From 0418583f35d70154e64a8178978bd47ac93367e8 Mon Sep 17 00:00:00 2001 From: Dario Amoroso d'Aragona Date: Fri, 5 Jul 2024 16:20:40 +0200 Subject: [PATCH] substituted watchtower with keel for automatic image manage in k8s cluster. modified the k8s script to install helm and use helm to install keel. triggering update on image to test keel --- docker/Dockerfile | 2 +- k8s/get_helm.sh | 341 ++++++++++++++++++++ k8s/k8s-manifest-dockerhub-with-git.yaml | 6 + k8s/k8s-manifest-dockerhub-without-git.yaml | 38 +-- k8s/setup.sh | 58 +++- 5 files changed, 411 insertions(+), 34 deletions(-) create mode 100755 k8s/get_helm.sh diff --git a/docker/Dockerfile b/docker/Dockerfile index 47b1b32..f59170f 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -33,7 +33,7 @@ ENV PYTHONPATH=/app # Add a dummy environment variable ENV DUMMY_VAR="trigger_watchtower_update" -ENV DUMMY_VAR_2="trigger_watchtower_update_@" + # Run the application #DEBUG COMMAND diff --git a/k8s/get_helm.sh b/k8s/get_helm.sh new file mode 100755 index 0000000..2292b70 --- /dev/null +++ b/k8s/get_helm.sh @@ -0,0 +1,341 @@ +#!/usr/bin/env bash + +# Copyright The Helm Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# The install script is based off of the MIT-licensed script from glide, +# the package manager for Go: https://github.com/Masterminds/glide.sh/blob/master/get + +: ${BINARY_NAME:="helm"} +: ${USE_SUDO:="true"} +: ${DEBUG:="false"} +: ${VERIFY_CHECKSUM:="true"} +: ${VERIFY_SIGNATURES:="false"} +: ${HELM_INSTALL_DIR:="/usr/local/bin"} +: ${GPG_PUBRING:="pubring.kbx"} + +HAS_CURL="$(type "curl" &> /dev/null && echo true || echo false)" +HAS_WGET="$(type "wget" &> /dev/null && echo true || echo false)" +HAS_OPENSSL="$(type "openssl" &> /dev/null && echo true || echo false)" +HAS_GPG="$(type "gpg" &> /dev/null && echo true || echo false)" +HAS_GIT="$(type "git" &> /dev/null && echo true || echo false)" + +# initArch discovers the architecture for this system. +initArch() { + ARCH=$(uname -m) + case $ARCH in + armv5*) ARCH="armv5";; + armv6*) ARCH="armv6";; + armv7*) ARCH="arm";; + aarch64) ARCH="arm64";; + x86) ARCH="386";; + x86_64) ARCH="amd64";; + i686) ARCH="386";; + i386) ARCH="386";; + esac +} + +# initOS discovers the operating system for this system. +initOS() { + OS=$(echo `uname`|tr '[:upper:]' '[:lower:]') + + case "$OS" in + # Minimalist GNU for Windows + mingw*|cygwin*) OS='windows';; + esac +} + +# runs the given command as root (detects if we are root already) +runAsRoot() { + if [ $EUID -ne 0 -a "$USE_SUDO" = "true" ]; then + sudo "${@}" + else + "${@}" + fi +} + +# verifySupported checks that the os/arch combination is supported for +# binary builds, as well whether or not necessary tools are present. +verifySupported() { + local supported="darwin-amd64\ndarwin-arm64\nlinux-386\nlinux-amd64\nlinux-arm\nlinux-arm64\nlinux-ppc64le\nlinux-s390x\nlinux-riscv64\nwindows-amd64\nwindows-arm64" + if ! echo "${supported}" | grep -q "${OS}-${ARCH}"; then + echo "No prebuilt binary for ${OS}-${ARCH}." + echo "To build from source, go to https://github.com/helm/helm" + exit 1 + fi + + if [ "${HAS_CURL}" != "true" ] && [ "${HAS_WGET}" != "true" ]; then + echo "Either curl or wget is required" + exit 1 + fi + + if [ "${VERIFY_CHECKSUM}" == "true" ] && [ "${HAS_OPENSSL}" != "true" ]; then + echo "In order to verify checksum, openssl must first be installed." + echo "Please install