mirror
/
drone-kubernetes
mirror of https://github.com/honestbee/drone-kubernetes.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge 78e44f22aa into b71e43dc6d

This commit is contained in:
Hashfyre 2018-01-10 13:19:17 +00:00 committed by GitHub
parent b71e43dc6d 78e44f22aa
commit f74a7c7e37
4 changed files with 118 additions and 128 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored Normal file
View File

@ -0,0 +1,2 @@
.DS_STORE
tmp

6
Dockerfile
View File

@ -1,7 +1,7 @@
FROM alpine:3.4 FROM alpine:3.4
RUN apk --no-cache add curl ca-certificates bash RUN apk --no-cache add curl ca-certificates bash && \
RUN curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && \
RUN chmod +x /usr/local/bin/kubectl chmod +x /usr/local/bin/kubectl
COPY update.sh /bin/ COPY update.sh /bin/
ENTRYPOINT ["/bin/bash"] ENTRYPOINT ["/bin/bash"]
CMD ["/bin/update.sh"] CMD ["/bin/update.sh"]

154
README.md
View File

@ -1,122 +1,76 @@
# Kubernetes plugin for drone.io [![Docker Repository on Quay](https://quay.io/repository/honestbee/drone-kubernetes/status "Docker Repository on Quay")](https://quay.io/repository/honestbee/drone-kubernetes) # Kubernetes plugin for drone.io [Docker Repository on Docker Cloud](https://cloud.docker.com/app/razorpay/repository/docker/razorpay/drone-kubernetes)
## Borrowed and distilled from [honestbee/drone-kubernetes](https://github.com/honestbee/drone-kubernetes)
This plugin allows to update a Kubernetes deployment. This plugin allows to update a Kubernetes deployment.
- Cert based auth for tls
- Insecure auth without tls
This version deprecates token based auth
## Usage ## Usage
This pipeline will update the `my-deployment` deployment with the image tagged `DRONE_COMMIT_SHA:0:8` This pipeline will update the `my-deployment` deployment with the image tagged `DRONE_COMMIT_SHA:0:8`
```yaml ```yaml
pipeline: pipeline:
deploy: deploy:
image: quay.io/honestbee/drone-kubernetes image: razorpay/drone-kubernetes
deployment: my-deployment pull: true
repo: myorg/myrepo secrets:
container: my-container - docker_username
- docker_password
- server_url_<cluster>
- server_cert_<cluster>
- client_cert_<cluster>
- client_key_<cluster>
- ...
user: <kubernetes-user with a cluster-rolebinding>
cluster: <kubernetes-cluster>
deployment: [<kubernetes-deployements, ...>]
repo: <org/repo>
container: [ <containers,...> ]
namespace: <kubernetes-namespace>
tag: tag:
- mytag - ${DRONE_REPO_BRANCH}-${DRONE_COMMIT_SHA}
- latest - ...
```
Deploying containers across several deployments, eg in a scheduler-worker setup. Make sure your container `name` in your manifest is the same for each pod.
```yaml
pipeline:
deploy:
image: quay.io/honestbee/drone-kubernetes
deployment: [server-deploy, worker-deploy]
repo: myorg/myrepo
container: my-container
tag:
- mytag
- latest
```
Deploying multiple containers within the same deployment.
```yaml
pipeline:
deploy:
image: quay.io/honestbee/drone-kubernetes
deployment: my-deployment
repo: myorg/myrepo
container: [container1, container2]
tag:
- mytag
- latest
```
**NOTE**: Combining multi container deployments across multiple deployments is not recommended
This more complex example demonstrates how to deploy to several environments based on the branch, in a `app` namespace
```yaml
pipeline:
deploy-staging:
image: quay.io/honestbee/drone-kubernetes
kubernetes_server: ${KUBERNETES_SERVER_STAGING}
