Skip to content

Commit 2abbf3b

Browse files
mattcarymattcary
committed
remove explicit credentials in order to use application default creds
1 parent d18dba1 commit 2abbf3b

File tree

9 files changed

+95
-48
lines changed

9 files changed

+95
-48
lines changed

‎deploy/kubernetes/deploy-driver.sh‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@
88
# which are in Kubernetes version 1.10.5+
99

1010
# Args:
11-
# GCE_PD_SA_DIR: Directory the service account key has been saved in (generated by setup-project.sh)
11+
# GCE_PD_SA_DIR: Directory the service account key has been saved in (generated
12+
# by setup-project.sh). Ignored if GCE_PD_DRIVER_VERSION == noauth.
1213
# GCE_PD_DRIVER_VERSION: The kustomize overlay (located in
1314
# deploy/kubernetes/overlays) to deploy. Can be one of {stable, dev}
1415

@@ -43,7 +44,9 @@ while [ -n "${1-}" ]; do
4344
esac
4445
done
4546

46-
ensure_var GCE_PD_SA_DIR
47+
if [ "${DEPLOY_VERSION}" != noauth ]; then
48+
ensure_var GCE_PD_SA_DIR
49+
fi
4750

4851
function check_service_account()
4952
{
@@ -71,7 +74,7 @@ function check_service_account()
7174

7275
ensure_kustomize
7376

74-
if [ "$skip_sa_check" != true ]; then
77+
if [ "$skip_sa_check" != true -a "${DEPLOY_VERSION}" != noauth ]; then
7578
check_service_account
7679
fi
7780

@@ -80,9 +83,11 @@ then
8083
${KUBECTL} create namespace "${NAMESPACE}" -v="${VERBOSITY}"
8184
fi
8285

83-
if ! ${KUBECTL} get secret cloud-sa -v="${VERBOSITY}" -n "${NAMESPACE}";
84-
then
85-
${KUBECTL} create secret generic cloud-sa -v="${VERBOSITY}" --from-file="${GCE_PD_SA_DIR}/cloud-sa.json" -n "${NAMESPACE}"
86+
if [ "${DEPLOY_VERSION}" != noauth ]; then
87+
if ! ${KUBECTL} get secret cloud-sa -v="${VERBOSITY}" -n "${NAMESPACE}";
88+
then
89+
${KUBECTL} create secret generic cloud-sa -v="${VERBOSITY}" --from-file="${GCE_PD_SA_DIR}/cloud-sa.json" -n "${NAMESPACE}"
90+
fi
8691
fi
8792

8893
# GKE Required Setup

‎deploy/kubernetes/images/dev/image.yaml‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎deploy/kubernetes/images/dev/kustomization.yaml‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎deploy/kubernetes/overlays/dev/kustomization.yaml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
resources:
44
- ../alpha
5-
patches:
5+
patchesStrategicMerge:
66
- controller_always_pull.yaml
77
- node_always_pull.yaml
8-
namespace:
9-
gce-pd-csi-driver
10-
transformers:
11-
- ../../images/dev
12-
8+
namespace: gce-pd-csi-driver
9+
# To change the dev image, add something like the following.
10+
#images:
11+
#- name: gke.gcr.io/gcp-compute-persistent-disk-csi-driver
12+
# newName: gcr.io/mattcary-gke-dev-owned/csi/gce-pd-driver
13+
# newTag: latest.

‎deploy/kubernetes/overlays/noauth/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- ../dev
5+
patchesStrategicMerge:
6+
- noauth.yaml
7+
namespace: gce-pd-csi-driver

‎deploy/kubernetes/overlays/noauth/noauth.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
kind: Deployment
2+
apiVersion: apps/v1
3+
metadata:
4+
name: csi-gce-pd-controller
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: gce-pd-driver
10+
env:
11+
- $patch: delete
12+
name: GOOGLE_APPLICATION_CREDENTIALS
13+
value: "/etc/cloud-sa/cloud-sa.json"
14+
volumeMounts:
15+
- $patch: delete
16+
name: cloud-sa-volume
17+
readOnly: true
18+
mountPath: "/etc/cloud-sa"
19+
volumes:
20+
- $patch: delete
21+
name: cloud-sa-volume
22+
secret:
23+
secretName: cloud-sa
24+
25+

‎test/k8s-integration/driver.go‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -56,25 +56,29 @@ func installDriver(platform, goPath, pkgDir, stagingImage, stagingVersion, deplo
5656
}
5757
}
5858

59-
// setup service account file for secret creation
60-
tmpSaFile := filepath.Join(generateUniqueTmpDir(), "cloud-sa.json")
61-
defer removeDir(filepath.Dir(tmpSaFile))
59+
var deployEnv []string
60+
if deployOverlayName != "noauth" {
61+
// setup service account file for secret creation
62+
tmpSaFile := filepath.Join(generateUniqueTmpDir(), "cloud-sa.json")
63+
defer removeDir(filepath.Dir(tmpSaFile))
64+
65+
// Need to copy it to name the file "cloud-sa.json"
66+
out, err := exec.Command("cp", *saFile, tmpSaFile).CombinedOutput()
67+
if err != nil {
68+
return fmt.Errorf("error copying service account key: %s, err: %v", out, err)
69+
}
70+
defer shredFile(tmpSaFile)
6271

63-
// Need to copy it to name the file "cloud-sa.json"
64-
out, err := exec.Command("cp", *saFile, tmpSaFile).CombinedOutput()
65-
if err != nil {
66-
return fmt.Errorf("error copying service account key: %s, err: %v", out, err)
72+
deployEnv = append(deployEnv, fmt.Sprintf("GCE_PD_SA_DIR=%s", filepath.Dir(tmpSaFile)))
6773
}
68-
defer shredFile(tmpSaFile)
6974