openssl or set VERIFY_CHECKSUM=false in your environment." + exit 1 + fi + + if [ "${VERIFY_SIGNATURES}" == "true" ]; then + if [ "${HAS_GPG}" != "true" ]; then + echo "In order to verify signatures, gpg must first be installed." + echo "Please install gpg or set VERIFY_SIGNATURES=false in your environment." + exit 1 + fi + if [ "${OS}" != "linux" ]; then + echo "Signature verification is currently only supported on Linux." + echo "Please set VERIFY_SIGNATURES=false or verify the signatures manually." + exit 1 + fi + fi + + if [ "${HAS_GIT}" != "true" ]; then + echo "[WARNING] Could not find git. It is required for plugin installation." + fi +} + +# checkDesiredVersion checks if the desired version is available. +checkDesiredVersion() { + if [ "x$DESIRED_VERSION" == "x" ]; then + # Get tag from release URL + local latest_release_url="https://get.helm.sh/helm-latest-version" + local latest_release_response="" + if [ "${HAS_CURL}" == "true" ]; then + latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true ) + elif [ "${HAS_WGET}" == "true" ]; then + latest_release_response=$( wget "$latest_release_url" -q -O - 2>&1 || true ) + fi + TAG=$( echo "$latest_release_response" | grep '^v[0-9]' ) + if [ "x$TAG" == "x" ]; then + printf "Could not retrieve the latest release tag information from %s: %s\n" "${latest_release_url}" "${latest_release_response}" + exit 1 + fi + else + TAG=$DESIRED_VERSION + fi +} + +# checkHelmInstalledVersion checks which version of helm is installed and +# if it needs to be changed. +checkHelmInstalledVersion() { + if [[ -f "${HELM_INSTALL_DIR}/${BINARY_NAME}" ]]; then + local version=$("${HELM_INSTALL_DIR}/${BINARY_NAME}" version --template="{{ .Version }}") + if [[ "$version" == "$TAG" ]]; then + echo "Helm ${version} is already ${DESIRED_VERSION:-latest}" + return 0 + else + echo "Helm ${TAG} is available. Changing from version ${version}." + return 1 + fi + else + return 1 + fi +} + +# downloadFile downloads the latest binary package and also the checksum +# for that binary. +downloadFile() { + HELM_DIST="helm-$TAG-$OS-$ARCH.tar.gz" + DOWNLOAD_URL="https://get.helm.sh/$HELM_DIST" + CHECKSUM_URL="$DOWNLOAD_URL.sha256" + HELM_TMP_ROOT="$(mktemp -dt helm-installer-XXXXXX)" + HELM_TMP_FILE="$HELM_TMP_ROOT/$HELM_DIST" + HELM_SUM_FILE="$HELM_TMP_ROOT/$HELM_DIST.sha256" + echo "Downloading $DOWNLOAD_URL" + if [ "${HAS_CURL}" == "true" ]; then + curl -SsL "$CHECKSUM_URL" -o "$HELM_SUM_FILE" + curl -SsL "$DOWNLOAD_URL" -o "$HELM_TMP_FILE" + elif [ "${HAS_WGET}" == "true" ]; then + wget -q -O "$HELM_SUM_FILE" "$CHECKSUM_URL" + wget -q -O "$HELM_TMP_FILE" "$DOWNLOAD_URL" + fi +} + +# verifyFile verifies the SHA256 checksum of the binary package +# and the GPG signatures for both the package and checksum file +# (depending on settings in environment). +verifyFile() { + if [ "${VERIFY_CHECKSUM}" == "true" ]; then + verifyChecksum + fi + if [ "${VERIFY_SIGNATURES}" == "true" ]; then + verifySignatures + fi +} + +# installFile installs the Helm binary. +installFile() { + HELM_TMP="$HELM_TMP_ROOT/$BINARY_NAME" + mkdir -p "$HELM_TMP" + tar xf "$HELM_TMP_FILE" -C "$HELM_TMP" + HELM_TMP_BIN="$HELM_TMP/$OS-$ARCH/helm" + echo "Preparing to install $BINARY_NAME into ${HELM_INSTALL_DIR}" + runAsRoot cp "$HELM_TMP_BIN" "$HELM_INSTALL_DIR/$BINARY_NAME" + echo "$BINARY_NAME installed into $HELM_INSTALL_DIR/$BINARY_NAME" +} + +# verifyChecksum