8dba799c18
This phase builded on top of generic executor container.
It uses kustomize generator to generate secrets
and SOPS function to encrypt secrets.
Usage:
1. `curl -fsSL -o key.asc https://raw.githubusercontent.com/mozilla/sops/master/pgp/sops_functional_tests_key.asc`
Copy existing key from sops project
2. `export SOPS_IMPORT_PGP="$(cat key.asc)" && export SOPS_PGP_FP="FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4"`
3. `airshipctl phase run secret-generate`
It will generate and encrypt secret in
manifests/site/test-site/target/generator/results/generated/
4. `KUSTOMIZE_PLUGIN_HOME=$(pwd)/manifests SOPS_IMPORT_PGP=$(cat key.asc) kustomize build --enable_alpha_plugins
manifests/site/test-site/target/catalogues/ > output.txt`
It will decrypt encrypted secret
Co-authored-by: Alexey Odinokov <aodinokov@mirantis.com>
Change-Id: I1682d71b7805eb36c407e712dcb747de799bc8bb
Relates-To: #379
172 lines
4.4 KiB
YAML
172 lines
4.4 KiB
YAML
---
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: KubernetesApply
|
|
metadata:
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
name: kubernetes-apply
|
|
config:
|
|
waitOptions:
|
|
timeout: 2000
|
|
pruneOptions:
|
|
prune: false
|
|
---
|
|
# This is added to support phase with no-wait
|
|
# When there is a wait, then it does status-check and fails
|
|
# if the resource status(condition) is not met.
|
|
# There are cases where the resource do not have status
|
|
# field implemeneted. So a wait will fail with status check
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: KubernetesApply
|
|
metadata:
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
name: kubernetes-apply-nowait
|
|
config:
|
|
waitOptions:
|
|
timeout: 0
|
|
pruneOptions:
|
|
prune: false
|
|
---
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: Clusterctl
|
|
metadata:
|
|
name: clusterctl_move
|
|
move-options: {}
|
|
action: move
|
|
---
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: IsoConfiguration
|
|
metadata:
|
|
name: isogen
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
builder:
|
|
outputFileName: ephemeral.iso
|
|
container:
|
|
containerRuntime: docker
|
|
image: quay.io/airshipit/image-builder:latest-ubuntu_focal
|
|
volume: /srv/images:/config
|
|
---
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: GenericContainer
|
|
metadata:
|
|
name: encrypter
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
kustomizeSinkOutputDir: "target/generator/results/generated"
|
|
spec:
|
|
container:
|
|
image: quay.io/aodinokov/sops:v0.0.3
|
|
envs:
|
|
- SOPS_IMPORT_PGP
|
|
- SOPS_PGP_FP
|
|
config: |
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
data:
|
|
cmd: encrypt
|
|
unencrypted-regex: '^(kind|apiVersion|group|metadata)$'
|
|
---
|
|
# This executor launchs a bootstrap container, which creates
|
|
# an Azure Kubernetes Service (AKS) cluster
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: BootConfiguration
|
|
metadata:
|
|
name: ephemeral-az-genesis
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
ephemeralCluster:
|
|
bootstrapCommand: create
|
|
configFilename: azure-config.yaml
|
|
bootstrapContainer:
|
|
containerRuntime: docker
|
|
image: quay.io/airshipit/capz-bootstrap:latest
|
|
volume: /tmp:/kube
|
|
saveKubeconfigFileName: capz.kubeconfig
|
|
---
|
|
# This executor launchs a bootstrap container, which deletes
|
|
# an Azure Kubernetes Service (AKS) cluster
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: BootConfiguration
|
|
metadata:
|
|
name: ephemeral-az-cleanup
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
ephemeralCluster:
|
|
bootstrapCommand: delete
|
|
configFilename: azure-config.yaml
|
|
bootstrapContainer:
|
|
containerRuntime: docker
|
|
image: quay.io/airshipit/capz-bootstrap:latest
|
|
volume: /tmp:/kube
|
|
saveKubeconfigFileName: capz.kubeconfig
|
|
---
|
|
# This executor launchs a bootstrap container, which creates
|
|
# a Google Kubernetes Engine (GKE) cluster
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: BootConfiguration
|
|
metadata:
|
|
name: ephemeral-gcp-genesis
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
ephemeralCluster:
|
|
bootstrapCommand: create
|
|
configFilename: gcp-config.yaml
|
|
bootstrapContainer:
|
|
containerRuntime: docker
|
|
image: quay.io/airshipit/capg-bootstrap:latest
|
|
volume: /tmp:/kube
|
|
saveKubeconfigFileName: capg.kubeconfig
|
|
---
|
|
# This executor launchs a bootstrap container, which deletes
|
|
# a Google Kubernetes Engine (GKE) cluster
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: BootConfiguration
|
|
metadata:
|
|
name: ephemeral-gcp-cleanup
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
ephemeralCluster:
|
|
bootstrapCommand: delete
|
|
configFilename: gcp-config.yaml
|
|
bootstrapContainer:
|
|
containerRuntime: docker
|
|
image: quay.io/airshipit/capg-bootstrap:latest
|
|
volume: /tmp:/kube
|
|
saveKubeconfigFileName: capg.kubeconfig
|
|
---
|
|
# This executor launchs a bootstrap container, which creates
|
|
# an ephemeral K8S cluster in Openstack
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: BootConfiguration
|
|
metadata:
|
|
name: ephemeral-os-genesis
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
ephemeralCluster:
|
|
bootstrapCommand: create
|
|
configFilename: openstack-config.yaml
|
|
bootstrapContainer:
|
|
containerRuntime: docker
|
|
image: quay.io/airshipit/capo-ephemeral:latest
|
|
volume: /tmp:/kube
|
|
saveKubeconfigFileName: capo.kubeconfig
|
|
---
|
|
# This executor launchs a bootstrap container, which deletes
|
|
# ephemeral K8S cluster in Openstack
|
|
apiVersion: airshipit.org/v1alpha1
|
|
kind: BootConfiguration
|
|
metadata:
|
|
name: ephemeral-os-cleanup
|
|
labels:
|
|
airshipit.org/deploy-k8s: "false"
|
|
ephemeralCluster:
|
|
bootstrapCommand: delete
|
|
configFilename: openstack-config.yaml
|
|
bootstrapContainer:
|
|
containerRuntime: docker
|
|
image: quay.io/airshipit/capo-ephemeral:latest
|
|
volume: /tmp:/kube
|
|
saveKubeconfigFileName: capo.kubeconfig
|