Add helm and linkerd

.github/workflows/build.yml

@@ -33,8 +33,8 @@ jobs:
         path: go
         build_args: GIT_COMMIT_ID=${{ github.sha }}
         tag_with_ref: true
-        tag_with_sha: true
-        push: ${{ github.ref == 'refs/heads/master' && github.event_name == 'push' }}
+        tag_with_sha: false
+        push: ${{ startsWith(github.ref, 'refs/tags') && github.event_name == 'push' }}
 
     - name: Build Txnsim Image
       uses: docker/build-push-action@v1
@@ -46,6 +46,6 @@ jobs:
         path: go
         build_args: GIT_COMMIT_ID=${{ github.sha }}
         tag_with_ref: true
-        tag_with_sha: true
-        push: ${{ github.ref == 'refs/heads/master' && github.event_name == 'push' }}
+        tag_with_sha: false
+        push: ${{ startsWith(github.ref, 'refs/tags') && github.event_name == 'push' }}
 

.github/workflows/helm.yml

@@ -0,0 +1,84 @@
+name: 'Helm'
+
+on:
+  push:
+    #paths: 
+    #- 'helm/**'
+    #branches:
+    #- master
+  pull_request:
+    #paths: 
+    #- 'helm/**'
+
+env:
+  GCP_REGION: europe-west2
+  GCP_CLUSTER: ocvab-cluster-model-adder
+
+jobs:
+  helm:
+    name: 'Helm'
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v2
+
+    - name: Install yq
+      run: |
+        sudo wget -O /usr/local/bin/yq \
+             https://github.com/mikefarah/yq/releases/download/3.3.0/yq_linux_amd64
+        sudo chmod +x /usr/local/bin/yq
+
+    - name: Setup Helm
+      uses: azure/setup-helm@v1
+
+    - name: Setup gcloud
+      uses: GoogleCloudPlatform/github-actions/setup-gcloud@master
+      with:
+        service_account_key: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+        project_id: ${{ secrets.GCP_PROJECT_ID }}
+
+    - name: Get Kubeconfig
+      run: gcloud container clusters get-credentials "$GCP_CLUSTER" --region "$GCP_REGION"
+
+    - name: Helm Lint
+      run: helm lint vab
+      working-directory: helm
+
+    - name: Helm repos
+      run: |
+        helm repo add linkerd https://helm.linkerd.io/stable
+
+    - name: Install or upgrade Chart
+      if: github.ref == 'refs/heads/master' && github.event_name == 'push'
+      working-directory: helm
+      run: |
+        yq write --inplace vab/Chart.yaml version $(echo $GIT_COMMIT_ID | cut -b -8)
+        yq write --inplace vab/Chart.yaml appVersion $(echo $GIT_COMMIT_ID | cut -b -8)
+
+        helm dependency update vab
+        release_name=$(helm list -o json | jq '.[] | select(.chart != null) | select(.chart | startswith("vab")) | .name' -r | head -1)
+        if [[ -z "$release_name" ]]; then
+          echo "Installing VAB chart"
+          helm install vab -g \
+            --set "linkerd2.global.identityTrustAnchorsPEM=$LINKERD2_GLOBAL_IDENTITYTRUSTANCHORSPEM" \
+            --set "linkerd2.identity.issuer.crtExpiry=$LINKERD2_IDENTITY_ISSUER_CRTEXPIRY" \
+            --set "linkerd2.identity.issuer.tls.crtPEM=$LINKERD2_IDENTITY_ISSUER_TLS_CRTPEM" \
+            --set "linkerd2.identity.issuer.tls.keyPEM=$LINKERD2_IDENTITY_ISSUER_TLS_KEYPEM" \
+            --set "users={$USERS}"
+        else
+          echo "Upgrading VAB chart"
+          helm upgrade "$release_name" vab \
+            --set "linkerd2.global.identityTrustAnchorsPEM=$LINKERD2_GLOBAL_IDENTITYTRUSTANCHORSPEM" \
+            --set "linkerd2.identity.issuer.crtExpiry=$LINKERD2_IDENTITY_ISSUER_CRTEXPIRY" \
+            --set "linkerd2.identity.issuer.tls.crtPEM=$LINKERD2_IDENTITY_ISSUER_TLS_CRTPEM" \
+            --set "linkerd2.identity.issuer.tls.keyPEM=$LINKERD2_IDENTITY_ISSUER_TLS_KEYPEM" \
+            --set "users={$USERS}"
+        fi
+      env:
+        LINKERD2_GLOBAL_IDENTITYTRUSTANCHORSPEM: ${{ secrets.LINKERD2_GLOBAL_IDENTITYTRUSTANCHORSPEM }}
+        LINKERD2_IDENTITY_ISSUER_CRTEXPIRY: ${{ secrets.LINKERD2_IDENTITY_ISSUER_CRTEXPIRY }}
+        LINKERD2_IDENTITY_ISSUER_TLS_CRTPEM: ${{ secrets.LINKERD2_IDENTITY_ISSUER_TLS_CRTPEM }}
+        LINKERD2_IDENTITY_ISSUER_TLS_KEYPEM: ${{ secrets.LINKERD2_IDENTITY_ISSUER_TLS_KEYPEM }}
+        USERS: ${{ secrets.USERS }}
+        GIT_COMMIT_ID: ${{ github.sha }}
+

helm/vab/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/vab/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: linkerd2
+  repository: https://helm.linkerd.io/stable
+  version: 2.8.1
+digest: sha256:74614c53bab9d469bb8f2bce9f5612c65c586992eef6ac56d760cf671c90523b
+generated: "2020-06-26T10:24:44.6283353+01:00"

helm/vab/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: vab
+description: Venafi Afterburners Parent Chart
+type: application
+version: 0.0.3
+appVersion: 0.0.3
+dependencies:
+- name: linkerd2
+  version: "~2.8.1"
+  repository: "@linkerd"

helm/vab/templates/l5d-tap-admin-clusterrolebinding.yaml

@@ -0,0 +1,16 @@
+{{ if .Values.users }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: linkerd-tap-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: linkerd-linkerd-tap-admin
+subjects:
+{{- range .Values.users }}
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: {{ . }}
+{{- end }}
+{{ end }}

scripts/bootstrap.sh

@@ -36,4 +36,5 @@ if [[ ! -z "$OCVAB_BUCKET_NAME" ]]; then
 fi
 
 gsutil mb -b on -l $LOCATION gs://$BUCKET_NAME
+helm repo add linkerd https://helm.linkerd.io/stable