Add FluxCD support for cert-manager

Introducing FluxCD support for cert-manager with new manifests added. The existing Armada app will still be supported. When stx-cert-manager is built, two packages are produced: one Armada package (supports existing cert-manager version v0.15.0) and FluxCD package (supports new cert-manager version v1.7.1). Test Cases: PASS: Verify that there are no changes to the armada rpm generated PASS: Run the rpm build and verify that two packages are generated: stx-cert-manager-helm-<version>.tis.noarch.rpm and stx-cert-manager-helm-fluxcd-<version>.tis.noarch.rpm PASS: Install the new package with kustomize and verify cert-manager pods/services/deployments etc are deployed and running successfully PASS: Verify that the fluxcd version of the app uses cert-manager 1.7.1 Two Stories/Tasks linked here since FluxCD support & upversioning of Cert-Manager are performed in same commit. Story: 2009138 Task: 44666 Story: 2009837 Task: 44668 Signed-off-by: Sabeel Ansari <Sabeel.Ansari@windriver.com> Change-Id: Icf5aeed35dc5ebf906238a1b52912ef33d46c6b9
2022-03-04 08:48:38 -05:00
parent 55814a8845
commit 993f4bf35d
15 changed files with 450 additions and 9 deletions
--- a/centos_iso_image.inc
+++ b/centos_iso_image.inc
@@ -1 +1,2 @@
 stx-cert-manager-helm
+stx-cert-manager-helm-fluxcd
--- a/centos_tarball-dl.lst
+++ b/centos_tarball-dl.lst
@@ -1 +1,2 @@
 helm-charts-certmanager-1d6ecc9cf8d841782acb5f3d3c28467c24c5fd18.tar.gz#helm-charts-certmanager#https://github.com/jetstack/cert-manager/archive/1d6ecc9cf8d841782acb5f3d3c28467c24c5fd18.tar.gz#http##
+helm-charts-certmanager-1.7.1.tar.gz#helm-charts#https://github.com/cert-manager/cert-manager/archive/refs/tags/v1.7.1.tar.gz#http##
--- a/cert-manager-helm/centos/build_srpm.data
+++ b/cert-manager-helm/centos/build_srpm.data
@@ -1,9 +1,15 @@
 TAR_NAME=helm-charts-certmanager
+
+# Armada version
 SHA=1d6ecc9cf8d841782acb5f3d3c28467c24c5fd18
 VERSION=1.0.0
-TAR="$TAR_NAME-$SHA.tar.gz"
+ARMADA_TAR="$TAR_NAME-$SHA.tar.gz"

-COPY_LIST="${CGCS_BASE}/downloads/$TAR $PKG_BASE/files/* "
+# FluxCD version
+CM_VERSION=1.7.1
+FLUXCD_TAR="$TAR_NAME-$CM_VERSION.tar.gz"
+
+COPY_LIST="${CGCS_BASE}/downloads/$ARMADA_TAR ${CGCS_BASE}/downloads/$FLUXCD_TAR $PKG_BASE/files/* "

 OPT_DEP_LIST="$STX_BASE/cert-manager-armada-app/stx-cert-manager-helm"

--- a/stx-cert-manager-helm/centos/build_srpm.data
+++ b/stx-cert-manager-helm/centos/build_srpm.data
@@ -5,6 +5,18 @@ SRC_DIR="stx-cert-manager-helm"
 TIS_BASE_SRCREV=94d4c26f982e2e8c222517900c504580d1e3a09d
 TIS_PATCH_VER=GITREVCOUNT

+TAR_NAME=helm-charts-certmanager
+
+# Armada version
+SHA=1d6ecc9cf8d841782acb5f3d3c28467c24c5fd18
+ARMADA_TAR="$TAR_NAME-$SHA.tar.gz"
+
+# FluxCD version
+CM_VERSION=1.7.1
+FLUXCD_TAR="$TAR_NAME-$CM_VERSION.tar.gz"
+
+COPY_LIST="${CGCS_BASE}/downloads/$ARMADA_TAR ${CGCS_BASE}/downloads/$FLUXCD_TAR $PKG_BASE/$SRC_DIR/files/* $PKG_BASE/$SRC_DIR/manifests/* $PKG_BASE/$SRC_DIR/fluxcd-manifests/*"
+
 COPY_LIST_TO_TAR="\
    $STX_BASE/helm-charts/psp-rolebinding/psp-rolebinding/helm-charts \
 "
--- a/stx-cert-manager-helm/centos/stx-cert-manager-helm.spec
+++ b/stx-cert-manager-helm/centos/stx-cert-manager-helm.spec
@@ -8,6 +8,8 @@
 # Build variables
 %global helm_folder /usr/lib/helm