7075
// deploy driver
7176
deployCmd := exec.Command(filepath.Join(pkgDir, "deploy", "kubernetes", "deploy-driver.sh"), "--skip-sa-check")
72-
deployCmd.Env = append(os.Environ(),
77+
deployEnv = append(deployEnv,
7378
fmt.Sprintf("GOPATH=%s", goPath),
74-
fmt.Sprintf("GCE_PD_SA_DIR=%s", filepath.Dir(tmpSaFile)),
75-
fmt.Sprintf("GCE_PD_DRIVER_VERSION=%s", deployOverlayName),
76-
)
77-
err = runCommand("Deploying driver", deployCmd)
79+
fmt.Sprintf("GCE_PD_DRIVER_VERSION=%s", deployOverlayName))
80+
deployCmd.Env = append(os.Environ(), deployEnv...)
81+
err := runCommand("Deploying driver", deployCmd)
7882
if err != nil {
7983
return fmt.Errorf("failed to deploy driver: %v", err)
8084
}
@@ -87,7 +91,7 @@ func installDriver(platform, goPath, pkgDir, stagingImage, stagingVersion, deplo
8791
klog.Infof("Waiting 5 minutes for the driver to start on Linux")
8892
time.Sleep(5 * time.Minute)
8993
}
90-
out, err = exec.Command("kubectl", "describe", "pods", "-n", driverNamespace).CombinedOutput()
94+
out, err := exec.Command("kubectl", "describe", "pods", "-n", driverNamespace).CombinedOutput()
9195
klog.Infof("describe pods \n %s", string(out))
9296

9397
if err != nil {

‎test/k8s-integration/main.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,9 @@ func main() {
9696
ensureVariable(deployOverlayName, false, "'deploy-overlay-name' must not be set when using GKE managed driver")
9797
}
9898

99-
ensureVariable(saFile, true, "service-account-file is a required flag")
99+
if *deployOverlayName != "noauth" {
100+
ensureVariable(saFile, true, "service-account-file is a required flag")
101+
}
100102
if !*useGKEManagedDriver {
101103
ensureVariable(deployOverlayName, true, "deploy-overlay-name is a required flag")
102104
}

‎test/run-k8s-integration-local.sh‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ readonly test_version=${TEST_VERSION:-master}
1010

1111
source "${PKGDIR}/deploy/common.sh"
1212

13-
ensure_var GCE_PD_SA_DIR
14-
1513
make -C "${PKGDIR}" test-k8s-integration
1614

1715
# This version of the command creates a GKE cluster. It also downloads and builds a k8s release
@@ -73,11 +71,29 @@ make -C "${PKGDIR}" test-k8s-integration
7371
# --gce-zone="us-central1-c" --num-nodes=${NUM_NODES:-3} --gke-release-channel="rapid" --deployment-strategy="gke" \
7472
# --use-gke-managed-driver=true --teardown-cluster=true
7573

76-
# This version of the command does not build the driver or K8s, points to a
77-
# local K8s repo to get the e2e.test binary, and does not bring up or down the cluster
78-
74+
# This version of the command does not build the driver or K8s, points to a local K8s repo to get
75+
# the e2e.test binary, does not bring up or down the cluster, and uses application default
76+
# credentials instead of requiring a service account key.
77+
#
78+
# Cluster nodes must have the proper GCP scopes set. This is done with kubetest by
79+
# NODE_SCOPES=https://www.googleapis.com/auth/cloud-platform \
80+
# KUBE_GCE_NODE_SERVICE_ACCOUNT=$SERVICE_ACCOUNT_NAME@$PROJECT.iam.gserviceaccount.com \
81+
# kubetest --up
82+
#
83+
# GCE_PD_SA_DIR is not used.
84+
#
85+
# As with all other methods local credentials must be set by running
86+
# gcloud auth application-default login
7987
"${PKGDIR}/bin/k8s-integration-test" --run-in-prow=false \
80-
--staging-image="${GCE_PD_CSI_STAGING_IMAGE}" --service-account-file="${GCE_PD_SA_DIR}/cloud-sa.json" \
81-
--deploy-overlay-name=dev --bringup-cluster=false --teardown-cluster=false --local-k8s-dir="$KTOP" \
82-
--storageclass-files=sc-standard.yaml,sc-balanced.yaml,sc-ssd.yaml --do-driver-build=false --test-focus='External.Storage' \
88+
--deploy-overlay-name=noauth --bringup-cluster=false --teardown-cluster=false --local-k8s-dir="$KTOP" \
89+
--storageclass-files=sc-standard.yaml --do-driver-build=false --test-focus='External.Storage' \
8390
--gce-zone="us-central1-b" --num-nodes="${NUM_NODES:-3}"
91+
92+
93+
# This version of the command does not build the driver or K8s, points to a
94+
# local K8s repo to get the e2e.test binary, and does not bring up or down the cluster
95+
# "${PKGDIR}/bin/k8s-integration-test" --run-in-prow=false \
96+
# --staging-image="${GCE_PD_CSI_STAGING_IMAGE}" --service-account-file="${GCE_PD_SA_DIR}/cloud-sa.json" \
97+
# --deploy-overlay-name=dev --bringup-cluster=false --teardown-cluster=false --local-k8s-dir="$KTOP" \
98+
# --storageclass-files=sc-standard.yaml --do-driver-build=false --test-focus='External.Storage' \
99+
# --gce-zone="us-central1-b" --num-nodes="${NUM_NODES:-3}"

0 commit comments

Comments
 (0)