run-pipeline deploy-crossplane             ${GREY}Deploy crossplane and provider-natssecrets${NC}"
    echo -e "${BOLD}  devspace run-pipeline deploy-nats                   ${GREY}Deploy the deploy preconfigured a NATS server${NC}"
    echo -e "${BOLD}  devspace run-pipeline create-custom-nats-account    ${GREY}Create a custom NATS account and user${NC}"

  check-prerequisites: |-
    #!/bin/bash
    set -e
    # Check if kubectl is installed
    if ! command -v kubectl &> /dev/null
    then
        echo "kubectl could not be found. Please install kubectl."
        exit
    fi
    # Check if mkcert is installed
    if ! command -v mkcert &> /dev/null
    then
        echo "mkcert could not be found. Please install mkcert (https://github.com/FiloSottile/mkcert)."
        exit
    fi
    # Check if jq is installed
    if ! command -v jq &> /dev/null
    then
        echo "jq could not be found. Please install jq (https://stedolan.github.io/jq/)."
        exit
    fi
    # Check if helm is installed
    if ! command -v helm &> /dev/null
    then
        echo "helm could not be found. Please install helm (https://helm.sh/docs/intro/install/)."
        exit
    fi
    # Check if kustomize is installed
    if ! command -v kustomize &> /dev/null
    then
        echo "kustomize could not be found. Please install kustomize (https://kubectl.docs.kubernetes.io/installation/kustomize/)."
        exit
    fi
    # Check if docker is installed
    if ! command -v docker &> /dev/null
    then
        echo "docker could not be found. Please install docker (https://docs.docker.com/get-docker/)."
        exit
    fi

  create-kind-cluster: |-
    #!/bin/bash
    set -e

    devspace run check-prerequisites

    # Check if kind is installed
    if ! command -v kind &> /dev/null
    then
        echo "kind could not be found. Please install kind (https://kind.sigs.k8s.io/docs/user/quick-start/#installation)."
        exit
    fi

    kind create cluster --name natssecrets --image kindest/node:v1.24.7 --config dev/kind/config.yaml
    kubectl config use-context kind-natssecrets
    kubectl config set-context --current --namespace kind-natssecrets

  delete-kind-cluster: |-
    #!/bin/bash
    set -e

    kind delete cluster --name natssecrets || true
    kubectl config delete-context kind-natssecrets 2>/dev/null || true
    kubectl config delete-cluster kind-natssecrets 2>/dev/null || true
    kubectl config delete-user admin@kind-natssecrets 2>/dev/null || true

functions:
  wait_for_crd: |-
    #!/bin/bash
    set -e
    echo "wait for crd/$1"
    until kubectl wait --for=condition=established "crd/$1" --timeout=60s 2>/dev/null; do echo -n "." && sleep 2; done

  wait_for_deployment: |-
    #!/bin/bash
    set -e
    echo "wait for deployment/$1 (ns: $2)"
    until kubectl wait --for=condition=available deployment/$1 -n $2 --timeout=60s 2>/dev/null; do echo -n "." && sleep 2; done

  wait_for_pod: |-
    #!/bin/bash
    set -e
    echo "wait for pod $1 (ns: $2)"
    until kubectl wait --for=condition=ready pod -n $2 $1 --timeout=60s 2>/dev/null; do echo -n "." && sleep 2; done

  wait_for_ressource: |-
    #!/bin/bash
    set -e
    echo "wait for ressource $1 (ns: $2)"
    until kubectl get $1 -n $2 2>/dev/null; do echo -n "." && sleep 2; done;

  wait_for_secret_key: |-
    #!/bin/bash
    set -e
    echo "wait for key $3 in secret $1 (ns: $2)"
    until [[ $(kubectl get secret/$1 -n $2 -o yaml | grep $3 | wc -l) -ge 1 ]] ; do echo -n "." && sleep 2; done
    echo " done"

  import_root_ca: |-
    # usage: import_root_ca <CAROOT> <secret name> <namespace>
    #!/usr/bin/env bash
    set -e
    set -u
    export CAROOT=${1}
    if [ "$#" -ne 3 ]; then
        echo "Illegal number of parameters"
        echo "import_root_ca <CAROOT> <ca_secret_name> <ca_secret_namespace>"
        exit 1
    fi
    if ! [ -d "${CAROOT}" ]; then
        echo "Creating self-signed CA ${2}"
        mkdir -p ${CAROOT}
        mkcert || true
    fi
    kubectl -n ${3} create secret tls ${2} \
        --key=${CAROOT}/rootCA-key.pem \
        --cert=${CAROOT}/rootCA.pem \
        --dry-run=client --output yaml | kubectl apply -f -

  init_ca: |-
    # usage init_ca <CAROOT>
    #!/usr/bin/env bash
    set -e
    set -u
    export CAROOT=${1}

    if [ "$#" -ne 1 ]; then
      echo "Illegal number of parameters"
      echo "init_ca"
      exit 1
    fi
    echo "installing ${CAROOT}"
    mkcert -install || true

