From a71ee15f6db2c214be8bfbe69c56463004888371 Mon Sep 17 00:00:00 2001 From: Kjeld Schouten Date: Thu, 24 Oct 2024 10:36:17 +0200 Subject: [PATCH] feat(clustertool): remove the use of talos manifests in favor of kubectl --- clustertool/cmd/apply.go | 4 + .../embed/generic/base/DOTREPLACEgitignore | 10 ++- .../embed/generic/base/talos/talconfig.yaml | 4 - .../embed/generic/patches/manifests.yaml | 6 -- .../embed/generic/patches/sopssecret.yaml | 39 --------- clustertool/pkg/fluxhandler/sshsecretgen.go | 35 -------- clustertool/pkg/gencmd/bootstrap.go | 8 ++ clustertool/pkg/gencmd/genconfig.go | 2 - clustertool/pkg/helper/vars.go | 8 +- clustertool/pkg/initfiles/initfiles.go | 85 +++++++++++-------- .../virtual-machines/virtualbox.md | 1 - 11 files changed, 77 insertions(+), 125 deletions(-) delete mode 100644 clustertool/embed/generic/patches/manifests.yaml delete mode 100644 clustertool/embed/generic/patches/sopssecret.yaml diff --git a/clustertool/cmd/apply.go b/clustertool/cmd/apply.go index a2a5cdfb4e2..de40f1b0e74 100644 --- a/clustertool/cmd/apply.go +++ b/clustertool/cmd/apply.go @@ -71,6 +71,10 @@ func RunApply(node string, extraArgs []string) { kubeconfigcmds := gencmd.GenKubeConfig(helper.TalEnv["VIP_IP"]) gencmd.ExecCmd(kubeconfigcmds) + + if helper.GetYesOrNo("Do you want to (re)load ssh, Sops and ClusterEnv onto the cluster? (yes/no) [y/n]: ") { + + } } func init() { diff --git a/clustertool/embed/generic/base/DOTREPLACEgitignore b/clustertool/embed/generic/base/DOTREPLACEgitignore index 1d04e41439c..a853079e26f 100644 --- a/clustertool/embed/generic/base/DOTREPLACEgitignore +++ b/clustertool/embed/generic/base/DOTREPLACEgitignore @@ -1,9 +1,15 @@ talconfig.json clusterconfig -patches/sopssecret.yaml patches/all.yaml patches/controlplane.yaml -patches/manifests.yaml patches/worker.yaml +*patches/all.yaml +*patches/controlplane.yaml +*patches/worker.yaml +all.yaml +controlplane.yaml +worker.yaml +*sopssecret.secret.yaml +sopssecret.secret.yaml cluster/main/kubernetes/**/bootstrap-values.yaml.ct *kubeconfig diff --git a/clustertool/embed/generic/base/talos/talconfig.yaml b/clustertool/embed/generic/base/talos/talconfig.yaml index 29f24911f32..2857c92b482 100644 --- a/clustertool/embed/generic/base/talos/talconfig.yaml +++ b/clustertool/embed/generic/base/talos/talconfig.yaml @@ -41,9 +41,6 @@ nodes: controlPlane: patches: - '@./patches/controlplane.yaml' - - '@./patches/sopssecret.yaml' - - '@./patches/manifests.yaml' - # - '@./patches/nvidia.yaml' schematic: customization: extraKernelArgs: @@ -64,7 +61,6 @@ controlPlane: worker: patches: - '@./patches/worker.yaml' - # - '@./patches/nvidia.yaml' schematic: customization: systemExtensions: diff --git a/clustertool/embed/generic/patches/manifests.yaml b/clustertool/embed/generic/patches/manifests.yaml deleted file mode 100644 index c027c6b625a..00000000000 --- a/clustertool/embed/generic/patches/manifests.yaml +++ /dev/null @@ -1,6 +0,0 @@ -- op: replace - path: /machine/time - value: - "disabled": false - "servers": - - "time.cloudflare.com" diff --git a/clustertool/embed/generic/patches/sopssecret.yaml b/clustertool/embed/generic/patches/sopssecret.yaml deleted file mode 100644 index b5183f7412f..00000000000 --- a/clustertool/embed/generic/patches/sopssecret.yaml +++ /dev/null @@ -1,39 +0,0 @@ -- op: add - path: /cluster/inlineManifests - value: - - name: flux-system - contents: |- - apiVersion: v1 - kind: Namespace - metadata: - name: flux-system - - name: sops-age - contents: |- - apiVersion: v1 - stringData: - age.agekey: REPLACEWITHSOPS - kind: Secret - metadata: - creationTimestamp: null - name: sops-age - namespace: flux-system - - name: cluster-config - contents: |- - apiVersion: v1 - kind: ConfigMap - metadata: - creationTimestamp: null - name: cluster-config - namespace: flux-system - data: -REPLACEWITHTALENV - - name: deploy-key - contents: |- - apiVersion: v1 - kind: ConfigMap - metadata: - creationTimestamp: null - name: deploy-key - namespace: flux-system - stringData: -REPLACEWITHDEPLOYKEY diff --git a/clustertool/pkg/fluxhandler/sshsecretgen.go b/clustertool/pkg/fluxhandler/sshsecretgen.go index 11ab11cd8d4..b62104b6fb4 100644 --- a/clustertool/pkg/fluxhandler/sshsecretgen.go +++ b/clustertool/pkg/fluxhandler/sshsecretgen.go @@ -127,41 +127,6 @@ func CreateGitSecret(gitURL string) error { return nil } -func CreateSshPatch() { - log.Info().Msg("generating talospatch for flux ssh key...") - // Paths to the YAML files - secretPath := filepath.Join(helper.ClusterPath, "kubernetes", "flux-system", "flux", "deploykey.secret.yaml") - sopsPatchPath := filepath.Join(helper.ClusterPath, "talos", "patches", "sopssecret.yaml") - - // Read the YAML file - yamlFile, err := ioutil.ReadFile(secretPath) - if err != nil { - log.Fatal().Err(err).Msg("error: %v") - } - - // Unmarshal the YAML content into a Config struct - var config Config - err = yaml.Unmarshal(yamlFile, &config) - if err != nil { - log.Fatal().Err(err).Msg("error: %v") - } - - // Extract the stringData content and convert it to a multi-line string - stringData, err := yaml.Marshal(config.StringData) - if err != nil { - log.Fatal().Err(err).Msg("error: %v") - } - - // Convert byte array to string - deployKeyData := string(stringData) - - // Replace the placeholder in sopspath.yaml - err = ReplacePlaceholder(sopsPatchPath, "REPLACEWITHDEPLOYKEY", indentYaml(deployKeyData, " ")) - if err != nil { - log.Fatal().Err(err).Msg("Failed to replace placeholder: %v") - } -} - // indentYaml indents each line of the YAML string with the specified indentation. func indentYaml(yamlStr, indent string) string { lines := strings.Split(yamlStr, "\n") diff --git a/clustertool/pkg/gencmd/bootstrap.go b/clustertool/pkg/gencmd/bootstrap.go index cb5baa99348..d4920884d35 100644 --- a/clustertool/pkg/gencmd/bootstrap.go +++ b/clustertool/pkg/gencmd/bootstrap.go @@ -158,6 +158,14 @@ func RunBootstrap(args []string) { } } + for _, filePath := range helper.ManifestPaths { + log.Info().Msgf("Bootstrap: Loading Manifest: %v", filePath) + if err := kubectlcmds.KubectlApply(ctx, filePath); err != nil { + log.Info().Msgf("Error applying manifest for %s: %v\n", filepath.Base(filePath), err) + os.Exit(1) + } + } + log.Info().Msg("Bootstrap: Base Cluster Configuration Completed, continuing setup...") log.Info().Msg("Bootstrap: Confirming cluster health...") healthcmd := GenHealth(helper.TalEnv["VIP_IP"]) diff --git a/clustertool/pkg/gencmd/genconfig.go b/clustertool/pkg/gencmd/genconfig.go index c52cead0264..fa1b333b075 100644 --- a/clustertool/pkg/gencmd/genconfig.go +++ b/clustertool/pkg/gencmd/genconfig.go @@ -27,8 +27,6 @@ func GenConfig(args []string) error { initfiles.GenSchema() initfiles.GenTalEnvConfigMap() initfiles.CheckEnvVariables() - initfiles.GenPatches() - fluxhandler.CreateSshPatch() genTalSecret() validateTalConfig(args) talhelperGenConfig() diff --git a/clustertool/pkg/helper/vars.go b/clustertool/pkg/helper/vars.go index 231a5dc5b3b..8022a5e0842 100644 --- a/clustertool/pkg/helper/vars.go +++ b/clustertool/pkg/helper/vars.go @@ -25,7 +25,13 @@ var ( AllIPs = []string{} ControlPlaneIPs = []string{} WorkerIPs = []string{} - KubeFilterStr = []string{ + ManifestPaths = []string{ + filepath.Join("flux-system", "flux", "sopskey.secret.yaml"), + filepath.Join("flux-system", "flux", "deploykey.secret.yaml"), + filepath.Join("flux-system", "flux", "clustersettings.secret.yaml"), + } + + KubeFilterStr = []string{ ".*would violate PodSecurity.*", } diff --git a/clustertool/pkg/initfiles/initfiles.go b/clustertool/pkg/initfiles/initfiles.go index 8be085915b4..648e60748b6 100644 --- a/clustertool/pkg/initfiles/initfiles.go +++ b/clustertool/pkg/initfiles/initfiles.go @@ -14,12 +14,14 @@ import ( "time" "github.com/rs/zerolog/log" + "gopkg.in/yaml.v2" age "filippo.io/age" talhelperCfg "github.com/budimanjojo/talhelper/v3/pkg/config" "github.com/invopop/jsonschema" "github.com/truecharts/public/clustertool/pkg/fluxhandler" "github.com/truecharts/public/clustertool/pkg/helper" + corev1 "k8s.io/api/core/v1" ) func InitFiles() error { @@ -34,7 +36,7 @@ func InitFiles() error { GenTalEnvConfigMap() UpdateGitRepo() fluxhandler.CreateGitSecret(helper.TalEnv["GITHUB_REPOSITORY"]) - fluxhandler.CreateSshPatch() + GenSopsSecret() if err := fluxhandler.ProcessDirectory(path.Join(helper.ClusterPath, "kubernetes")); err != nil { log.Error().Msgf("Error: %v", err) } @@ -277,29 +279,6 @@ func GenPatches() error { setDocker() - // Read the content of the talenv.yaml file - talenvContent, err := os.ReadFile(helper.ClusterPath + "/clusterenv.yaml") - if err != nil { - return err - } - - // Convert the file content to a string and split it into lines - talenvLines := strings.Split(string(talenvContent), "\n") - - // Add indentation to each line - for i, line := range talenvLines { - talenvLines[i] = " " + line - } - - // Join the indented lines back into a single string - indentedTalenvContent := strings.Join(talenvLines, "\n") - - helper.ReplaceInFile(filepath.Join(helper.ClusterPath, "/talos/patches", "sopssecret.yaml"), "REPLACEWITHTALENV", indentedTalenvContent) - // log.Info().Msg("test", filepath.Join(helper.ClusterPath, "/talos/patches", "sopssecret.yaml")) - if err != nil { - log.Fatal().Err(err).Msg("Error: %s") - } - return nil } @@ -308,17 +287,18 @@ func setDocker() { if helper.TalEnv["DOCKERHUB_USER"] != "" && helper.TalEnv["DOCKERHUB_PASSWORD"] != "" { // Prepare the content to append configContent := fmt.Sprintf(`# Add Dockerhub Login - registries: - config: - registry-1.docker.io: - auth: - username: %s - password: %s - docker.io: - auth: - username: %s - password: %s - +- op: add + path: /machine/registries/config/registry-1.docker.io/auth/username + value: "%s" +- op: add + path: /machine/registries/config/registry-1.docker.io/auth/password + value: "%s" +- op: add + path: /machine/registries/config/docker.io/auth/username + value: "%s" +- op: add + path: /machine/registries/config/docker.io/auth/password + value: "%s" `, helper.TalEnv["DOCKERHUB_USER"], helper.TalEnv["DOCKERHUB_PASSWORD"], helper.TalEnv["DOCKERHUB_USER"], helper.TalEnv["DOCKERHUB_PASSWORD"]) // Open the file in append mode or create it if it doesn't exist @@ -455,6 +435,41 @@ func GetSecKey() (string, error) { return secretKey, nil } +func GenSopsSecret() error { + secretPath := filepath.Join(helper.ClusterPath, "kubernetes", "flux-system", "flux", "sopsscret.secret.yaml") + ageSecKey, err := GetSecKey() + // Generate Kubernetes secret YAML content + secret := map[string]interface{}{ + "apiVersion": "v1", + "kind": "Secret", + "metadata": map[string]interface{}{ + "name": "sops-age", + "namespace": "flux-system", + }, + "stringData": map[string]interface{}{ + "age.agekey": ageSecKey, + }, + "type": string(corev1.SecretTypeOpaque), + } + + secretYAML, err := yaml.Marshal(secret) + if err != nil { + return fmt.Errorf("failed to marshal secret to YAML: %w", err) + } + + // Write Kubernetes secret YAML to file + err = os.MkdirAll(filepath.Dir(secretPath), 0755) + if err != nil { + return fmt.Errorf("failed to create directories: %w", err) + } + err = os.WriteFile(secretPath, secretYAML, 0644) + if err != nil { + return fmt.Errorf("failed to write secret YAML to file: %w", err) + } + log.Info().Msgf("Kubernetes secret YAML saved to: %s\n", secretPath) + return nil +} + func GenSchema() error { cfg := talhelperCfg.TalhelperConfig{} r := new(jsonschema.Reflector) diff --git a/website/src/content/docs/clustertool/virtual-machines/virtualbox.md b/website/src/content/docs/clustertool/virtual-machines/virtualbox.md index fe26d395ce4..658514253f4 100644 --- a/website/src/content/docs/clustertool/virtual-machines/virtualbox.md +++ b/website/src/content/docs/clustertool/virtual-machines/virtualbox.md @@ -49,7 +49,6 @@ By default ClusterTool installs the `qemu-guest-agent` extension. This is not co controlPlane: patches: - '@./patches/controlplane.yaml' - - '@./patches/sopssecret.yaml' - '@./patches/manifests.yaml' # - '@./patches/nvidia.yaml' schematic: