adding job for post-install and moving job to cronjob for nightly met…

…rics
securesign · Nov 15, 2023 · 11c854d · 11c854d
1 parent 2c85714
commit 11c854d
Show file tree

Hide file tree

Showing 14 changed files with 186 additions and 46 deletions.
diff --git a/charts/trusted-artifact-signer/Chart.yaml b/charts/trusted-artifact-signer/Chart.yaml
@@ -33,4 +33,4 @@ sources:
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.23
+version: 0.1.24
diff --git a/charts/trusted-artifact-signer/README.md b/charts/trusted-artifact-signer/README.md
@@ -3,7 +3,7 @@
 
 A Helm chart for deploying Sigstore scaffold chart that is opinionated for OpenShift
 
-![Version: 0.1.23](https://img.shields.io/badge/Version-0.1.23-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.1.24](https://img.shields.io/badge/Version-0.1.24-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 ## Overview
 
@@ -117,12 +117,15 @@ Kubernetes: `>= 1.19.0-0`
 | configs.fulcio.server.secret.public_key_file | file containing signer public key | string | `""` |
 | configs.fulcio.server.secret.root_cert | fulcio root certificate authority (CA) | string | `""` |
 | configs.fulcio.server.secret.root_cert_file | file containing fulcio root certificate authority (CA) | string | `""` |
-| configs.nightlymetrics.image.pullPolicy |  | string | `"IfNotPresent"` |
-| configs.nightlymetrics.image.registry |  | string | `"registry.access.redhat.com"` |
-| configs.nightlymetrics.image.repository |  | string | `"ubi9/python-311"` |
-| configs.nightlymetrics.image.version |  | string | `"sha256:92416840a0361bf5c8ed6071f50098ddbdd1d14285793d4bcd8e761658c97df8"` |
-| configs.nightlymetrics.name |  | string | `"nightlyMetricsCollection"` |
-| configs.nightlymetrics.namespace |  | string | `"sigstore-monitoring"` |
+| configs.sigstore_monitoring.namespace |  | string | `"sigstore-monitoring"` |
+| configs.sigstore_monitoring.namespace_create |  | bool | `true` |
+| configs.segment_backup_job.image.registry |  | string | `"registry.access.redhat.com"` |
+| configs.segment_backup_job.image.pullPolicy |  | string | `"IfNotPresent"` |
+| configs.segment_backup_job.image.registry |  | string | `"registry.access.redhat.com"` |
+| configs.segment_backup_job.image.repository |  | string | `"ubi9/python-311"` |
+| configs.segment_backup_job.image.version |  | string | `"sha256:92416840a0361bf5c8ed6071f50098ddbdd1d14285793d4bcd8e761658c97df8"` |
+| configs.segment_backup_job.name |  | string | `"nightlyMetricsCollection"` |
+| configs.segment_backup_job.namespace |  | string | `"sigstore-monitoring"` |
 | configs.rekor.clusterMonitoring.enabled |  | bool | `true` |
 | configs.rekor.clusterMonitoring.endpoints[0].interval |  | string | `"30s"` |
 | configs.rekor.clusterMonitoring.endpoints[0].port |  | string | `"2112-tcp"` |

