Archived
27 lines
1.7 KiB
Bash
Executable File
27 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
|
namespace=cert-manager
|
|
service_account=cert-manager-config-deployer
|
|
secret=cert-manager-config-deployer-token
|
|
ssh_host=${KUBECTL_SSH_HOST:-}
|
|
ssh_config=${SSH_CONFIG:-}
|
|
cluster_kubectl() { if [[ -n "$ssh_host" ]]; then if [[ -n "$ssh_config" ]]; then ssh -F "$ssh_config" "$ssh_host" kubectl "$@"; else ssh "$ssh_host" kubectl "$@"; fi; else kubectl "$@"; fi; }
|
|
if [[ -n "$ssh_host" ]]; then cluster_kubectl apply -f - < "$project_dir/ci-deployer.yaml" >&2; else cluster_kubectl apply -f "$project_dir/ci-deployer.yaml" >&2; fi
|
|
for attempt in {1..30}; do
|
|
if cluster_kubectl -n "$namespace" get secret "$secret" -o jsonpath='{.data.token}' 2>/dev/null | grep -q .; then break; fi
|
|
[[ "$attempt" != 30 ]] || { echo 'Timed out waiting for service-account token' >&2; exit 1; }
|
|
sleep 1
|
|
done
|
|
work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
|
|
server=$(cluster_kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
|
|
cluster_kubectl -n "$namespace" get secret "$secret" -o jsonpath='{.data.ca\.crt}' | base64 -d > "$work/ca.crt"
|
|
token=$(cluster_kubectl -n "$namespace" get secret "$secret" -o jsonpath='{.data.token}' | base64 -d)
|
|
export KUBECONFIG="$work/config"
|
|
kubectl config set-cluster cluster --server="$server" --certificate-authority="$work/ca.crt" --embed-certs=true >/dev/null
|
|
kubectl config set-credentials "$service_account" --token="$token" >/dev/null
|
|
kubectl config set-context cert-manager --cluster=cluster --user="$service_account" --namespace="$namespace" >/dev/null
|
|
kubectl config use-context cert-manager >/dev/null
|
|
echo 'Store this line as Gitea Actions secret KUBE_CONFIG_BASE64; do not commit it.' >&2
|
|
base64 -w0 "$KUBECONFIG"; printf '\n'
|