-
Notifications
You must be signed in to change notification settings - Fork 621
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #877 from stealthybox/integrations-registry-creden…
…tials-sync Add ACR auth to Image Updates examples
- Loading branch information
Showing
33 changed files
with
1,034 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
20 changes: 20 additions & 0 deletions
20
manifests/integrations/registry-credentials-sync/_base/kustomization.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| apiVersion: kustomize.config.k8s.io/v1beta1 | ||
| kind: Kustomization | ||
|
|
||
| commonLabels: | ||
| app: credentials-sync | ||
|
|
||
| resources: | ||
| - sync.yaml | ||
|
|
||
| vars: | ||
| - name: KUBE_SECRET | ||
| objref: | ||
| kind: ConfigMap | ||
| name: credentials-sync | ||
| apiVersion: v1 | ||
| fieldref: | ||
| fieldpath: data.KUBE_SECRET | ||
|
|
||
| configurations: | ||
| - kustomizeconfig.yaml |
3 changes: 3 additions & 0 deletions
3
manifests/integrations/registry-credentials-sync/_base/kustomizeconfig.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| varReference: | ||
| - path: rules/resourceNames | ||
| kind: Role |
125 changes: 125 additions & 0 deletions
125
manifests/integrations/registry-credentials-sync/_base/sync.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| --- | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: credentials-sync | ||
| data: | ||
| # Patch this ConfigMap with additional values needed for your cloud | ||
| KUBE_SECRET: my-registry-token # does not yet exist -- will be created in the same Namespace | ||
| SYNC_PERIOD: "3600" # tokens expire; refresh faster than that | ||
|
|
||
| --- | ||
| # This Deployment frequently fetches registry tokens and applies them as an imagePullSecret. | ||
| # It's done as a 1-replica Deployment rather than a CronJob, because CronJob scheduling can | ||
| # block cluster bootstraps and cold-reboots from obtaining registry tokens for a considerable time. | ||
| # This deployment will immediately fetch a token, which reduces latency for working image updates. | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: credentials-sync | ||
| namespace: flux-system | ||
| spec: | ||
| replicas: 1 | ||
| strategy: | ||
| type: Recreate | ||
| template: | ||
| spec: | ||
| serviceAccount: credentials-sync | ||
| containers: | ||
| - image: busybox # override this with a cloud-specific image | ||
| name: sync | ||
| envFrom: | ||
| - configMapRef: | ||
| name: credentials-sync | ||
| env: | ||
| - name: RECONCILE_SH # override this env var with a shell function in a kustomize patch | ||
| value: |- | ||
| reconcile() { | ||
| echo reconciling... | ||
| } | ||
| command: | ||
| - bash | ||
| - -ceu | ||
| - |- | ||
| # template reconcile() into the script | ||
| # env var is expanded by k8s before the pod starts | ||
| $(RECONCILE_SH) | ||
| apply-secret() { | ||
| /kbin/kubectl create secret docker-registry "${1}" \ | ||
| --docker-server="${2}" \ | ||
| --docker-username="${3}" \ | ||
| --docker-password="${4}" \ | ||
| --dry-run=client -o=yaml \ | ||
| | grep -v "creationTimestamp:" \ | ||
| | /kbin/kubectl apply -f - | ||
| } | ||
| pause_loop() { | ||
| sleep "${SYNC_PERIOD:-3600}" || true | ||
| } | ||
| graceful_exit() { | ||
| echo "Trapped signal -- $(date)" | ||
| job_ids="$( | ||
| jobs \ | ||
| | grep "pause_loop" \ | ||
| | cut -d] -f1 \ | ||
| | tr [ % | ||
| )" | ||
| # shellcheck disable=SC2086 | ||
| if [ "${job_ids}" ]; then | ||
| kill ${job_ids} | ||
| fi | ||
| wait | ||
| echo "Graceful exit -- $(date)" | ||
| } | ||
| trap graceful_exit INT TERM | ||
| echo "Loop started (period: ${SYNC_PERIOD} s) -- $(date)" | ||
| while true; do | ||
| reconcile & wait $! | ||
| pause_loop & wait $! | ||
| done | ||
| resources: {} | ||
|
|
||
|
|
||
| # RBAC necessary for our Deployment to apply our imagePullSecret | ||
| --- | ||
| kind: Role | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: credentials-sync | ||
| namespace: flux-system | ||
| rules: | ||
| - apiGroups: [""] | ||
| resources: | ||
| - secrets | ||
| verbs: | ||
| - get | ||
| - create | ||
| - update | ||
| - patch | ||
| # # Lock this down to the specific Secret name (Optional) | ||
| resourceNames: | ||
| - $(KUBE_SECRET) # templated from kustomize vars referencing ConfigMap, also see kustomizeconfig.yaml | ||
| --- | ||
| kind: RoleBinding | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: credentials-sync | ||
| namespace: flux-system | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: credentials-sync | ||
| roleRef: | ||
| kind: Role | ||
| name: credentials-sync | ||
| apiGroup: rbac.authorization.k8s.io | ||
| --- | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: credentials-sync | ||
| namespace: flux-system |
20 changes: 20 additions & 0 deletions
20
manifests/integrations/registry-credentials-sync/_cronjobs/_base/kustomization.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| apiVersion: kustomize.config.k8s.io/v1beta1 | ||
| kind: Kustomization | ||
|
|
||
| commonLabels: | ||
| app: credentials-sync | ||
|
|
||
| resources: | ||
| - sync.yaml | ||
|
|
||
| vars: | ||
| - name: KUBE_SECRET | ||
| objref: | ||
| kind: ConfigMap | ||
| name: credentials-sync | ||
| apiVersion: v1 | ||
| fieldref: | ||
| fieldpath: data.KUBE_SECRET | ||
|
|
||
| configurations: | ||
| - kustomizeconfig.yaml |
3 changes: 3 additions & 0 deletions
3
manifests/integrations/registry-credentials-sync/_cronjobs/_base/kustomizeconfig.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| varReference: | ||
| - path: rules/resourceNames | ||
| kind: Role |
101 changes: 101 additions & 0 deletions
101
manifests/integrations/registry-credentials-sync/_cronjobs/_base/sync.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| --- | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: credentials-sync | ||
| data: | ||
| # Patch this ConfigMap with additional values needed for your cloud | ||
| KUBE_SECRET: my-registry-token # does not yet exist -- will be created in the same Namespace | ||
|
|
||
| --- | ||
| # This CronJob frequently fetches registry tokens and applies them as an imagePullSecret. | ||
| # note: CronJob scheduling can block cluster bootstraps and cold-reboots from obtaining registry tokens for a considerable time. | ||
| # To run the job immediately, do `kubectl create job --from=cronjob/credentials-sync -n flux-system credentials-sync-init` | ||
| apiVersion: batch/v1beta1 | ||
| kind: CronJob | ||
| metadata: | ||
| name: credentials-sync | ||
| namespace: flux-system | ||
| spec: | ||
| suspend: false | ||
| schedule: 0 */6 * * * | ||
| failedJobsHistoryLimit: 1 | ||
| successfulJobsHistoryLimit: 1 | ||
| jobTemplate: | ||
| spec: | ||
| template: | ||
| spec: | ||
| serviceAccountName: credentials-sync | ||
| restartPolicy: Never | ||
| containers: | ||
| - image: busybox # override this with a cloud-specific image | ||
| name: sync | ||
| envFrom: | ||
| - configMapRef: | ||
| name: credentials-sync | ||
| env: | ||
| - name: RECONCILE_SH # override this env var with a shell function in a kustomize patch | ||
| value: |- | ||
| reconcile() { | ||
| echo reconciling... | ||
| } | ||
| command: | ||
| - bash | ||
| - -ceu | ||
| - |- | ||
| # template reconcile() into the script | ||
| # env var is expanded by k8s before the pod starts | ||
| $(RECONCILE_SH) | ||
| apply-secret() { | ||
| /kbin/kubectl create secret docker-registry "${1}" \ | ||
| --docker-server="${2}" \ | ||
| --docker-username="${3}" \ | ||
| --docker-password="${4}" \ | ||
| --dry-run=client -o=yaml \ | ||
| | grep -v "creationTimestamp:" \ | ||
| | /kbin/kubectl apply -f - | ||
| } | ||
| reconcile | ||
| resources: {} | ||
|
|
||
|
|
||
| # RBAC necessary for our Deployment to apply our imagePullSecret | ||
| --- | ||
| kind: Role | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: credentials-sync | ||
| namespace: flux-system | ||
| rules: | ||
| - apiGroups: [""] | ||
| resources: | ||
| - secrets | ||
| verbs: | ||
| - get | ||
| - create | ||
| - update | ||
| - patch | ||
| # # Lock this down to the specific Secret name (Optional) | ||
| resourceNames: | ||
| - $(KUBE_SECRET) # templated from kustomize vars referencing ConfigMap, also see kustomizeconfig.yaml | ||
| --- | ||
| kind: RoleBinding | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: credentials-sync | ||
| namespace: flux-system | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: credentials-sync | ||
| roleRef: | ||
| kind: Role | ||
| name: credentials-sync | ||
| apiGroup: rbac.authorization.k8s.io | ||
| --- | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: credentials-sync | ||
| namespace: flux-system |
Oops, something went wrong.