adds tuf-rollout-restart container to ensure tuf root secret is updated.

Signed-off-by: ianhundere <138915+ianhundere@users.noreply.github.com>
sigstore · Jul 29, 2024 · 7e29bb8 · 7e29bb8
1 parent e677b89
commit 7e29bb8
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 10 deletions.
diff --git a/charts/scaffold/Chart.yaml b/charts/scaffold/Chart.yaml
@@ -4,7 +4,7 @@ description: Scaffolding the components of the sigstore architecture
 
 type: application
 
-version: 0.6.54
+version: 0.6.55
 keywords:
   - security
   - pki

diff --git a/charts/scaffold/README.md b/charts/scaffold/README.md
@@ -2,7 +2,7 @@
 
 <!-- This README.md is generated. Please edit README.md.gotmpl -->
 
-![Version: 0.6.54](https://img.shields.io/badge/Version-0.6.54-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.6.55](https://img.shields.io/badge/Version-0.6.55-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Scaffolding the components of the sigstore architecture
 

diff --git a/charts/scaffold/templates/clusterrole.yaml b/charts/scaffold/templates/clusterrole.yaml
@@ -9,5 +9,5 @@ rules:
     verbs: ["get", "create", "patch"{{- if .Values.copySecretJob.copySecretCronJob.enabled }}, "delete"{{- end }}]
   - apiGroups: ["apps"]
     resources: ["deployments"]
-    verbs: ["get", "list"]
-{{- end }}
+    verbs: ["get", "list"{{- if .Values.copySecretJob.copySecretCronJob.enabled }}, "update"{{- end }}]
+{{- end }}
diff --git a/charts/scaffold/templates/copy-secrets-cronjob.yaml b/charts/scaffold/templates/copy-secrets-cronjob.yaml
@@ -56,25 +56,25 @@ spec:
             args: [
                 "-c",
                 "curl {{ .Values.tuf.secrets.rekor.deploymentName}}.{{ .Values.tuf.secrets.rekor.namespace }}.svc.cluster.local/api/v1/log/publicKey -o /tmp/key -v && \
-                kubectl apply -f - <<EOF\napiVersion: v1\nkind: Secret\nmetadata:\n  name: {{ .Values.tuf.secrets.rekor.name }}\n  namespace: {{ .Values.forceNamespace }}\ndata:\n  key: $(cat /tmp/key | base64 -w 0)\nEOF\n"
+                kubectl apply -f - <<EOF\napiVersion: v1\nkind: Secret\nmetadata:\n  name: {{ .Values.tuf.secrets.rekor.name }}\n  namespace: {{ include "tuf.rawnamespace" .Subcharts.tuf }}\ndata:\n  key: $(cat /tmp/key | base64 -w 0)\nEOF\n"
             ]
           - name: copy-fulcio-secret
             image: {{ template "scaffold.image" .Values.copySecretJob }}
             imagePullPolicy: {{ .Values.copySecretJob.pullPolicy }}
             command: ["/bin/sh"]
             args: [
                 "-c",
-                "kubectl -n {{ .Values.forceNamespace }} delete secret {{ .Values.tuf.secrets.fulcio.name }} --ignore-not-found && \
-                kubectl -n {{ .Values.tuf.secrets.fulcio.namespace }} get secrets {{ .Values.tuf.secrets.fulcio.name }} -oyaml | sed 's/namespace: .*/namespace: {{ .Values.forceNamespace }}/' | kubectl apply -f -"
+                "kubectl -n {{ include "tuf.rawnamespace" .Subcharts.tuf }} delete secret {{ .Values.tuf.secrets.fulcio.name }} --ignore-not-found && \
+                kubectl -n {{ .Values.tuf.secrets.fulcio.namespace }} get secrets {{ .Values.tuf.secrets.fulcio.name }} -oyaml | sed 's/namespace: .*/namespace: {{ include "tuf.rawnamespace" .Subcharts.tuf }}/' | kubectl apply -f -"
             ]
           - name: copy-ctlog-secret
             image: {{ template "scaffold.image" .Values.copySecretJob }}
             imagePullPolicy: {{ .Values.copySecretJob.pullPolicy }}
             command: ["/bin/sh"]
             args: [
                 "-c",
-                "kubectl -n {{ .Values.forceNamespace }} delete secret {{ .Values.tuf.secrets.ctlog.name }} --ignore-not-found && \
-                kubectl -n {{ .Values.tuf.secrets.ctlog.namespace }} get secrets {{ .Values.tuf.secrets.ctlog.name }} -oyaml | sed 's/namespace: .*/namespace: {{ .Values.forceNamespace }}/' | kubectl apply -f -"
+                "kubectl -n {{ include "tuf.rawnamespace" .Subcharts.tuf }} delete secret {{ .Values.tuf.secrets.ctlog.name }} --ignore-not-found && \
+                kubectl -n {{ .Values.tuf.secrets.ctlog.namespace }} get secrets {{ .Values.tuf.secrets.ctlog.name }} -oyaml | sed 's/namespace: .*/namespace: {{ include "tuf.rawnamespace" .Subcharts.tuf }}/' | kubectl apply -f -"
             ]
           - name: copy-tsa-secret
             image: {{ template "scaffold.image" .Values.copySecretJob }}
@@ -83,7 +83,15 @@ spec:
             args: [
                 "-c",
                 "curl {{ .Values.tuf.secrets.tsa.deploymentName}}.{{ .Values.tuf.secrets.tsa.namespace }}.svc.cluster.local/api/v1/timestamp/certchain -o /tmp/cert-chain -v && \
-                kubectl apply -f - <<EOF\napiVersion: v1\nkind: Secret\nmetadata:\n  name: {{ .Values.tuf.secrets.tsa.name }}\n  namespace: {{ .Values.forceNamespace }}\ndata:\n  cert-chain: $(cat /tmp/cert-chain | base64 -w 0)\nEOF\n"
+                kubectl apply -f - <<EOF\napiVersion: v1\nkind: Secret\nmetadata:\n  name: {{ .Values.tuf.secrets.tsa.name }}\n  namespace: {{ include "tuf.rawnamespace" .Subcharts.tuf }}\ndata:\n  cert-chain: $(cat /tmp/cert-chain | base64 -w 0)\nEOF\n"
+            ]
+          - name: rollout-restart-tuf
+            image: {{ template "scaffold.image" .Values.copySecretJob }}
+            imagePullPolicy: {{ .Values.copySecretJob.pullPolicy }}
+            command: ["/bin/sh"]
+            args: [
+                "-c",
+                "kubectl rollout restart deployment {{ .Values.tuf.fullnameOverride}} -n {{ include "tuf.rawnamespace" .Subcharts.tuf }}"
             ]
           {{- if .Values.copySecretJob.nodeSelector }}
           nodeSelector: