mirror of
https://github.com/ysoftdevs/imagepullsecret-injector.git
synced 2026-01-19 01:57:14 +01:00
Compare commits
5 Commits
feature/no
...
release/le
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
073514be65 | ||
|
|
0189cb74e5 | ||
|
|
a678d5f149 | ||
|
|
b35f219c4b | ||
|
|
f023dc9264 |
@@ -7,7 +7,4 @@ RUN make build
|
|||||||
FROM alpine:3.13.4 as base
|
FROM alpine:3.13.4 as base
|
||||||
COPY --from=builder /go/src/github.com/ysoftdevs/imagepullsecret-injector/build/_output/bin/imagepullsecret-injector /usr/local/bin/imagepullsecret-injector
|
COPY --from=builder /go/src/github.com/ysoftdevs/imagepullsecret-injector/build/_output/bin/imagepullsecret-injector /usr/local/bin/imagepullsecret-injector
|
||||||
|
|
||||||
RUN addgroup -S imagepullsecret-injector-group && adduser -S imagepullsecret-injector-user -G imagepullsecret-injector-group
|
ENTRYPOINT ["imagepullsecret-injector"]
|
||||||
USER imagepullsecret-injector-user
|
|
||||||
|
|
||||||
ENTRYPOINT ["imagepullsecret-injector"]
|
|
||||||
@@ -1,9 +1,6 @@
|
|||||||
FROM alpine:3.13.4
|
FROM alpine:3.13.4
|
||||||
|
|
||||||
RUN addgroup -S imagepullsecret-injector-group && adduser -S imagepullsecret-injector-user -G imagepullsecret-injector-group \
|
RUN apk add bash curl openssl \
|
||||||
&& apk add bash curl openssl jq \
|
|
||||||
&& curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
|
&& curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
|
||||||
&& chmod 755 ./kubectl \
|
&& chmod 755 ./kubectl \
|
||||||
&& mv ./kubectl /usr/bin/kubectl
|
&& mv ./kubectl /usr/bin/kubectl
|
||||||
|
|
||||||
USER imagepullsecret-injector-user
|
|
||||||
|
|||||||
@@ -2,22 +2,6 @@ apiVersion: v2
|
|||||||
name: imagepullsecret-injector
|
name: imagepullsecret-injector
|
||||||
description: A Helm chart for Kubernetes
|
description: A Helm chart for Kubernetes
|
||||||
|
|
||||||
# A chart can be either an 'application' or a 'library' chart.
|
|
||||||
#
|
|
||||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
|
||||||
# to be deployed.
|
|
||||||
#
|
|
||||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
|
||||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
|
||||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
|
||||||
type: application
|
type: application
|
||||||
|
version: 0.0.20-legacy
|
||||||
# This is the chart version. This version number should be incremented each time you make changes
|
appVersion: 0.0.11
|
||||||
# to the chart and its templates, including the app version.
|
|
||||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
|
||||||
version: 0.0.21
|
|
||||||
|
|
||||||
# This is the version number of the application being deployed. This version number should be
|
|
||||||
# incremented each time you make changes to the application. Versions are not expected to
|
|
||||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
|
||||||
appVersion: 0.0.12
|
|
||||||
|
|||||||
@@ -83,27 +83,23 @@ echo "Deleting old CertificateSigningRequests"
|
|||||||
kubectl delete csr ${csrName} 2>/dev/null || true
|
kubectl delete csr ${csrName} 2>/dev/null || true
|
||||||
|
|
||||||
echo "Creating new CertificateSigningRequests"
|
echo "Creating new CertificateSigningRequests"
|
||||||
# create server cert/key CSR and send to k8s API
|
# create server cert/key CSR and send to k8s API
|
||||||
jq -n --arg request "$(< "${tmpdir}"/server.csr base64)" \
|
cat <<EOF | kubectl create -f -
|
||||||
--arg namespace "$namespace" \
|
apiVersion: certificates.k8s.io/v1beta1
|
||||||
--arg csrName "$csrName" '{
|
kind: CertificateSigningRequest
|
||||||
apiVersion: "certificates.k8s.io/v1",
|
metadata:
|
||||||
kind: "CertificateSigningRequest",
|
name: ${csrName}
|
||||||
metadata: {
|
namespace: ${namespace}
|
||||||
name: $csrName,
|
spec:
|
||||||
namespace: $namespace
|
signerName: kubernetes.io/kubelet-serving
|
||||||
},
|
groups:
|
||||||
spec: {
|
- system:authenticated
|
||||||
signerName: "kubernetes.io/kubelet-serving",
|
request: $(< "${tmpdir}"/server.csr base64 | tr -d '\n')
|
||||||
groups: ["system:authenticated"],
|
usages:
|
||||||
request: $request,
|
- digital signature
|
||||||
usages: [
|
- key encipherment
|
||||||
"digital signature",
|
- server auth
|
||||||
"key encipherment",
|
EOF
|
||||||
"server auth"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
}' | kubectl create -f -
|
|
||||||
|
|
||||||
# verify CSR has been created
|
# verify CSR has been created
|
||||||
while true; do
|
while true; do
|
||||||
|
|||||||
@@ -14,7 +14,6 @@ imagepullsecretInjector:
|
|||||||
dockerconfigjsonRef:
|
dockerconfigjsonRef:
|
||||||
secretName: acr-dockerconfigjson-source
|
secretName: acr-dockerconfigjson-source
|
||||||
secretNamespace: ""
|
secretNamespace: ""
|
||||||
|
|
||||||
targetSecretName: acr-dockerconfigjson
|
targetSecretName: acr-dockerconfigjson
|
||||||
ignoreSecretCreationError: false
|
ignoreSecretCreationError: false
|
||||||
allSaNames: false
|
allSaNames: false
|
||||||
|
|||||||
Reference in New Issue
Block a user