From 8efc0681e14f04d28e6c4485bb9e550960ba67a5 Mon Sep 17 00:00:00 2001 From: Mike Williamson Date: Wed, 3 Mar 2021 19:31:04 -0500 Subject: [PATCH] Don't bother with keys for dev This commit switches to using https for retrieving the repo instead of ssh since it's public anyway. --- deploy/README.md | 16 +++++----------- deploy/aks/kustomization.yaml | 2 -- deploy/bases/tracker-repo.yaml | 4 +--- deploy/creds/readonly/kustomization.yaml | 13 ------------- deploy/gke/kustomization.yaml | 4 ++-- deploy/gke/tracker-repo.yaml | 14 ++++++++++++++ deploy/minikube/kustomization.yaml | 2 -- deploy/test/kustomization.yaml | 2 -- 8 files changed, 22 insertions(+), 35 deletions(-) delete mode 100644 deploy/creds/readonly/kustomization.yaml create mode 100644 deploy/gke/tracker-repo.yaml diff --git a/deploy/README.md b/deploy/README.md index 21fd076036..a64d6e21c9 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -4,17 +4,6 @@ The Tracker project uses [Flux](https://fluxcd.io/), to enable [pull based](http The directory here is laid out to allow the patching of a basic flux install. It is based on [the example](https://docs.fluxcd.io/en/1.18.0/tutorials/get-started-kustomize.html) in the documentation. -## Creating credentials for Flux - -Tracker uses SSH deploy keys, and uses kustomize to [generate secrets](https://github.com/kubernetes-sigs/kustomize/blob/master/examples/secretGeneratorPlugin.md#secret-values-from-local-files). To create the keys, use the following commands. - -```bash -ssh-keygen -q -N "" -C "flux-read-only" -f ./deploy/creds/readonly/identity -ssh-keyscan github.com > ./deploy/creds/readonly/known_hosts -``` - -With keys in hand, take the output of `cat deploy/creds/readonly/identity.pub` and [add a new deploy key](https://github.com/canada-ca/tracker/settings/keys/new) to the Tracker repo. Obviously only select "Allow write access" if you are creating a read/write key to allow Flux to automate deployments. Typically we'd only want read/write in production, and everything else using read. - ## Testing config changes Config changes can be pretty high impact, so trying it out somewhere is pretty useful. To that end, we have a few ways to bring up a "non-prod" version of the app; basically, using a self signed cert and requesting its own IP address. @@ -51,11 +40,16 @@ kustomize build deploy/aks | kubectl apply -f - Deploying to prod is a little anticlimactic. You'll want some read/write credentials for Flux so that it can [update our config](https://toolkit.fluxcd.io/components/image/imageupdateautomations/#update-strategy) with new image tags, but everything else is the same. +Tracker uses SSH deploy keys to allow those updates, and uses kustomize to [generate secrets](https://github.com/kubernetes-sigs/kustomize/blob/master/examples/secretGeneratorPlugin.md#secret-values-from-local-files). To create the keys, use the following commands. + ```bash ssh-keygen -q -N "" -C "flux-read-write" -f ./deploy/creds/readwrite/identity ssh-keyscan github.com > ./deploy/creds/readwrite/known_hosts ``` +[Add the new deploy key](https://github.com/canada-ca/tracker/settings/keys/new) to the Tracker repo, and select "Allow write access". +After that it's basically the same: + ```bash kustomize build platform/creds/prod | kubectl apply -f - kustomize build app/creds/prod | kubectl apply -f - diff --git a/deploy/aks/kustomization.yaml b/deploy/aks/kustomization.yaml index 27c279572b..3669131f60 100644 --- a/deploy/aks/kustomization.yaml +++ b/deploy/aks/kustomization.yaml @@ -5,5 +5,3 @@ resources: patchesStrategicMerge: - app-kustomization.yaml - platform-kustomization.yaml -components: -- ../creds/readonly diff --git a/deploy/bases/tracker-repo.yaml b/deploy/bases/tracker-repo.yaml index a04bb17009..f721a91d72 100644 --- a/deploy/bases/tracker-repo.yaml +++ b/deploy/bases/tracker-repo.yaml @@ -8,7 +8,5 @@ spec: interval: 1m0s ref: branch: master - secretRef: - name: flux-credentials - url: ssh://git@github.com/canada-ca/tracker + url: https://github.com/canada-ca/tracker diff --git a/deploy/creds/readonly/kustomization.yaml b/deploy/creds/readonly/kustomization.yaml deleted file mode 100644 index 7e0a57813b..0000000000 --- a/deploy/creds/readonly/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component -# apiVersion: kustomize.config.k8s.io/v1beta1 -# kind: Kustomization -secretGenerator: -- files: - - identity - - identity.pub - - known_hosts - name: flux-credentials - namespace: flux-system -generatorOptions: - disableNameSuffixHash: true diff --git a/deploy/gke/kustomization.yaml b/deploy/gke/kustomization.yaml index 59d374203a..df14fee8d5 100644 --- a/deploy/gke/kustomization.yaml +++ b/deploy/gke/kustomization.yaml @@ -5,5 +5,5 @@ resources: - api-image-policy.yaml - frontend-image-policy.yaml - update-automation.yaml -components: -- ../creds/readwrite +patches: +- path: tracker-repo.yaml diff --git a/deploy/gke/tracker-repo.yaml b/deploy/gke/tracker-repo.yaml new file mode 100644 index 0000000000..a04bb17009 --- /dev/null +++ b/deploy/gke/tracker-repo.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1beta1 +kind: GitRepository +metadata: + name: tracker + namespace: flux-system +spec: + interval: 1m0s + ref: + branch: master + secretRef: + name: flux-credentials + url: ssh://git@github.com/canada-ca/tracker + diff --git a/deploy/minikube/kustomization.yaml b/deploy/minikube/kustomization.yaml index 27c279572b..3669131f60 100644 --- a/deploy/minikube/kustomization.yaml +++ b/deploy/minikube/kustomization.yaml @@ -5,5 +5,3 @@ resources: patchesStrategicMerge: - app-kustomization.yaml - platform-kustomization.yaml -components: -- ../creds/readonly diff --git a/deploy/test/kustomization.yaml b/deploy/test/kustomization.yaml index 27c279572b..3669131f60 100644 --- a/deploy/test/kustomization.yaml +++ b/deploy/test/kustomization.yaml @@ -5,5 +5,3 @@ resources: patchesStrategicMerge: - app-kustomization.yaml - platform-kustomization.yaml -components: -- ../creds/readonly