Mercurial > code > home > repos > pomerium

comparison tasks.py @ 34:b1f75b0584f3

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
redo 'run' task and 'delete' (less tested)
author drewp@bigasterisk.com
date Wed, 21 Jun 2023 23:01:32 -0700
parents bd2cbc36bc65
children
comparison
equal deleted inserted replaced
33:48b4ebc37636 34:b1f75b0584f3
1 import sys
2 import time 1 import time
3 from invoke import task 2 from invoke import task
4 from invoke.exceptions import UnexpectedExit
5
6
7 def authCert(ctx):
8 for tries in range(100):
9 try:
10 ctx.run("kubectl apply -f config/60-auth-cert.yaml", echo=True, )
11 sys.stderr.write("worked")
12 return
13 except UnexpectedExit:
14 time.sleep(2)
15 sys.stderr.write('.')
16 sys.stderr.flush()
17 raise ValueError
18
19 3
20 4
21 @task 5 @task
22 def run(ctx): 6 def run(ctx):
23 ctx.run("kubectl delete -n pomerium job/pomerium-gen-secrets --ignore-not-found", echo=True) 7 ctx.run("kubectl delete -n pomerium job/pomerium-gen-secrets --ignore-not-found", echo=True)
24 ctx.run("skaffold run -f use-invoke-not-skaffold.yaml", echo=True) 8 ctx.run("kubectl kustomize upstream | kubectl apply -f -", echo=True)
25 authCert(ctx) 9 print("let CM start up")
26 ctx.run("./make_global.py | kubectl apply -f -", echo=True) 10 time.sleep(15)
11 ctx.run("kubectl apply -f config/05-idp-secret.yaml", echo=True)
12 ctx.run("kubectl apply -f config/dns-secret.yaml", echo=True)
13 # ctx.run("kubectl apply -f config/06-postgres.yaml", echo=True)
27 ctx.run("kubectl apply -f config/51-pomerium-production-issuer.yaml", echo=True) 14 ctx.run("kubectl apply -f config/51-pomerium-production-issuer.yaml", echo=True)
28 ctx.run("kubectl apply -f config/51-pomerium-staging-issuer.yaml", echo=True) 15 ctx.run("kubectl apply -f config/51-pomerium-staging-issuer.yaml", echo=True)
16 ctx.run("kubectl apply -f config/dns-issuers.yaml", echo=True)
17 ctx.run("./make_global.py no_cert | kubectl apply -f -", echo=True)
18
19 ctx.run("./make_global.py output_pom_cert | kubectl apply -f -", echo=True)
20 # that will make infinite certs :( Clean up the redundant requests before LE ratelimits!
21 # k delete -n pomerium certificaterequests.cert-manager.io <tab>
22
23 ctx.run("kubectl apply -f ingress/default.yaml", echo=True)
24 ctx.run("kubectl apply -f ingress/static.yaml", echo=True)
25
26 # this may wait for
27 # 1) nothing; cert+secret exist
28 # 2) a letsencrypt session
29 # 3) a cert-manager delay before a LE session (e.g. 45 minutes)
30 ctx.run("./make_global.py wait_for_cert | kubectl apply -f -", echo=True)
29 31
30 32
31 @task 33 @task
32 def delete(ctx): 34 def delete(ctx):
33 # todo don't delete certs that have big timeouts to remake 35 ctx.run("kubectl delete pomerium/global --ignore-not-found", echo=True)
36 ctx.run("kubectl delete -f config/dns-issuers.yaml --ignore-not-found", echo=True)
34 ctx.run("kubectl delete -f config/51-pomerium-staging-issuer.yaml --ignore-not-found", echo=True) 37 ctx.run("kubectl delete -f config/51-pomerium-staging-issuer.yaml --ignore-not-found", echo=True)
35 ctx.run("kubectl delete -f config/51-pomerium-production-issuer.yaml --ignore-not-found", echo=True) 38 ctx.run("kubectl delete -f config/51-pomerium-production-issuer.yaml --ignore-not-found", echo=True)
36 ctx.run("kubectl delete -f config/60-auth-cert.yaml --ignore-not-found", echo=True) 39 ctx.run("kubectl delete -f config/06-postgres.yaml --ignore-not-found", echo=True)
37 ctx.run("kubectl delete pomerium/global --ignore-not-found", echo=True) 40 ctx.run("kubectl delete -f config/05-idp-secret.yaml --ignore-not-found", echo=True)
38 ctx.run("skaffold delete -f use-invoke-not-skaffold.yaml ", echo=True) 41
42 # the kustomize workloads and svcs
43 for type, ns, name in [
44 ('job', 'pomerium', 'pomerium-gen-secrets'),
45 ('deploy', 'cert-manager', 'cert-manager'),
46 ('deploy', 'cert-manager', 'cert-manager-cainjector'),
47 ('deploy', 'cert-manager', 'cert-manager-webhook'),
48 ('deploy', 'pomerium', 'pomerium'),
49 ('service', 'cert-manager', 'cert-manager'),
50 ('service', 'cert-manager', 'cert-manager-webhook'),
51 ('service', 'pomerium', 'pomerium-metrics'),
52 ('service', 'pomerium', 'pomerium-proxy'),
53 ]:
54 ctx.run(f"kubectl delete -n {ns} {type} {name} --ignore-not-found", echo=True)
55
39 ctx.run("kubectl delete -n pomerium job/pomerium-gen-secrets --ignore-not-found", echo=True) 56 ctx.run("kubectl delete -n pomerium job/pomerium-gen-secrets --ignore-not-found", echo=True)
40 57
41 58
42 ''' 59 '''
43 troubleshooting, based on 60 troubleshooting, based on