+%global fluxcd_cm_version 1.7.1
+
 Summary: StarlingX Cert-Manager Armada Helm Charts
 Name: stx-cert-manager-helm
 Version: 1.0
@@ -17,7 +19,20 @@ Group: base
 Packager: Wind River <info@windriver.com>
 URL: unknown

-Source0: %{name}-%{version}.tar.gz
+Source0: helm-charts-certmanager-%{version}.tar.gz
+Source1: Makefile
+
+# fluxcd specific source items
+Source4: 0001-Patch-for-acmesolver-and-chartyaml-cm-v1.7.1.patch
+Source5: helm-charts-certmanager-%{fluxcd_cm_version}.tar.gz
+Source6: kustomization.yaml
+Source7: base_helmrepository.yaml
+Source8: base_kustomization.yaml
+Source9: base_namespace.yaml
+Source10: cert-manager_helmrelease.yaml
+Source11: cert-manager_kustomization.yaml
+Source12: cert-manager_cert-manager-static-overrides.yaml
+Source13: cert-manager_cert-manager-system-overrides.yaml

 BuildArch: noarch

@@ -30,8 +45,16 @@ BuildRequires: python-k8sapp-cert-manager-wheels
 %description
 StarlingX Cert-Manager Armada Helm Charts

+%package fluxcd
+Summary: StarlingX Cert-Manager Application FluxCD Helm Charts
+Group: base
+License: Apache-2.0
+
+%description fluxcd
+StarlingX Cert-Manager Application FluxCD Helm Charts
+
 %prep
-%setup
+%setup -n helm-charts-certmanager-%{version}

 %build
 # Host a server for the charts
@@ -44,14 +67,44 @@ cd helm-charts
 make psp-rolebinding
 cd -

+# set up fluxcd tar source
+cd %{_builddir}
+rm -rf fluxcd
+/usr/bin/mkdir -p fluxcd
+cd fluxcd
+/usr/bin/tar xfv /builddir/build/SOURCES/helm-charts-certmanager-%{fluxcd_cm_version}.tar.gz
+
+cd %{_builddir}/fluxcd/helm-charts
+cp %{SOURCE4} .
+patch -p1 < %{SOURCE4}
+rm -f deploy/charts/cert-manager/templates/deployment.yaml.orig
+
+# Copy CRD yaml files to templates
+cp deploy/crds/*.yaml deploy/charts/cert-manager/templates/
+
+# Create the tgz files
+cp %{SOURCE1} deploy/charts
+cd deploy/charts
+
+# In Cert-manager release, 'helm lint' fails
+# on templates/BUILD.bazel (with invalid file extension)
+# Removing the problem file
+rm cert-manager/templates/BUILD.bazel
+
+make cert-manager
+mv *.tgz %{app_name}-fluxcd-%{version}-%{tis_patch_ver}.tgz
+cd -
+
 # terminate helm server (the last backgrounded task)
 kill %1

 # Create a chart tarball compliant with sysinv kube-app.py
 %define app_staging %{_builddir}/staging
-%define app_tarball %{app_name}-%{version}-%{tis_patch_ver}.tgz
+%define app_tarball_armada %{app_name}-%{version}-%{tis_patch_ver}.tgz
+%define app_tarball_fluxcd %{app_name}-fluxcd-%{version}-%{tis_patch_ver}.tgz

 # Setup staging
+cd %{_builddir}/helm-charts-certmanager-%{version}
 mkdir -p %{app_staging}
 cp files/metadata.yaml %{app_staging}
 cp manifests/*.yaml %{app_staging}
@@ -69,17 +122,46 @@ sed -i 's/@HELM_REPO@/%{helm_repo}/g' %{app_staging}/metadata.yaml
 mkdir -p %{app_staging}/plugins
 cp /plugins/%{app_name}/*.whl %{app_staging}/plugins