pipelines:
  init: |-
    #!/bin/bash
    set -e
    devspace run check-prerequisites
    # install cert-manager and nginx-ingress
    create_deployments cert-manager nginx-ingress
    wait_for_deployment cert-manager cert-manager
    wait_for_deployment cert-manager-cainjector cert-manager
    wait_for_deployment cert-manager-webhook cert-manager
    wait_for_crd certificates.cert-manager.io
    wait_for_pod "-l app.kubernetes.io/instance=ingress-nginx -l app.kubernetes.io/component=controller" ingress-nginx
    # install root certificate for cert-manager
    init_ca ${ca_root}
    import_root_ca ${ca_root} root-ca cert-manager
    create_deployments cert-manager-config

  deploy-vault: |-
    #!/bin/bash
    set -e
    devspace run check-prerequisites
    COLOR='\033[0;93m'
    NC='\033[0m'
    create_deployments vault-operator
    wait_for_pod "-l app.kubernetes.io/instance=vault-operator" vault
    create_deployments vault-config
    until kubectl wait --for=condition=ready pods -n vault -l vault_cr=vault --timeout=60s 2>/dev/null; do echo -n "." && sleep 2; done
    wait_for_secret_key bank-vaults vault vault-root
    echo "vault-root-token: $(kubectl get secrets bank-vaults -n vault -o jsonpath={.data.vault-root} | base64 --decode)"

  deploy-crossplane: |-
    #!/bin/bash
    set -e
    devspace run check-prerequisites
    # create_deployments crossplane
    # wait_for_deployment crossplane crossplane-system
    # wait_for_deployment crossplane-rbac-manager crossplane-system
    create_deployments provider-natssecrets
    kubectl wait --for=condition=installed --for=condition=healthy providers.pkg.crossplane.io provider-natssecrets
    # VAULT_TOKEN=$(kubectl get secrets bank-vaults -n vault -o jsonpath={.data.vault-root} | base64 --decode)
    # TEMPLATE=$(sed "s/VAULT_TOKEN/$VAULT_TOKEN/g" dev/manifests/resources/providerconfig/providerconfigsecret.yaml.tmpl)
    # echo "$TEMPLATE" | kubectl apply -f -
    # kubectl apply -f dev/manifests/resources/providerconfig/providerconfig.yaml
    # kubectl apply -f dev/manifests/resources/stage1 --recursive

  deploy-nats: |-
    #!/bin/bash
    set -e
    OPERATOR_JWT=$(kubectl get secrets myoperator -n crossplane-system -o jsonpath='{.data.jwt}' | base64 -d)
    SYS_ACCOUNT_PUBLIC_KEY=$(kubectl get secrets sys -n crossplane-system -o jsonpath='{.data.pub}' | base64 -d)
    SYS_ACCOUNT_JWT=$(kubectl get secrets sys -n crossplane-system -o jsonpath='{.data.jwt}' | base64 -d)
    TEMPLATE=$(sed "s/OPERATOR_JWT/$OPERATOR_JWT/g" dev/manifests/nats/configmap.yaml.template)
    TEMPLATE=$(sed "s/SYS_ACCOUNT_PUBLIC_KEY/$SYS_ACCOUNT_PUBLIC_KEY/g" <<< $TEMPLATE)
    TEMPLATE=$(sed "s/SYS_ACCOUNT_JWT/$SYS_ACCOUNT_JWT/g" <<< $TEMPLATE)

    echo "$TEMPLATE" > dev/manifests/nats/configmap.yaml
    create_deployments nats
    wait_for_deployment nats nats
    kubectl get operators -o wide
    kubectl get accounts -o wide
    kubectl get users -o wide

  create-custom-nats-account: |-
    #!/bin/bash
    set -e
    kubectl apply -f dev/manifests/resources/stage2  --recursive
    mkdir -p ${creds_dir}
    kubectl get secrets -n crossplane-system myuser -o jsonpath='{.data.creds}' | base64 -d > ${creds_dir}/creds
    kubectl get operators -o wide
    kubectl get accounts -o wide
    kubectl get users -o wide

  purge-nats: |-
    #!/bin/bash
    set -e
    kubectl delete -f dev/manifests/nats/configmap.yaml
    kubectl delete -f dev/manifests/nats/deployment.yaml
    kubectl delete -f dev/manifests/nats/service.yaml

deployments:
  local-path-provisioner:
    kubectl:
      manifests:
        - "https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.22/deploy/local-path-storage.yaml"
    namespace: kube-system

  cert-manager:
    kubectl:
      manifests:
        - https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.yaml
    namespace: cert-manager

  cert-manager-config:
    kubectl:
      manifests:
        - dev/manifests/cert-manager/
    namespace: cert-manager

  nginx-ingress:
    kubectl:
      manifests:
        - https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
    namespace: ingress-nginx

  vault-operator:
    helm:
      chart:
        name: vault-operator
        repo: https://kubernetes-charts.banzaicloud.com
    namespace: vault

  vault-config:
    kubectl:
      manifests:
        - dev/manifests/vault/
    namespace: vault

  nats:
    kubectl:
      manifests:
        - dev/manifests/nats/
    namespace: nats

  crossplane:
    helm:
      chart:
        name: crossplane
        repo: https://charts.crossplane.io/stable/
        version: "1.11.2"
      values:
        args:
          - --enable-composition-functions
          - --debug
        xfn:
          enabled: true
          args:
            - --debug
    namespace: crossplane-system

  provider-natssecrets:
    kubectl:
      manifests:
        - dev/manifests/provider-natssecrets/
    namespace: crossplane-system