chore: migrate tekton tasks resulting host info to secrets

Signed-off-by: Adrian Riobo <[email protected]>
redhat-developer · Nov 12, 2024 · 3746721 · 3746721
1 parent 445f1ce
commit 3746721
Show file tree

Hide file tree

Showing 8 changed files with 400 additions and 458 deletions.
diff --git a/hacks/azure/azure_setup.sh b/hacks/azure/azure_setup.sh
diff --git a/hacks/azure/mapt-aks-role.json b/hacks/azure/mapt-aks-role.json
@@ -0,0 +1,14 @@
+{
+  "Name": "Mapt AKS Operator",
+  "IsCustom": true,
+  "Description": "Can create aks clusters with mapt features.",
+  "Actions": [
+    "Microsoft.Authorization/roleAssignments/*"
+  ],
+  "NotActions": [],
+  "DataActions": [],
+  "NotDataActions": [],
+  "AssignableScopes": [
+    "/subscriptions/b0ad4737-8299-4c0a-9dd5-959cbcf8d81c"
+  ]
+}
diff --git a/oci/Containerfile b/oci/Containerfile
@@ -36,6 +36,8 @@ ENV AZ_CLI_VERSION 2.61.0
 # Pulumi plugins
 # renovate: datasource=github-releases depName=pulumi/pulumi-aws
 ARG PULUMI_AWS_VERSION=v6.37.1
+# Install this
+# https://releases.hashicorp.com/terraform-provider-aws/5.75.1/terraform-provider-aws_5.75.1_linux_amd64.zip
 # renovate: datasource=github-releases depName=pulumi/pulumi-aws
 ARG PULUMI_AWSX_VERSION=v2.3.0
 # renovate: datasource=github-releases depName=pulumi/pulumi-azure-native

diff --git a/tkn/infra-aws-fedora.yaml b/tkn/infra-aws-fedora.yaml
@@ -6,22 +6,25 @@ metadata:
   labels:
     app.kubernetes.io/version: "0.8.0-dev"
   annotations:
-    tekton.dev/pipelines.minVersion: "0.24.x"
+    tekton.dev/pipelines.minVersion: "0.44.x"
     tekton.dev/categories: infrastructure
     tekton.dev/tags: infrastructure, aws, fedora
     tekton.dev/displayName: "aws manager"
-    tekton.dev/platforms: "linux/amd64"
+    tekton.dev/platforms: "linux/amd64,inux/arm64"
 spec:
   description: |
     Task provision a fedora dedicated on host on AWS
 
-    The machine will offer nested virtualizataion capabilities as so it should be spin on a dedicated (baremetal) machine
-
-  workspaces:
-    - name: storage
-      description: volume to store outputs to connect within the target machine + state file for the infrastructure 
-      mountPath: /opt/storage
+  volumes:
     - name: aws-credentials
+      secret:
+        secretName: $(params.secret-aws-credentials)
+    - name: host-info
+      emptyDir: {}
+
+  params:
+    # mapt params 
+    - name: secret-aws-credentials
       description: |
         ocp secret holding the aws credentials. Secret should be accessible to this task.
 
@@ -38,22 +41,14 @@ spec:
           access-key: ${access_key}
           secret-key: ${secret_key}
           region: ${region}
-      mountPath: /opt/aws-credentials
-
-  params:
-    # mapt params 
-    - name: project-name
-      description: identifier for project. 
-    - name: backed-url
-      description: |
-        If we want to backed resources externally we can use s3 setting this param(i.e s3://existing-bucket). 
-
-        If default will be store on storage workspace at path set by param ws-output-path.
-      default: "''"
-    - name: ws-output-path
-      description: path on workspace where to store ephemeral assets related with the provisioning
+          bucket: ${bucket}
+    - name: id
+      description: identifier for the provisioned environment
     - name: operation 
       description: operation to execute within the infrastructure. Current values (create, destroy)
+    - name: host-access-secret 
+      description: name from the secret holding the host-info created during create operation. This is required only destroy operation
+      default: "''"
 
     # VM type params
     - name: arch
@@ -74,8 +69,8 @@ spec:
 
     # Fedora params
     - name: version
-      description: this task will spin a Fedora-Cloud image. This param will set the version for it. Default 40.
-      default: '40'
+      description: this task will spin a Fedora-Cloud image. This param will set the version for it. Default 41.
+      default: '41'
 
     # Topology params
     - name: airgap
@@ -93,10 +88,6 @@ spec:
       description: tags for the resources created on the providers
       default: "''"
 
-    # Control params
-    - name: remove-lock
-      description: in case a previous run fails the stack can be locked. This value allows to control if remove lock
-      default: 'true'
     - name: debug
       description: |
         Warning setting this param to true expose credentials 
@@ -106,23 +97,36 @@ spec:
       default: 'false'
 
   results:
-    - name: host
-      description: ip to connect to the provisioned machine
-    - name: username
-      description: username to connect to the provisioned machine
-    - name: key
-      description: filename for the private key. The key is located at workspace-resources-path
-    - name: bastion-host
-      description: if airgap is set we get the bastion host as result
-    - name: bastion-username
-      description: if airgap is set we get the bastion username to connect as result
-    - name: bastion-key
-      description: if airgap is set we get the bastion filename for the private key. The key is located at workspace-resources-path
-
+    - name: host-access-secret
+      description: |
+        ocp secret holding the information to connect with the target machine.
+
+          ---
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: aws-${name}
+            labels:
+              app.kubernetes.io/component: ${name}
+              app.kubernetes.io/part-of: qe-platform
+          type: Opaque
+          data:
+            host: ${host}
+            username: ${username}
+            id_rsa: ${id_rsa}
+            # If airgap data for bastion host
+            bastion-host: ${bastion-host}
+            bastion-username: ${bastion-username}
+            bastion-id_rsa: ${bastion-id_rsa}
   steps:
     - name: provisioner
       image: quay.io/redhat-developer/mapt:v0.8.0-dev
       imagePullPolicy: Always
+      volumeMounts:
+        - name: aws-credentials
+          mountPath: /opt/aws-credentials
+        - name: host-info
+          mountPath: /opt/host-info
       script: |
         #!/bin/sh
 