diff --git a/charts/trusted-artifact-signer/templates/segment-backup-cronjob.yaml b/charts/trusted-artifact-signer/templates/segment-backup-cronjob.yaml
@@ -0,0 +1,37 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .Values.configs.segment_backup_job.name }}
+  namespace: {{ .Values.configs.segment_backup_job.namespace }}
+spec:
+  schedule: "0 0 * * *"  
+  concurrencyPolicy: "Replace"
+  startingDeadlineSeconds: 200
+  suspend: false
+  successfulJobsHistoryLimit: 7
+  failedJobsHistoryLimit: 3
+  jobTemplate:                  
+    spec:
+      template:
+          metadata:
+            name: {{ .Values.configs.segment_backup_job.name }}
+            labels:               
+              parent: "segment-backup-job"
+          spec:
+            restartPolicy: OnFailure 
+            serviceAccountName: segment-backup-job
+            containers:
+              - name: {{ .Values.configs.segment_backup_job.name }}
+                # image: "{{ .Values.configs.segment_backup_job.image.registry }}/{{ .Values.configs.segment_backup_job.image.repository }}/{{ .Values.configs.segment_backup_job.image.version }}"
+                image: "{{ .Values.configs.segment_backup_job.image.registry }}/{{ .Values.configs.segment_backup_job.image.repository }}@{{ .Values.configs.segment_backup_job.image.version }}"
+                command: ["/bin/bash",  "/opt/app-root/src/script.sh"]
+                env:
+                  - name: RUN_TYPE
+                    value: "nightly"
+                securityContext:
+                  allowPrivilegeEscalation: false
+                  seccompProfile:
+                    type: RuntimeDefault
+                  capabilities:
+                    drop:
+                    - ALL
diff --git a/charts/trusted-artifact-signer/templates/segment-backup-job-clusterrole.yaml b/charts/trusted-artifact-signer/templates/segment-backup-job-clusterrole.yaml
@@ -0,0 +1,19 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: segment-backup-job
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - "route.openshift.io"
+  resources:
+  - routes
+  verbs:
+  - get
+  - list 
diff --git a/charts/trusted-artifact-signer/templates/segment-backup-job-clusterrolebinding.yaml b/charts/trusted-artifact-signer/templates/segment-backup-job-clusterrolebinding.yaml
@@ -0,0 +1,13 @@
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: segment-backup-job
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: segment-backup-job
+subjects:
+- kind: ServiceAccount
+  name: segment-backup-job
+  namespace: {{ .Values.configs.segment_backup_job.namespace }}
diff --git a/charts/trusted-artifact-signer/templates/segment-backup-job-sa.yaml b/charts/trusted-artifact-signer/templates/segment-backup-job-sa.yaml
@@ -1,9 +1,8 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: segment-backup-sa
+  name: segment-backup-job
+  # namespace: {{ .Values.configs.segment_backup_job.namespace }}
   namespace: sigstore-monitoring
 secrets:
-- name: pull-secret
-imagePullSecrets:
 - name: pull-secret
diff --git a/charts/trusted-artifact-signer/templates/segment-backup-job.yaml b/charts/trusted-artifact-signer/templates/segment-backup-job.yaml
@@ -1,24 +1,33 @@
 apiVersion: batch/v1
-kind: Cronjob
+kind: Job
 metadata:
-  name: {{ .Values.configs.segment-backup-job.name }}
-spec:
-  schedule: "0 0 * * *"  
-  concurrencyPolicy: "Replace"
-  startingDeadlineSeconds: 200
-  suspend: false
-  successfulJobsHistoryLimit: 7
-  failedJobsHistoryLimit: 3
-  jobTemplate:                  
+  name: {{ .Values.configs.segment_backup_job.name }}
+  namespace: {{ .Values.configs.segment_backup_job.namespace }}
+spec:  
+  parallelism: 1    
+  completions: 1
+  activeDeadlineSeconds: 600
+  backoffLimit: 5
+  template:
+    metadata:
+      name: {{ .Values.configs.segment_backup_job.name }}
+      labels:               
+        parent: "segment-backup-job"
     spec:
-      template:
-        serviceAccountName: segment-backup-sa
-        metadata:
-          labels:               
-            parent: "segment-backup-job"
-        spec:
-          containers:
-          - name: {{ .Values.configs.segment-backup-job.name }}
-            image: "{{ .Values.configs.cosign_deploy.image.registry }}/{{ .Values.configs.cosign_deploy.image.repository }}:{{ .Values.configs.cosign_deploy.image.version }}"
-            command: ["/bin/bash",  "/opt/app-root/src/script.sh"]
-          restartPolicy: OnFailure 
+      restartPolicy: OnFailure 
+      serviceAccountName: segment-backup-job
+      containers:
+        - name: {{ .Values.configs.segment_backup_job.name }}
+          # image: "{{ .Values.configs.segment_backup_job.image.registry }}/{{ .Values.configs.segment_backup_job.image.repository }}/{{ .Values.configs.segment_backup_job.image.version }}"
+          image: "{{ .Values.configs.segment_backup_job.image.registry }}/{{ .Values.configs.segment_backup_job.image.repository }}@{{ .Values.configs.segment_backup_job.image.version }}"
+          command: ["/bin/bash",  "/opt/app-root/src/script.sh"]
+          env:
+            - name: RUN_TYPE
+              value: "installation"
+          securityContext:
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop:
+              - ALL
diff --git a/charts/trusted-artifact-signer/values.schema.json b/charts/trusted-artifact-signer/values.schema.json
@@ -3,7 +3,17 @@
     "properties": {
         "configs": {
             "properties": {
-                "segment-backup-job":{
+                "sigstore_monitoring": {
+                    "properties": {
+                        "namespace": {
+                            "type": "string"
+                        },
+                        "namespace_create": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "segment_backup_job":{
                     "properties": {
                         "name": {
                             "type": "string"
@@ -26,6 +36,12 @@
                                     "type": "string"
                                 }
                             }
+                        },
+                        "rolebindings": {
+                            "items": {
+                                "type": "string"
+                            },
+                            "type": "array"
                         }
                     }
                 },