kubernetes_cert: ${KUBERNETES_CERT_STAGING}
kubernetes_token: ${KUBERNETES_TOKEN_STAGING}
deployment: my-deployment
repo: myorg/myrepo
container: my-container
namespace: app
tag:
- mytag
- latest
when: when:
branch: [ staging ] environment: <kubernetes-cluster>
branch: [ <branches>,... ]
deploy-prod: event:
image: quay.io/honestbee/drone-kubernetes exclude: [push, pull_request, tag]
kubernetes_server: ${KUBERNETES_SERVER_PROD} include: [deployment]
kubernetes_token: ${KUBERNETES_TOKEN_PROD}
# notice: no tls verification will be done, warning will is printed
deployment: my-deployment
repo: myorg/myrepo
container: my-container
namespace: app
tag:
- mytag
- latest
when:
branch: [ master ]
``` ```
## Required secrets ## Required secrets
```bash - server_url
drone secret add --image=honestbee/drone-kubernetes \ - tls:
your-user/your-repo KUBERNETES_SERVER https://mykubernetesapiserver - server_cert
- `kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.crt:' > ca.crt`
drone secret add --image=honestbee/drone-kubernetes \ - `kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.key:' > ca.key`
your-user/your-repo KUBERNETES_CERT <base64 encoded CA.crt> - client_cert
- client_key
drone secret add --image=honestbee/drone-kubernetes \ - ```
your-user/your-repo KUBERNETES_TOKEN eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJ... openssl genrsa -out client.key
``` openssl req -new -key client.key -out client.csr -subj "/CN=drone/O=org"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 500
```
- ```
cat ca.crt | base64 > car.crt.enc
cat client.crt | base64 > client.crt.enc
cat client.key | base64 > client.key.enc
```
- ```
drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name server_url_<cluster> -value https://k8s.org.com.:443
drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name server_cert_<cluster> -value @./ca.crt.enc
drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name client_cert_<cluster> -value @./client.crt.enc
drone secret add -repository razorpay/gimli -image razorpay/drone-kubernetes -event deployment -name client_key_<cluster> -value @./client.key.enc
```
When using TLS Verification, ensure Server Certificate used by kubernetes API server When using TLS Verification, ensure Server Certificate used by kubernetes API server
is signed for SERVER url ( could be a reason for failures if using aliases of kubernetes cluster ) is signed for SERVER url ( could be a reason for failures if using aliases of kubernetes cluster )
## How to get token
1. After deployment inspect you pod for name of (k8s) secret with **token** and **ca.crt**
```bash
kubectl describe po/[ your pod name ] | grep SecretName | grep token
```
(When you use **default service account**)
2. Get data from you (k8s) secret
```bash
kubectl get secret [ your default secret name ] -o yaml | egrep 'ca.crt:|token:'
```
3. Copy-paste contents of ca.crt into your drone's **KUBERNETES_CERT** secret
4. Decode base64 encoded token
```bash
echo [ your k8s base64 encoded token ] | base64 -d && echo''
```
5. Copy-paste decoded token into your drone's **KUBERNETES_TOKEN** secret
### RBAC ### RBAC
When using a version of kubernetes with RBAC (role-based access control) When using a version of kubernetes with RBAC (role-based access control)

74
update.sh
View File

@ -1,40 +1,74 @@
#!/bin/bash #!/bin/bash
set -euo pipefail
if [ -z ${PLUGIN_NAMESPACE} ]; then # check optional params
PLUGIN_NAMESPACE="default" if [ ! -z ${PLUGIN_USER} ]; then
USER=${PLUGIN_USER:-default}
fi fi
if [ ! -z ${PLUGIN_KUBERNETES_TOKEN} ]; then if [ ! -z ${PLUGIN_NAMESPACE} ]; then
KUBERNETES_TOKEN=$PLUGIN_KUBERNETES_TOKEN NAMESPACE=${PLUGIN_NAMESPACE:-default}
fi fi
if [ ! -z ${PLUGIN_KUBERNETES_SERVER} ]; then # check required params
KUBERNETES_SERVER=$PLUGIN_KUBERNETES_SERVER if [ ! -z ${PLUGIN_CLUSTER} ]; then
fi # convert cluster name to ucase and assign
CLUSTER=${PLUGIN_CLUSTER^^}
if [ ! -z ${PLUGIN_KUBERNETES_CERT} ]; then # create dynamic cert var names
KUBERNETES_CERT=${PLUGIN_KUBERNETES_CERT} SERVER_URL_VAR=SERVER_URL_${CLUSTER}
fi SERVER_CERT_VAR=SERVER_CERT_${CLUSTER}
CLIENT_CERT_VAR=CLIENT_CERT_${CLUSTER}
CLIENT_KEY_VAR=CLIENT_KEY_${CLUSTER}
kubectl config set-credentials default --token=${KUBERNETES_TOKEN} # expand the var contents
if [ ! -z ${KUBERNETES_CERT} ]; then SERVER_URL=${!SERVER_URL_VAR}
echo ${KUBERNETES_CERT} | base64 -d > ca.crt SERVER_CERT=${!SERVER_CERT_VAR}
kubectl config set-cluster default --server=${KUBERNETES_SERVER} --certificate-authority=ca.crt CLIENT_CERT=${!CLIENT_CERT_VAR}
CLIENT_KEY=${!CLIENT_KEY_VAR}
if [[ -z "${SERVER_URL}" ]]; then
echo "[ERROR] drone secret: ${SERVER_URL_VAR} not added!"
exit 1
fi
if [[ ! -z "${SERVER_CERT}" ]]; then
echo "[INFO] Using secure connection with tls-certificate."
echo ${SERVER_CERT} | base64 -d > ca.crt
kubectl config set-cluster default --server=${SERVER_URL} --certificate-authority=ca.crt
if [[ ! -z "${CLIENT_CERT}" ]] && [[ ! -z "${CLIENT_KEY}" ]]; then
echo "[INFO] Setting client credentials with signed-certificate and key."
echo ${CLIENT_CERT} | base64 -d > client.crt
echo ${CLIENT_KEY} | base64 -d > client.key
kubectl config set-credentials ${USER} --client-certificate=client.crt --client-key=client.key
else
echo "[ERROR] Required plugin parameters:"
echo " - client_cert"
echo " - client_key"
echo "are not provided"
exit 1
fi
else
echo "[WARNING] Required plugin parameter: ${SERVER_CERT_VAR} not added!"
echo "[WARNING] Using insecure connection to cluster"
kubectl config set-cluster default --server=${SERVER_URL} --insecure-skip-tls-verify=true
fi
else else
echo "WARNING: Using insecure connection to cluster" echo "[ERROR] Required pipeline parameter: cluster not provided"
kubectl config set-cluster default --server=${KUBERNETES_SERVER} --insecure-skip-tls-verify=true exit 1
fi fi
kubectl config set-context default --cluster=default --user=default kubectl config set-context default --cluster=default --user=${USER}
kubectl config use-context default kubectl config use-context default
# kubectl version # kubectl version
IFS=',' read -r -a DEPLOYMENTS <<< "${PLUGIN_DEPLOYMENT}" IFS=',' read -r -a DEPLOYMENTS <<< "${PLUGIN_DEPLOYMENT}"
IFS=',' read -r -a CONTAINERS <<< "${PLUGIN_CONTAINER}" IFS=',' read -r -a CONTAINERS <<< "${PLUGIN_CONTAINER}"
for DEPLOY in ${DEPLOYMENTS[@]}; do for DEPLOY in ${DEPLOYMENTS[@]}; do
echo Deploying to $KUBERNETES_SERVER echo Deploying to ${CLUSTER}
for CONTAINER in ${CONTAINERS[@]}; do for CONTAINER in ${CONTAINERS[@]}; do
kubectl -n ${PLUGIN_NAMESPACE} set image deployment/${DEPLOY} \ kubectl -n ${NAMESPACE} set image deployment/${DEPLOY} \
${CONTAINER}=${PLUGIN_REPO}:${PLUGIN_TAG} --record ${CONTAINER}="${PLUGIN_REPO}:${PLUGIN_TAG}" --record
done done
done done