Streamlining Kubernetes GitOps with the Service Foundry Console

#!/bin/bash

set -e

CWD=$(pwd)

# set variables that will be saved in the secrets and configmaps
GENERATOR_NSA2_GIT_BRANCH=${GENERATOR_NSA2_GIT_BRANCH:-"release-0.7.0"}
CLOUD_PROVIDER=${CLOUD_PROVIDER:-}
#AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
AWS_ACCOUNT_ID=${AWS_ACCOUNT_ID:-}
#AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
AWS_REGION=${AWS_REGION:-"us-west-2"}
EKS_CLUSTER_NAME=${EKS_CLUSTER_NAME:-young-eks}
GIT_OPS_REPO_URL=${GIT_OPS_REPO_URL:-"git@github.com:nsalexamy/service-foundry-argocd.git"}
GIT_OPS_REPO_NAME=${GIT_OPS_REPO_NAME:-"service-foundry-argocd"}
ARGOCD_PROJECT=${ARGOCD_PROJECT:-"service-foundry"}
SF_ROOT_DOMAIN=${SF_ROOT_DOMAIN:-"nsa2.com"}
SF_APP_FRONTEND_VERSION=${SF_APP_FRONTEND_VERSION:-"0.1.0"}
SF_APP_BACKEND_VERSION=${SF_APP_BACKEND_VERSION:-"0.1.0"}

# Set the version of the service-foundry-builder chart
SF_BUILDER_CHART_VERSION=0.1.9

# SSH Key Path
GENERATOR_NSA2_SSH_KEY_PATH=${GENERATOR_NSA2_SSH_KEY_PATH:-"./ssh/id_rsa"}
GIT_OPS_REPO_SSH_KEY_PATH=${GIT_OPS_REPO_SSH_KEY_PATH:-"./argocd-ssh/argocd_id_rsa"}

echo "GENERATOR_NSA2_GIT_BRANCH: $GENERATOR_NSA2_GIT_BRANCH"
echo "EKS_CLUSTER_NAME: $EKS_CLUSTER_NAME"


kubectl get namespace service-foundry &> /dev/null || kubectl create namespace service-foundry

kubectl -n service-foundry get secret aws-secret &> /dev/null || \
kubectl -n service-foundry create secret generic aws-secret \
  --from-literal=AWS_ACCOUNT_ID=$AWS_ACCOUNT_ID \
  --from-literal=AWS_REGION=$AWS_REGION

source ./irsa.sh

kubectl -n service-foundry get configmap aws-configmap &> /dev/null || \
kubectl -n service-foundry create configmap aws-configmap \
  --from-literal=EKS_CLUSTER_NAME=$EKS_CLUSTER_NAME

kubectl -n service-foundry get secret service-foundry-github-ssh &> /dev/null || \
kubectl -n service-foundry create secret generic service-foundry-github-ssh \
  --from-file=id_rsa=$GENERATOR_NSA2_SSH_KEY_PATH \
  --from-file=argocd_id_rsa=$GIT_OPS_REPO_SSH_KEY_PATH


# create an empty service-foundry-builder-secret
kubectl -n service-foundry get secret service-foundry-builder-secret &> /dev/null || \
kubectl -n service-foundry create secret generic service-foundry-builder-secret

kubectl -n service-foundry get configmap service-foundry-builder-configmap &> /dev/null || \
kubectl -n service-foundry create configmap service-foundry-builder-configmap \
  --from-literal=GIT_OPS_REPO_URL="$GIT_OPS_REPO_URL" \
  --from-literal=GIT_OPS_REPO_NAME="$GIT_OPS_REPO_NAME" \
  --from-literal=ARGOCD_PROJECT="$ARGOCD_PROJECT" \
  --from-literal=SF_ROOT_DOMAIN="$SF_ROOT_DOMAIN" \
  --from-literal=SF_APP_FRONTEND_VERSION="$SF_APP_FRONTEND_VERSION" \
  --from-literal=SF_APP_BACKEND_VERSION="$SF_APP_BACKEND_VERSION" \
  --from-literal=GENERATOR_NSA2_GIT_BRANCH="$GENERATOR_NSA2_GIT_BRANCH"


# if service-foundry-config-files secret exists, delete it
kubectl -n service-foundry get secret service-foundry-config-files &> /dev/null && \
  kubectl -n service-foundry delete secret service-foundry-config-files

# create an empty service-foundry-config-files secret
kubectl create secret generic service-foundry-config-files \
  -n service-foundry

helm install service-foundry-builder service-foundry/service-foundry-builder \
  --set command=bootstrap \
  --set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::${AWS_ACCOUNT_ID}:role/service-foundry-builder-role \
  -n service-foundry --create-namespace --version $SF_BUILDER_CHART_VERSION

echo "Service Foundry Builder installed successfully."

#!/bin/bash

echo "Creating eks-update-kubeconfig-policy if it does not exist..."
aws iam get-policy --policy-arn arn:aws:iam::${AWS_ACCOUNT_ID}:policy/eks-update-kubeconfig-policy &> /dev/null || \
aws iam create-policy \
  --policy-name eks-update-kubeconfig-policy \
  --policy-document file://eks-update-kubeconfig-policy.json


OIDC_PROVIDER=$(aws eks describe-cluster --name $EKS_CLUSTER_NAME --region $AWS_REGION --query "cluster.identity.oidc.issuer" --output text | sed -e "s/^https:\/\///")

cat <<EOF  > trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::$AWS_ACCOUNT_ID:oidc-provider/$OIDC_PROVIDER"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "${OIDC_PROVIDER}:sub": "system:serviceaccount:service-foundry:service-foundry-builder"
        }
      }
    }
  ]
}

EOF


if ! aws iam get-role --role-name service-foundry-builder-role &> /dev/null ; then
  aws iam create-role \
    --role-name service-foundry-builder-role \
    --assume-role-policy-document file://trust-policy.json


  aws iam attach-role-policy \
    --role-name service-foundry-builder-role \
    --policy-arn arn:aws:iam::${AWS_ACCOUNT_ID}:policy/eks-update-kubeconfig-policy
else
  echo "service-foundry-builder-role already exists. Skipping creation."
fi