-# package it up
+# package armada
 find . -type f ! -name '*.md5' -print0 | xargs -0 md5sum > checksum.md5
-tar -zcf %{_builddir}/%{app_tarball} -C %{app_staging}/ .
+tar -zcf %{_builddir}/%{app_tarball_armada} -C %{app_staging}/ .
+
+# package fluxcd
+rm -f %{app_staging}/certmanager-manifest.yaml
+rm -f %{app_staging}/charts/*.tgz
+cp %{_builddir}/fluxcd/helm-charts/deploy/charts/*.tgz %{app_staging}/charts
+cp %{_builddir}/helm-charts-certmanager-%{version}/helm-charts/psp*.tgz %{app_staging}/charts
+fluxcd_dest=%{app_staging}/fluxcd-manifests
+mkdir -p $fluxcd_dest
+cp %{SOURCE6} %{app_staging}/fluxcd-manifests
+cd %{_sourcedir}
+directories="base cert-manager"
+for dir in $directories;
+do
+  mkdir -p $dir
+  prefix="${dir}_"
+  for file in ${dir}_*; do
+    mv $file $dir/"${file#$prefix}"
+  done
+  cp -r $dir $fluxcd_dest
+done
+cd -
+
+find . -type f ! -name '*.md5' -print0 | xargs -0 md5sum > checksum.md5
+tar -zcf %{_builddir}/%{app_tarball_fluxcd} -C %{app_staging}/ .

 # Cleanup staging
 rm -fr %{app_staging}

 %install
 install -d -m 755 %{buildroot}/%{app_folder}
-install -p -D -m 755 %{_builddir}/%{app_tarball} %{buildroot}/%{app_folder}
+install -p -D -m 755 %{_builddir}/%{app_tarball_armada} %{buildroot}/%{app_folder}
+install -p -D -m 755 %{_builddir}/%{app_tarball_fluxcd} %{buildroot}/%{app_folder}

