k8s.io/test-infra@v0.0.0-20240520184403-27c6b4c223d8/testgrid/config-updater-sa.sh (about)

     1  #!/usr/bin/env bash
     2  # Copyright 2019 The Kubernetes Authors.
     3  #
     4  # Licensed under the Apache License, Version 2.0 (the "License");
     5  # you may not use this file except in compliance with the License.
     6  # You may obtain a copy of the License at
     7  #
     8  #     http://www.apache.org/licenses/LICENSE-2.0
     9  #
    10  # Unless required by applicable law or agreed to in writing, software
    11  # distributed under the License is distributed on an "AS IS" BASIS,
    12  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  # See the License for the specific language governing permissions and
    14  # limitations under the License.
    15  
    16  set -o errexit
    17  set -o nounset
    18  set -o pipefail
    19  
    20  # This script will create a 'testgrid-config-updater' GCP service account with permissions
    21  # to update the TG config and load a service account key into the cluster's
    22  # test-pods namespace. This should only be done when the Prow instance is using a
    23  # separate build cluster and only trusted jobs are running in the service cluster.
    24  # Setting up this service account is necessary for Prow to update TG config with
    25  # a postsubmit job.
    26  
    27  # To use, point your kubeconfig at the correct cluster context and specify gcp
    28  # PROJECT and service account DESCRIPTION environment variables.
    29  
    30  # To enable prompts and run in "interactive" mode supply the "-i|--interactive" flag.
    31  # e.g.
    32  #  PROJECT="istio-testing" \
    33  #  DESCRIPTION="Used to update the TestGrid config in the gs://k8s-testgrid bucket." \
    34  #  config-updater-sa.sh --interactive
    35  
    36  # Globals:
    37  SERVICE_ACCOUNT="${SERVICE_ACCOUNT:=testgrid-config-updater}"
    38  # PROJECT => "required"
    39  # DESCRIPTION => "required"
    40  
    41  # Options:
    42  INTERACTIVE=
    43  
    44  function cleanup() {
    45    # For security reasons, delete private key regardless of exit code.
    46    trap 'rm -f "$SERVICE_ACCOUNT-sa-key.json"' EXIT
    47  }
    48  
    49  function create_service_account() {
    50    prompt "Create service-account: \"$SERVICE_ACCOUNT\" in Project: \"$PROJECT\""
    51  
    52    # Create a service account for performing Prow deployments in a GCP project.
    53    gcloud beta iam service-accounts create "${SERVICE_ACCOUNT}" --project="${PROJECT}" --description="${DESCRIPTION}" --display-name="TestGrid Config Updater SA"
    54  
    55    # Add the `roles/storage.objectAdmin` IAM policy binding to the service account.
    56    # https://cloud.google.com/iam/docs/understanding-roles#storage-roles
    57    gcloud projects add-iam-policy-binding "$PROJECT" --member="serviceAccount:${SERVICE_ACCOUNT}@${PROJECT}.iam.gserviceaccount.com" --role "roles/storage.objectAdmin"
    58  
    59    # Generate private key and attach to the service account.
    60    gcloud iam service-accounts keys create "${SERVICE_ACCOUNT}-sa-key.json" --project="${PROJECT}" --iam-account="${SERVICE_ACCOUNT}@${PROJECT}.iam.gserviceaccount.com"
    61  }
    62  
    63  function create_secret() {
    64    prompt "Create cluster secret for Kube context: \"$(kubectl config current-context)\""
    65  
    66    # Deploy the service-account secret to the cluster in the current context.
    67    kubectl create secret generic -n test-pods "${SERVICE_ACCOUNT}-service-account" --from-file="service-account.json=${SERVICE_ACCOUNT}-sa-key.json"
    68  }
    69  
    70  function handle_options() {
    71    while [ $# -gt 0 ]; do
    72      case "$1" in
    73      -i | --interactive)
    74        INTERACTIVE=1
    75        shift
    76        ;;
    77      *)
    78        echo "Unknown option: $1" >&1
    79        exit 1
    80        ;;
    81      esac
    82    done
    83  }
    84  
    85  function prompt() {
    86    if [ "$INTERACTIVE" ]; then
    87      echo
    88      read -r -n1 -p "$1 ? [y/n] "
    89      echo
    90      if [[ ! $REPLY =~ ^[Yy]$ ]]; then
    91        exit 0
    92      fi
    93    fi
    94  }
    95  
    96  function main() {
    97    cleanup
    98    handle_options "$@"
    99    create_service_account
   100    create_secret
   101  }
   102  
   103  main "$@"