Commit ce10ca3e authored by Pierre Smeyers's avatar Pierre Smeyers
Browse files

fix(authent): support text or file variable for Kubeconfig

parent 0169678b

README.md

+6 −6
Original line number Diff line number Diff line
@@ -68,7 +68,7 @@ The Kubernetes template supports 3 ways of login/accessing your Kubernetes clust 


1. The [GitLab Kubernetes integration](https://docs.gitlab.com/ee/user/project/clusters/): when enabled, the template

  automatically retrieves and uses your Kubernetes cluster configuration (`KUBECONFIG` env),

2. By defining an explicit `kubeconfig` **yaml content** from env,

2. By defining an explicit `kubeconfig` from env (either file or yaml content),

3. By defining explicit `kubeconfig` **exploded parameters** from env: server url, server certificate authority and user token.



### Deployment context variables
@@ -350,7 +350,7 @@ The Kubernetes template uses some global configuration used throughout all jobs. 
| `K8S_KUBECTL_IMAGE`    | the Docker image used to run Kubernetes `kubectl` commands <br/>:warning: **set the version required by your Kubernetes server** | `bitnami/kubectl:latest` |

| `K8S_BASE_APP_NAME`    | default application name              | `$CI_PROJECT_NAME` ([see GitLab doc](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html)) |

| `K8S_ENVIRONMENT_URL`    | Default environments url _(only define for static environment URLs declaration)_<br/>_supports late variable expansion (ex: `https://%{environment_name}.k8s.acme.com`)_ | _none_ |

| :lock: `K8S_DEFAULT_KUBE_CONFIG`| default kubeconfig content used by `kubectl`. | **required if not using exploded kubeconfig parameters** |

| :lock: `K8S_DEFAULT_KUBE_CONFIG`| The default kubeconfig to use (either content or file variable) | **required if not using exploded kubeconfig parameters** |

| `K8S_URL`              | the Kubernetes API url                | **required if using exploded kubeconfig parameters** |

| `K8S_CA_CERT`          | the default Kubernetes server certificate authority | **optional if using exploded kubeconfig parameters** |

| :lock: `K8S_TOKEN`     | default service account token         | **required if using exploded kubeconfig parameters** |
@@ -373,7 +373,7 @@ Here are variables supported to configure review environments: 
| `K8S_REVIEW_SPACE`       | k8s namespace for `review` env         | _none_ (disabled) |

| `K8S_REVIEW_APP_NAME`    | application name for `review` env      | `"${K8S_BASE_APP_NAME}-${CI_COMMIT_REF_SLUG}"` |

| `K8S_REVIEW_ENVIRONMENT_URL`| The review environments url _(only define for static environment URLs declaration and if different from default)_ | `$K8S_ENVIRONMENT_URL` |

| :lock: `K8S_REVIEW_KUBE_CONFIG` | kubeconfig content used by `kubectl` for `review` env _(only define if not using exploded kubeconfig parameters and if different from default)_ | `$K8S_DEFAULT_KUBE_CONFIG` |

| :lock: `K8S_REVIEW_KUBE_CONFIG` | Specific kubeconfig for `review` env _(only define if not using exploded kubeconfig parameters and if different from default)_ | `$K8S_DEFAULT_KUBE_CONFIG` |

| `K8S_REVIEW_URL`         | Kubernetes API url for `review` env  _(only define if using exploded kubeconfig parameters and if different from default)_    | `$K8S_URL` |

| `K8S_REVIEW_CA_CERT`     | the Kubernetes server certificate authority for `review` env _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_CA_CERT` |

| :lock: `K8S_REVIEW_TOKEN`| service account token for `review` env _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_TOKEN` |
@@ -391,7 +391,7 @@ Here are variables supported to configure the integration environment: 
| `K8S_INTEG_SPACE`        | k8s namespace for `integration` env    | _none_ (disabled) |