verifies the SHA256 checksum of the binary package. +verifyChecksum() { + printf "Verifying checksum... " + local sum=$(openssl sha1 -sha256 ${HELM_TMP_FILE} | awk '{print $2}') + local expected_sum=$(cat ${HELM_SUM_FILE}) + if [ "$sum" != "$expected_sum" ]; then + echo "SHA sum of ${HELM_TMP_FILE} does not match. Aborting." + exit 1 + fi + echo "Done." +} + +# verifySignatures obtains the latest KEYS file from GitHub main branch +# as well as the signature .asc files from the specific GitHub release, +# then verifies that the release artifacts were signed by a maintainer's key. +verifySignatures() { + printf "Verifying signatures... " + local keys_filename="KEYS" + local github_keys_url="https://raw.githubusercontent.com/helm/helm/main/${keys_filename}" + if [ "${HAS_CURL}" == "true" ]; then + curl -SsL "${github_keys_url}" -o "${HELM_TMP_ROOT}/${keys_filename}" + elif [ "${HAS_WGET}" == "true" ]; then + wget -q -O "${HELM_TMP_ROOT}/${keys_filename}" "${github_keys_url}" + fi + local gpg_keyring="${HELM_TMP_ROOT}/keyring.gpg" + local gpg_homedir="${HELM_TMP_ROOT}/gnupg" + mkdir -p -m 0700 "${gpg_homedir}" + local gpg_stderr_device="/dev/null" + if [ "${DEBUG}" == "true" ]; then + gpg_stderr_device="/dev/stderr" + fi + gpg --batch --quiet --homedir="${gpg_homedir}" --import "${HELM_TMP_ROOT}/${keys_filename}" 2> "${gpg_stderr_device}" + gpg --batch --no-default-keyring --keyring "${gpg_homedir}/${GPG_PUBRING}" --export > "${gpg_keyring}" + local github_release_url="https://github.com/helm/helm/releases/download/${TAG}" + if [ "${HAS_CURL}" == "true" ]; then + curl -SsL "${github_release_url}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc" -o "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc" + curl -SsL "${github_release_url}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc" -o "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc" + elif [ "${HAS_WGET}" == "true" ]; then + wget -q -O "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc" "${github_release_url}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc" + wget -q -O "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc" "${github_release_url}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc" + fi + local error_text="If you think this might be a potential security issue," + error_text="${error_text}\nplease see here: https://github.com/helm/community/blob/master/SECURITY.md" + local num_goodlines_sha=$(gpg --verify --keyring="${gpg_keyring}" --status-fd=1 "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc" 2> "${gpg_stderr_device}" | grep -c -E '^\[GNUPG:\] (GOODSIG|VALIDSIG)') + if [[ ${num_goodlines_sha} -lt 2 ]]; then + echo "Unable to verify the signature of helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256!" + echo -e "${error_text}" + exit 1 + fi + local num_goodlines_tar=$(gpg --verify --keyring="${gpg_keyring}" --status-fd=1 "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc" 2> "${gpg_stderr_device}" | grep -c -E '^\[GNUPG:\] (GOODSIG|VALIDSIG)') + if [[ ${num_goodlines_tar} -lt 2 ]]; then + echo "Unable to verify the signature of helm-${TAG}-${OS}-${ARCH}.tar.gz!" + echo -e "${error_text}" + exit 1 + fi + echo "Done." +} + +# fail_trap is executed if an error occurs. +fail_trap() { + result=$? + if [ "$result" != "0" ]; then + if [[ -n "$INPUT_ARGUMENTS" ]]; then + echo "Failed to install $BINARY_NAME with the arguments