 %files
 %defattr(-,root,root,-)
-%{app_folder}/*
+%{app_folder}/%{app_tarball_armada}
+
+%files fluxcd
+%defattr(-,root,root,-)
+%{app_folder}/%{app_tarball_fluxcd}
--- a/stx-cert-manager-helm/stx-cert-manager-helm/files/0001-Patch-for-acmesolver-and-chartyaml-cm-v1.7.1.patch
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/files/0001-Patch-for-acmesolver-and-chartyaml-cm-v1.7.1.patch
@@ -0,0 +1,71 @@
+From 33cf9baf34b3006d997e951a9cf787fb6a04c450 Mon Sep 17 00:00:00 2001
+From: Sabeel Ansari <Sabeel.Ansari@windriver.com>
+Date: Wed, 2 Mar 2022 13:09:23 -0500
+Subject: [PATCH] Patch for acmesolver-and-chartyaml-cm-v1.7.1
+
+---
+ deploy/charts/cert-manager/Chart.yaml         | 20 +++++++++++++++++++
+ .../cert-manager/templates/deployment.yaml    |  1 +
+ deploy/charts/cert-manager/values.yaml        |  7 +++++++
+ 3 files changed, 28 insertions(+)
+ create mode 100644 deploy/charts/cert-manager/Chart.yaml
+
+diff --git a/deploy/charts/cert-manager/Chart.yaml b/deploy/charts/cert-manager/Chart.yaml
+new file mode 100644
+index 000000000..d4476fd70
+--- /dev/null
+++ b/deploy/charts/cert-manager/Chart.yaml
+@@ -0,0 +1,20 @@
+apiVersion: v1
+name: cert-manager
+# The version and appVersion fields are set automatically by the release tool
+version: v1.7.1
+appVersion: v1.7.1
+description: A Helm chart for cert-manager
+home: https://github.com/cert-manager/cert-manager
+icon: https://raw.githubusercontent.com/jetstack/cert-manager/master/logo/logo.png
+keywords:
+  - cert-manager
+  - kube-lego
+  - letsencrypt
+  - tls
+sources:
+  - https://github.com/cert-manager/cert-manager
+maintainers:
+  - name: cert-manager-maintainers
+    email: cert-manager-maintainers@googlegroups.com
+annotations:
+  artifacthub.io/prerelease: "{{IS_PRERELEASE}}"
+diff --git a/deploy/charts/cert-manager/templates/deployment.yaml b/deploy/charts/cert-manager/templates/deployment.yaml
+index b7f549edc..506fa54aa 100644
+--- a/deploy/charts/cert-manager/templates/deployment.yaml
+++ b/deploy/charts/cert-manager/templates/deployment.yaml
+@@ -113,6 +113,7 @@ spec:
+           {{- if .Values.featureGates }}
+           - --feature-gates={{ .Values.featureGates }}
+           {{- end }}
+          - --acme-http01-solver-image={{ .Values.acmesolver.image.repository }}:{{ default $.Chart.AppVersion .Values.acmesolver.image.tag }}
+           ports:
+           - containerPort: 9402
+             name: http-metrics
+diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml
+index 44a04db21..a9dca2f97 100644
+--- a/deploy/charts/cert-manager/values.yaml
+++ b/deploy/charts/cert-manager/values.yaml
+@@ -428,6 +428,13 @@ cainjector:
+     # Automount API credentials for a Service Account.
+     automountServiceAccountToken: true
+ 
+acmesolver:
+  image:
+    repository: quay.io/jetstack/cert-manager-acmesolver
+    # Override the image tag to deploy by setting this variable.
+    # If no value is set, the chart's appVersion will be used.
+    # tag: canary
+
+ # This startupapicheck is a Helm post-install hook that waits for the webhook
+ # endpoints to become available.
+ # The check is implemented using a Kubernetes Job- if you are injecting mesh
+-- 
+2.29.2
+
--- a/stx-cert-manager-helm/stx-cert-manager-helm/files/Makefile
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/files/Makefile
@@ -0,0 +1,43 @@
+#
+# Copyright 2017 The Openstack-Helm Authors.
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# It's necessary to set this because some environments don't link sh -> bash.
+SHELL := /bin/bash
+TASK  := build
+
+EXCLUDES := helm-toolkit doc tests tools logs tmp
+CHARTS := helm-toolkit $(filter-out $(EXCLUDES), $(patsubst %/.,%,$(wildcard */.)))
+
+.PHONY: $(EXCLUDES) $(CHARTS)
+
+all: $(CHARTS)
+
+$(CHARTS):
+	@if [ -d $@ ]; then \
+		echo; \
+		echo "===== Processing [$@] chart ====="; \
+		make $(TASK)-$@; \
+	fi
+
+init-%:
+	if [ -f $*/Makefile ]; then make -C $*; fi
+	if [ -f $*/requirements.yaml ]; then helm dep up $*; fi
+
+lint-%: init-%
+	if [ -d $* ]; then helm lint $*; fi
+
+build-%: lint-%
+	if [ -d $* ]; then helm package $*; fi
+
+clean:
+	@echo "Clean all build artifacts"
+	rm -f */templates/_partials.tpl */templates/_globals.tpl
+	rm -f *tgz */charts/*tgz */requirements.lock
+	rm -rf */charts */tmpcharts
+
+%:
+	@:
--- a/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/base_helmrepository.yaml
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/base_helmrepository.yaml
@@ -0,0 +1,13 @@
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: stx-platform
+spec:
+  url: http://192.168.206.1:8080/helm_charts/stx-platform
+  interval: 60m
--- a/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/base_kustomization.yaml
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/base_kustomization.yaml
@@ -0,0 +1,8 @@
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+resources:
+  - helmrepository.yaml
--- a/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/base_namespace.yaml
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/base_namespace.yaml
@@ -0,0 +1,10 @@
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
--- a/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/cert-manager_cert-manager-static-overrides.yaml
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/cert-manager_cert-manager-static-overrides.yaml
@@ -0,0 +1,97 @@
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+global:
+  imagePullSecrets: [{"name": "default-registry-key"}]
+installCRDs: true
+replicaCount: 1
+image:
+  repository: quay.io/jetstack/cert-manager-controller
+  tag: v1.7.1
+nodeSelector:
+  node-role.kubernetes.io/master: ""
+affinity:
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+    - labelSelector:
+        matchExpressions:
+        - key: app
+          operator: In
+          values:
+          - cert-manager
+      topologyKey: kubernetes.io/hostname
+tolerations:
+  - key: "node-role.kubernetes.io/master"
+    operator: "Exists"
+    effect: "NoSchedule"
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxSurge: 1
+    maxUnavailable: 1
+extraArgs:
+  - --enable-certificate-owner-ref=true
+webhook:
+  replicaCount: 1
+  serviceName: "cm-cert-manager-webhook"
+  image:
+    repository: quay.io/jetstack/cert-manager-webhook
+    tag: v1.7.1
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+  affinity:
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchExpressions:
+          - key: app
+            operator: In
+            values:
+            - webhook
+        topologyKey: kubernetes.io/hostname
+  tolerations:
+    - key: "node-role.kubernetes.io/master"
+      operator: "Exists"
+      effect: "NoSchedule"
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+cainjector:
+  replicaCount: 1
+  image:
+    repository: quay.io/jetstack/cert-manager-cainjector
+    tag: v1.7.1
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+  affinity:
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchExpressions:
+          - key: app
+            operator: In
+            values:
+            - cainjector
+        topologyKey: kubernetes.io/hostname
+  tolerations:
+    - key: "node-role.kubernetes.io/master"
+      operator: "Exists"
+      effect: "NoSchedule"
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+acmesolver:
+  image:
+    repository: quay.io/jetstack/cert-manager-acmesolver
+    tag: v1.7.1
+---
+#Values for cert-manager-psp-rolebinding
+rolebindingNamespace: cert-manager
+serviceAccount: cert-manager
--- a/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/cert-manager_cert-manager-system-overrides.yaml
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/cert-manager_cert-manager-system-overrides.yaml
@@ -0,0 +1,6 @@
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
--- a/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/cert-manager_helmrelease.yaml
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/cert-manager_helmrelease.yaml
@@ -0,0 +1,61 @@
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+apiVersion: "helm.toolkit.fluxcd.io/v2beta1"
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  labels:
+    chart_group: cert-manager
+spec:
+  releaseName: cm-cert-manager
+  chart:
+    spec:
+      chart: cert-manager
+      version: v1.7.1
+      sourceRef:
+        kind: HelmRepository
+        name: stx-platform
+  interval: 5m
+  timeout: 30m
+  test:
+    enable: false
+  install:
+    disableHooks: false
+  upgrade:
+    disableHooks: false
+    force: true
+  valuesFrom:
+    - kind: Secret
+      name: cert-manager-static-overrides
+      valuesKey: cert-manager-static-overrides.yaml
+    - kind: Secret
+      name: cert-manager-system-overrides
+      valuesKey: cert-manager-system-overrides.yaml
+---
+apiVersion: "helm.toolkit.fluxcd.io/v2beta1"
+kind: HelmRelease
+metadata:
+  name: cert-manager-psp-rolebinding
+  labels:
+    chart_group: cert-manager-psp-rolebinding
+spec:
+  releaseName: cm-cert-manager-psp-rolebinding
+  chart:
+    spec:
+      chart: psp-rolebinding
+      version: 0.1.0
+      sourceRef:
+        kind: HelmRepository
+        name: stx-platform
+  interval: 5m
+  timeout: 30m
+  test:
+    enable: false
+  install:
+    disableHooks: false
+  upgrade:
+    force: true
--- a/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/cert-manager_kustomization.yaml
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/cert-manager_kustomization.yaml
@@ -0,0 +1,18 @@
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+namespace: cert-manager
+resources:
+  - helmrelease.yaml
+secretGenerator:
+  - name: cert-manager-static-overrides
+    files:
+      - cert-manager-static-overrides.yaml
+  - name: cert-manager-system-overrides
+    files:
+      - cert-manager-system-overrides.yaml
+generatorOptions:
+  disableNameSuffixHash: true
--- a/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/kustomization.yaml
+++ b/stx-cert-manager-helm/stx-cert-manager-helm/fluxcd-manifests/kustomization.yaml
@@ -0,0 +1,12 @@
+#
+# Copyright (c) 2022 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - base
+  - cert-manager