| `K8S_INTEG_APP_NAME`     | application name for `integration` env | `$K8S_BASE_APP_NAME-integration` |

| `K8S_INTEG_ENVIRONMENT_URL`| The integration environment url _(only define for static environment URLs declaration and if different from default)_ | `$K8S_ENVIRONMENT_URL` |

| :lock: `K8S_INTEG_KUBE_CONFIG` | kubeconfig content used by `kubectl` for `integration` env _(only define if not using exploded kubeconfig parameters and if different from default)_ | `$K8S_DEFAULT_KUBE_CONFIG` |

| :lock: `K8S_INTEG_KUBE_CONFIG` | Specific kubeconfig for `integration` env _(only define if not using exploded kubeconfig parameters and if different from default)_ | `$K8S_DEFAULT_KUBE_CONFIG` |

| `K8S_INTEG_URL`          | Kubernetes API url for `integration` env  _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_URL` |

| `K8S_INTEG_CA_CERT`      | the Kubernetes server certificate authority for `integration` env _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_CA_CERT` |

| :lock: `K8S_INTEG_TOKEN` | service account token for `integration` env _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_TOKEN` |
@@ -409,7 +409,7 @@ Here are variables supported to configure the staging environment: 
| `K8S_STAGING_SPACE`      | k8s namespace for `staging` env        | _none_ (disabled) |

| `K8S_STAGING_APP_NAME`   | application name for `staging` env     | `$K8S_BASE_APP_NAME-staging` |

| `K8S_STAGING_ENVIRONMENT_URL`| The staging environment url _(only define for static environment URLs declaration and if different from default)_ | `$K8S_ENVIRONMENT_URL` |

| :lock: `K8S_STAGING_KUBE_CONFIG` | kubeconfig content used by `kubectl` for `staging` env _(only define if not using exploded kubeconfig parameters and if different from default)_ | `$K8S_DEFAULT_KUBE_CONFIG` |

| :lock: `K8S_STAGING_KUBE_CONFIG` | Specific kubeconfig for `staging` env _(only define if not using exploded kubeconfig parameters and if different from default)_ | `$K8S_DEFAULT_KUBE_CONFIG` |

| `K8S_STAGING_URL`        | Kubernetes API url for `staging` env  _(only define if using exploded kubeconfig parameters and if different from default)_   | `$K8S_URL` |

| `K8S_STAGING_CA_CERT`    | the Kubernetes server certificate authority for `staging` env _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_CA_CERT` |

| :lock: `K8S_STAGING_TOKEN`| service account token for `staging` env _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_TOKEN` |
@@ -427,7 +427,7 @@ Here are variables supported to configure the production environment: 
| `K8S_PROD_SPACE`         | k8s namespace for `production` env     | _none_ (disabled) |

| `K8S_PROD_APP_NAME`      | application name for `production` env  | `$K8S_BASE_APP_NAME` |

| `K8S_PROD_ENVIRONMENT_URL`| The production environment url _(only define for static environment URLs declaration and if different from default)_ | `$K8S_ENVIRONMENT_URL` |

| :lock: `K8S_PROD_KUBE_CONFIG` | kubeconfig content used by `kubectl` for `production` env _(only define if not using exploded kubeconfig parameters and if different from default)_ | `$K8S_DEFAULT_KUBE_CONFIG` |

| :lock: `K8S_PROD_KUBE_CONFIG` | Specific kubeconfig for `production` env _(only define if not using exploded kubeconfig parameters and if different from default)_ | `$K8S_DEFAULT_KUBE_CONFIG` |

| `K8S_PROD_URL`           | Kubernetes API url for `production` env  _(only define if using exploded kubeconfig parameters and if different from default)_| `$K8S_URL` |

| `K8S_PROD_CA_CERT`       | the Kubernetes server certificate authority for `production` env _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_CA_CERT` |

| :lock: `K8S_PROD_TOKEN`  | service account token for `production` env _(only define if using exploded kubeconfig parameters and if different from default)_ | `$K8S_TOKEN` |

kicker.json

+5 −5
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ 
    },

    {

      "name": "K8S_DEFAULT_KUBE_CONFIG",

      "description": "Global kubeconfig content used by `kubectl` (only define if not using exploded kubeconfig parameters)",

      "description": "The default kubeconfig to use (either content or file variable)\n\n_only define if not using exploded kubeconfig parameters_",

      "secret": true

    },

    {
@@ -95,7 +95,7 @@ 
        },

        {

          "name": "K8S_REVIEW_KUBE_CONFIG",

          "description": "kubeconfig content used by kubectl for review env (only define if not using exploded parameters and if different from global)",

          "description": "Specific kubeconfig for review env (only define if not using exploded parameters and if different from global)",

          "secret": true

        },

        {
@@ -139,7 +139,7 @@ 
        },

        {

          "name": "K8S_INTEG_KUBE_CONFIG",

          "description": "kubeconfig content used by kubectl for integration env (only define if not using exploded parameters and if different from global)",

          "description": "Specific kubeconfig for integration env (only define if not using exploded parameters and if different from global)",

          "secret": true

        },

        {
@@ -183,7 +183,7 @@ 
        },

        {

          "name": "K8S_STAGING_KUBE_CONFIG",

          "description": "kubeconfig content used by kubectl for staging env (only define if not using exploded parameters and if different from global)",

          "description": "Specific kubeconfig for staging env (only define if not using exploded parameters and if different from global)",

          "secret": true

        },

        {
@@ -232,7 +232,7 @@ 
        },

        {

          "name": "K8S_PROD_KUBE_CONFIG",

          "description": "kubeconfig content used by kubectl for production env (only define if not using exploded parameters and if different from global)",

          "description": "Specific kubeconfig for production env (only define if not using exploded parameters and if different from global)",

          "secret": true

        },

        {

templates/gitlab-ci-k8s.yml

+14 −5
Original line number Diff line number Diff line
@@ -288,14 +288,23 @@ stages: 
    namespace=$5

    config=$6



    if [ -n "$config" ]; then

      log_info "--- \\e[32mlogin\\e[0m using kubeconfig content provided from env"

    if [[ -f "$config" ]]

    then

      # $config is a path to a Kuberconfig file

      export KUBECONFIG="$CI_PROJECT_DIR/.kubeconfig"

      cp -f "$config" "$KUBECONFIG"

      log_info "--- using \\e[32mKUBECONFIG\\e[0m provided by env variables (file)"

    elif [[ -n "$config" ]]

    then

      # $config is a Kuberconfig file content

      export KUBECONFIG="$CI_PROJECT_DIR/.kubeconfig"

      echo "$config" > "$KUBECONFIG"

    elif [ -n "$KUBECONFIG" ]; then

      log_info "--- \\e[32mlogin\\e[0m using kubeconfig file provided by GitLab"

      log_info "--- using \\e[32mKUBECONFIG\\e[0m provided by env variables (content)"

    elif [[ -n "$KUBECONFIG" ]]

    then

      log_info "--- using \\e[32mKUBECONFIG\\e[0m provided by GitLab"

    else

      log_info "--- \\e[32mlogin\\e[0m using exploded kubeconfig parameters (env: \\e[33;1m${environment_type}\\e[0m, url: \\e[33;1m${url}\\e[0m, namespace: \\e[33;1m${namespace}\\e[0m)"

      log_info "--- using exploded \\e[32mKUBECONFIG\\e[0m parameters (env: \\e[33;1m${environment_type}\\e[0m, url: \\e[33;1m${url}\\e[0m, namespace: \\e[33;1m${namespace}\\e[0m)"



      assert_defined "${url}" "Missing required Kubernetes URL. Provide a kubeconfig file or \$K8S_*_URL"

      assert_defined "${token}" "Missing required Kubernetes Token. Provide a kubeconfig file or \$K8S_*_TOKEN"