provided: $INPUT_ARGUMENTS" + help + else + echo "Failed to install $BINARY_NAME" + fi + echo -e "\tFor support, go to https://github.com/helm/helm." + fi + cleanup + exit $result +} + +# testVersion tests the installed client to make sure it is working. +testVersion() { + set +e + HELM="$(command -v $BINARY_NAME)" + if [ "$?" = "1" ]; then + echo "$BINARY_NAME not found. Is $HELM_INSTALL_DIR on your "'$PATH?' + exit 1 + fi + set -e +} + +# help provides possible cli installation arguments +help () { + echo "Accepted cli arguments are:" + echo -e "\t[--help|-h ] ->> prints this help" + echo -e "\t[--version|-v ] . When not defined it fetches the latest release from GitHub" + echo -e "\te.g. --version v3.0.0 or -v canary" + echo -e "\t[--no-sudo] ->> install without sudo" +} + +# cleanup temporary files to avoid https://github.com/helm/helm/issues/2977 +cleanup() { + if [[ -d "${HELM_TMP_ROOT:-}" ]]; then + rm -rf "$HELM_TMP_ROOT" + fi +} + +# Execution + +#Stop execution on any error +trap "fail_trap" EXIT +set -e + +# Set debug if desired +if [ "${DEBUG}" == "true" ]; then + set -x +fi + +# Parsing input arguments (if any) +export INPUT_ARGUMENTS="${@}" +set -u +while [[ $# -gt 0 ]]; do + case $1 in + '--version'|-v) + shift + if [[ $# -ne 0 ]]; then + export DESIRED_VERSION="${1}" + if [[ "$1" != "v"* ]]; then + echo "Expected version arg ('${DESIRED_VERSION}') to begin with 'v', fixing..." + export DESIRED_VERSION="v${1}" + fi + else + echo -e "Please provide the desired version. e.g. --version v3.0.0 or -v canary" + exit 0 + fi + ;; + '--no-sudo') + USE_SUDO="false" + ;; + '--help'|-h) + help + exit 0 + ;; + *) exit 1 + ;; + esac + shift +done +set +u + +initArch +initOS +verifySupported +checkDesiredVersion +if ! checkHelmInstalledVersion; then + downloadFile + verifyFile + installFile +fi +testVersion +cleanup diff --git a/k8s/k8s-manifest-dockerhub-with-git.yaml b/k8s/k8s-manifest-dockerhub-with-git.yaml index 8738550..3c27e34 100644 --- a/k8s/k8s-manifest-dockerhub-with-git.yaml +++ b/k8s/k8s-manifest-dockerhub-with-git.yaml @@ -34,6 +34,9 @@ apiVersion: apps/v1 kind: Deployment metadata: name: coupling-tool + annotations: + keel.sh/policy: all # Keel will monitor for all updates + keel.sh/trigger: poll # Keel will poll the registry for updates spec: replicas: 1 selector: @@ -99,6 +102,9 @@ apiVersion: apps/v1 kind: Deployment metadata: name: celery-worker + annotations: + keel.sh/policy: all # Keel will monitor for all updates + keel.sh/trigger: poll # Keel will poll the registry for updates spec: replicas: 1 selector: diff --git a/k8s/k8s-manifest-dockerhub-without-git.yaml b/k8s/k8s-manifest-dockerhub-without-git.yaml index 1676858..425034a 100644 --- a/k8s/k8s-manifest-dockerhub-without-git.yaml +++ b/k8s/k8s-manifest-dockerhub-without-git.yaml @@ -34,6 +34,9 @@ apiVersion: apps/v1 kind: Deployment metadata: name: coupling-tool + annotations: + keel.sh/policy: all # Keel will monitor for all updates + keel.sh/trigger: poll # Keel will poll the registry for updates spec: replicas: 1 selector: @@ -83,6 +86,9 @@ apiVersion: apps/v1 kind: Deployment metadata: name: celery-worker + annotations: + keel.sh/policy: all # Keel will monitor for all updates + keel.sh/trigger: poll # Keel will poll the registry for updates spec: replicas: 1 selector: @@ -193,38 +199,6 @@ spec: targetPort: 80 nodePort: 30085 --- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: watchtower -spec: - replicas: 1 - selector: - matchLabels: - app: watchtower - template: - metadata: - labels: - app: watchtower - spec: - containers: - - name: watchtower - image: containrrr/watchtower:latest - imagePullPolicy: IfNotPresent - args: ["--interval", "90", "--stop-timeout", "60s"] - env: - - name: WATCHTOWER_DEBUG - value: "true" - - name: WATCHTOWER_CLEANUP - value: "true" - volumeMounts: - - name: docker-socket - mountPath: /var/run/docker.sock - volumes: - - name: docker-socket - hostPath: - path: /var/run/docker.sock ---- apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: diff --git a/k8s/setup.sh b/k8s/setup.sh index 62eeb50..d38b995 100755 --- a/k8s/setup.sh +++ b/k8s/setup.sh @@ -6,6 +6,7 @@ GITCREDENTIALS_PATH="/etc/.git-credentials" # Change this to the actual path on MANIFEST_FILE_WITH_GIT="k8s-manifest-dockerhub-with-git.yaml" MANIFEST_FILE_WITHOUT_GIT="k8s-manifest-dockerhub-without-git.yaml" + # Function to create a ConfigMap from a file if it exists create_configmap_if_exists() { local file_path=$1 @@ -21,6 +22,12 @@ create_configmap_if_exists() { fi } +# Ensure the script runs with sudo without prompting for a password +if [ "$EUID" -ne 0 ]; then + echo "Please run this script as root using sudo." + exit 1 +fi + # Step 1: Create ConfigMaps if create_configmap_if_exists $GITCONFIG_PATH "gitconfig" ".gitconfig" && \ create_configmap_if_exists $GITCREDENTIALS_PATH "gitcredentials" ".git-credentials"; then @@ -34,7 +41,7 @@ if [ -f "$MANIFEST_FILE" ]; then echo "Applying Kubernetes manifests from $MANIFEST_FILE..." kubectl apply -f $MANIFEST_FILE if [ $? -eq 0 ]; then - echo "Kubernetes manifests applied successfully." + echo "Kubernetes manifest applied successfully." else echo "Failed to apply Kubernetes manifests." exit 1 @@ -43,3 +50,52 @@ else echo "Manifest file $MANIFEST_FILE does not exist. Exiting..." exit 1 fi + + +# Function to print errors without exiting +print_error() { + echo "Error: $1" +} + +# Install Helm +echo "Installing Helm..." +curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash +if [ $? -ne 0 ]; then + print_error "Helm installation failed." +else + echo "Helm installed successfully." +fi + +# Add the Keel Helm repository and update +echo "Adding Keel Helm repository..." +helm repo add keel https://charts.keel.sh +if [ $? -ne 0 ]; then + print_error "Failed to add Keel Helm repository. Keel will not be available. No automatic updates of the running container will be performed." +else + helm repo update + if [ $? -ne 0 ]; then + print_error "Failed to update Helm repositories. Keel will not be available. No automatic updates of the running container will be performed." + else + echo "Keel Helm repository added and updated successfully." + fi +fi + +# Install Keel using Helm +echo "Installing Keel..." +helm install keel keel/keel --namespace keel --create-namespace +if [ $? -ne 0 ]; then + print_error "Keel installation failed. Keel will not be available. No automatic updates of the running container will be performed." +else + echo "Keel installed successfully." +fi + +echo "Applying Autoscaler..." +kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml +if [ $? -eq 0 ]; then + echo "Autoscaler applied successfully." + + else + echo "Failed to apply Autoscaler, the automatic autoscaler will not be available." +fi + +echo "Script completed." \ No newline at end of file