commit 4a3e4618287f31130c0aee9423a82a5a234f4f47
parent 2969dc7ddb41b0d7c43638ca433925f1f6269107
Author: MTRNord <mtrnord1@gmail.com>
Date: Tue, 12 Dec 2023 11:08:04 +0100
Use latest and add validate.sh
Diffstat:
3 files changed, 72 insertions(+), 6 deletions(-)
diff --git a/README.md b/README.md
@@ -138,7 +138,7 @@ infra-controllers main@sha1:21ebd912 False True Applied revision
## TODOs
- [ ] Migrate old deployments here
- - [ ] Gitea
+ - [ ] ~~Gitea~~
- [x] Woodpecker
- [ ] ~~Docker repo~~ (Part of gitea now)
- [ ] Traefik
@@ -153,10 +153,10 @@ infra-controllers main@sha1:21ebd912 False True Applied revision
- [x] Sliding Proxy
- [x] Prepare DB in DB Cluster
- [x] Move DB to DB Cluster
- - [ ] Mjolnir
- - [ ] Bridges
- - [x] Prepare DBs in DB Cluster
- - [ ] Move DBs to DB Cluster
+ - [x] Mjolnir (important ones)
+ - [ ] ~~Bridges~~
+ - [x] ~~Prepare DBs in DB Cluster~~
+ - [ ] ~~Move DBs to DB Cluster~~
- [ ] Keycloak
- [x] Prometheus/grafana
- [x] Cosign
diff --git a/apps/base/matrix/draupnir-fluffy/deployment.yaml b/apps/base/matrix/draupnir-fluffy/deployment.yaml
@@ -20,7 +20,7 @@ spec:
app: mjolnir-fluffy
spec:
containers:
- - image: gnuxie/draupnir:develop
+ - image: gnuxie/draupnir:latest
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
diff --git a/scripts/validate.sh b/scripts/validate.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+
+# This script downloads the Flux OpenAPI schemas, then it validates the
+# Flux custom resources and the kustomize overlays using kubeconform.
+# This script is meant to be run locally and in CI before the changes
+# are merged on the main branch that's synced by Flux.
+
+# Copyright 2023 The Flux authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Prerequisites
+# - yq v4.34
+# - kustomize v5.0
+# - kubeconform v0.6
+
+set -o errexit
+set -o pipefail
+
+# mirror kustomize-controller build options
+kustomize_flags=("--load-restrictor=LoadRestrictionsNone")
+kustomize_config="kustomization.yaml"
+
+# skip Kubernetes Secrets due to SOPS fields failing validation
+kubeconform_flags=("-skip=Secret -ignore-filename-pattern=./apps/production/secrets/*.yaml")
+kubeconform_config=("-strict" "-ignore-missing-schemas" "-schema-location" "default" "-schema-location" "/tmp/flux-crd-schemas" "-verbose")
+
+echo "INFO - Downloading Flux OpenAPI schemas"
+mkdir -p /tmp/flux-crd-schemas/master-standalone-strict
+curl -sL https://github.com/fluxcd/flux2/releases/latest/download/crd-schemas.tar.gz | tar zxf - -C /tmp/flux-crd-schemas/master-standalone-strict
+
+find . -type f -name '*.yaml' -print0 | while IFS= read -r -d $'\0' file;
+ do
+ echo "INFO - Validating $file"
+ yq e 'true' "$file" > /dev/null
+done
+
+echo "INFO - Validating clusters"
+find ./clusters -maxdepth 2 -type f -name '*.yaml' -print0 | while IFS= read -r -d $'\0' file;
+ do
+ kubeconform "${kubeconform_flags[@]}" "${kubeconform_config[@]}" "${file}"
+ if [[ ${PIPESTATUS[0]} != 0 ]]; then
+ exit 1
+ fi
+done
+
+echo "INFO - Validating kustomize overlays"
+find . -type f -name $kustomize_config -print0 | while IFS= read -r -d $'\0' file;
+ do
+ echo "INFO - Validating kustomization ${file/%$kustomize_config}"
+ kustomize build "${file/%$kustomize_config}" "${kustomize_flags[@]}" | \
+ kubeconform "${kubeconform_flags[@]}" "${kubeconform_config[@]}"
+ if [[ ${PIPESTATUS[0]} != 0 ]]; then
+ exit 1
+ fi
+done