diff --git a/charts/trusted-artifact-signer/values.schema.tmpl.json b/charts/trusted-artifact-signer/values.schema.tmpl.json
@@ -19,7 +19,17 @@
         "configs": {
             "type": "object",
             "properties": {
-                "segment-backup-job":{
+                "sigstore_monitoring": {
+                    "properties": {
+                        "namespace": {
+                            "type": "string"
+                        },
+                        "namespace_create": {
+                            "type": "boolean"
+                        }
+                    }
+                },
+                "segment_backup_job":{
                     "properties": {
                         "name": {
                             "type": "string"
@@ -42,6 +52,12 @@
                                     "type": "string"
                                 }
                             }
+                        },
+                        "rolebindings": {
+                            "items": {
+                                "type": "string"
+                            },
+                            "type": "array"
                         }
                     }
                 },
@@ -301,8 +317,7 @@
                     },
                     "type": "object"
                 }
-            },
-            "type": "object"
+            }
         },
         "rbac": {
             "properties": {

diff --git a/charts/trusted-artifact-signer/values.yaml b/charts/trusted-artifact-signer/values.yaml
@@ -5,14 +5,19 @@ global:
   appsSubdomain: ""
 
 configs:
-  segment-backup-job:
+  sigstore_monitoring:
+    namespace: sigstore-monitoring
+    namespace_create: true
+  segment_backup_job:
     name: segment-backup-job
     namespace: sigstore-monitoring
     image:
       registry: quay.io
-      repository: ubi9/python-311
-      version: sha256:92416840a0361bf5c8ed6071f50098ddbdd1d14285793d4bcd8e761658c97df8
+      repository: redhat-user-workloads/rhtas-tenant/rhtas-stack-1-0-beta/segment-backup-job
+      version: sha256:4496c186e3478b2760ee5d5da61255fd86d5223d158524591d604988981000d5
       pullPolicy: IfNotPresent
+    rolebindings:
+      - segment-backup-job
   clientserver:
     # -- Whether to create the OpenShift resource 'ConsoleCLIDownload' for each binary.
     # -- This can only be enabled if the OpenShift CRD is registered.
@@ -146,8 +151,6 @@ rbac:
   # -- clusterrole to be added to sigstore component serviceaccounts.
   clusterrole: system:openshift:scc:anyuid
 
-  https://github.com/securesign/sigstore-ocp/blob/dc536fd05432421742f1952cc0c8ff04f64bb97f/charts/trusted-artifact-signer/values.yaml#L139C3-L139C43
-
 # github.com/sigstore/helm-charts/charts
 scaffold:
   ctlog:

diff --git a/grafana/operator/kustomization.yaml b/grafana/operator/kustomization.yaml
@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-- namespace.yaml
 - operator.yaml
diff --git a/grafana/operator/namespace.yaml b/grafana/operator/namespace.yaml
diff --git a/kind/kind-up-test.sh b/kind/kind-up-test.sh
@@ -21,6 +21,7 @@ then
 else
   mv /tmp/config ~/.kube/config
 fi
+chmod go-r ~/.kube/config
 
 oc config use-context kind-kind
 

diff --git a/tas-easy-install.sh b/tas-easy-install.sh
@@ -97,6 +97,36 @@ openssl ec -in file_ca_key.pem -passin pass:"$password" -pubout -out file_ca_pub
 openssl req -new -x509 -days 365 -key file_ca_key.pem -passin pass:"$password"  -out fulcio-root.pem -passout pass:"$password" -subj "/CN=$common_name/emailAddress=$email_address/O=$organization_name"
 openssl ecparam -name prime256v1 -genkey -noout -out rekor_key.pem
 
+segment_backup_job=$(oc get job -n sigstore-monitoring --ignore-not-found=true | tail -n 1 | awk '{print $1}')
+if [[ -n $segment_backup_job ]]; then
+    oc delete job $segment_backup_job -n sigstore-monitoring
+fi
+
+pull_secret_exists=$(oc get secret pull-secret -n sigstore-monitoring --ignore-not-found=true)
+if [[ -n $pull_secret_exists ]]; then
+    read -p "Secret \"pull-secret\" in namespace \"sigstore-monitoring\" already exists. Overwrite it (Y/N)?: " -n1 overwrite_pull_secret
+    echo ""
+    if [[ $overwrite_pull_secret == "Y" || $overwrite_pull_secret == 'y' ]]; then
+        read -p "Please enter the absolute path to the pull-secret.json file:
+" pull_secret_path
+        file_exists=$(ls $pull_secret_path 2>/dev/null)
+        if [[ -n $file_exists ]]; then
+            oc create secret generic pull-secret -n sigstore-monitoring --from-file=$pull_secret_path --dry-run=client -o yaml | oc replace -f -
+        else
+            echo "pull secret was not found based on the path provided: $pull_secret_path"
+            exit 0
+        fi
+    elif [[ $overwrite_pull_secret == "N" || $overwrite_pull_secret == 'n' ]]; then
+        echo "Skipping overwriting pull-secret..."
+    else 
+        echo "Bad input. Skipping this step, using existing pull-secret"
+    fi
+else
+    read -p "Please enter the absolute path to the pull-secret.json file:
+" pull_secret_path
+    oc create secret generic pull-secret -n sigstore-monitoring --from-file=$pull_secret_path
+fi
+
 rm unenc.key
 popd > /dev/null