@@ -135,27 +139,14 @@ spec:
         export AWS_ACCESS_KEY_ID=$(cat /opt/aws-credentials/access-key)
         export AWS_SECRET_ACCESS_KEY=$(cat /opt/aws-credentials/secret-key)
         export AWS_DEFAULT_REGION=$(cat /opt/aws-credentials/region)
-
-        # Output folder
-        workspace_path=/opt/storage/$(params.ws-output-path)
-        mkdir -p ${workspace_path}
-
-        # Remove lock
-        if [[ $(params.remove-lock) == "true" ]]; then
-            rm -rf ${workspace_path}/.pulumi/locks/*
-        fi
+        BUCKET=$(cat /opt/aws-credentials/bucket)
 
         # Run mapt
         cmd="mapt aws fedora $(params.operation) "
-        cmd="$cmd --project-name $(params.project-name) "
-        # Set the backed url
-        if [[ $(params.backed-url) != "" ]]; then
-          cmd="$cmd --backed-url $(params.backed-url) "
-        else
-          cmd="$cmd --backed-url file://${workspace_path} "
-        fi
+        cmd="$cmd --project-name mapt-fedora-$(params.id) "
+        cmd="$cmd --backed-url s3://${BUCKET}/mapt/fedora/$(params.id) "
         if [[ $(params.operation) == "create" ]]; then
-          cmd="$cmd --conn-details-output ${workspace_path} " 
+          cmd="$cmd --conn-details-output /opt/host-info " 
           cmd="$cmd --arch $(params.arch) "
           cmd="$cmd --cpus $(params.cpus) "
           cmd="$cmd --memory $(params.memory) "
@@ -174,41 +165,57 @@ spec:
           fi
         fi
         eval "${cmd}"
-        
-        create_exit_code=$?
-      
-        # set task results
-        cat "${workspace_path}/host" | tee $(results.host.path)
-        cat "${workspace_path}/username" | tee $(results.username.path)   
-        echo -n "id_rsa" | tee $(results.key.path)   
-        if [[ $(params.airgap) == "true" ]]; then
-          cat "${workspace_path}/bastion_host" | tee $(results.bastion-host.path)
-          cat "${workspace_path}/bastion_username" | tee $(results.bastion-username.path)   
-          echo -n "bastion_id_rsa" | tee $(results.bastion-key.path)   
-        fi
-
-        # If debug print credentials
-        if [[ $(params.debug) == "true" ]]; then
-          echo "Credentials to access target machine \n"
-          cat "${workspace_path}/host"
-          cat "${workspace_path}/username"
-          cat "${workspace_path}/id_rsa"
-          if [[ $(params.airgap) == "true" ]]; then
-            cat "${workspace_path}/bastion_host"
-            cat "${workspace_path}/bastion_username"
-            cat "${workspace_path}/bastion_id_rsa"
-          fi
-        fi
-
-        if [[ ${create_exit_code} -ne 0 ]]; then 
-          exit 1
-        fi
-
       resources:      
         requests:
           memory: "200Mi"
           cpu: "100m"
         limits:
           memory: "600Mi"
           cpu: "300m"
-
+    - name: host-info-secret
+      image: registry.redhat.io/openshift4/ose-cli:4.13@sha256:e70eb2be867f1236b19f5cbfeb8e0625737ce0ec1369e32a4f9f146aaaf68d49
+      env:
+        - name: NAMESPACE
+          value: $(context.taskRun.namespace)
+      volumeMounts:
+        - name: host-info
+          mountPath: /opt/host-info
+      script: |
+        #!/bin/bash
+        set -eo pipefail
+        if [[ $(params.operation) == "create" ]]; then
+        cat <<EOF > host-info.yaml
+        apiVersion: v1
+        kind: Secret
+        metadata:
+          generateName: mapt-aws-fedora-
+          namespace: $NAMESPACE
+        type: Opaque
+        data:
+          host: $(cat /opt/host-info/host | base64 -w0)
+          username: $(cat /opt/host-info/username | base64 -w0)
+          id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0)
+        EOF
+        if [[ $(params.airgap) == "true" ]]; then
+        cat <<EOF >> host-info.yaml
+          bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0)
+          bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0)
+          bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0)
+        EOF
+        fi
+
+        if [[ $(params.debug) == "true" ]]; then
+          cat /opt/host-info/*
+        fi
+        
+        NAME=$(oc create -f host-info.yaml -o=jsonpath='{.metadata.name}')
+        echo -n "${NAME}" | tee $(results.host-access-secret.path)   
+        fi
+
+        if [[ $(params.operation) == "destroy" ]]; then
+          if [[ $(params.host-access-secret) == "" ]]; then
+            echo "On destroy host-access-secret param is mandatory"
+            exit 1
+          fi
+          oc delete secret $(params.host-access-secret)
+        fi