mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
fix: helm changes
This commit is contained in:
Daniel Hougaard
@@ -50,77 +50,99 @@ for crd_file in "${HELM_DIR}"/templates/*crd.yaml; do
|
||||
echo "Completed processing for: ${crd_file}"
|
||||
done
|
||||
|
||||
# ? NOTE: Processes only the manager-rbac.yaml file
|
||||
if [ -f "${HELM_DIR}/templates/manager-rbac.yaml" ]; then
|
||||
echo "Processing manager-rbac.yaml file specifically"
|
||||
# ? NOTE: Processes all files ending in -rbac.yaml, except metrics-reader-rbac.yaml
|
||||
for rbac_file in "${HELM_DIR}/templates"/*-rbac.yaml; do
|
||||
if [ -f "$rbac_file" ]; then
|
||||
if [[ "$(basename "$rbac_file")" == "metrics-reader-rbac.yaml" ]]; then
|
||||
echo "Skipping metrics-reader-rbac.yaml"
|
||||
continue
|
||||
fi
|
||||
|
||||
if [[ "$(basename "$rbac_file")" == "leader-election-rbac.yaml" ]]; then
|
||||
echo "Skipping infisicaldynamicsecret-admin-rbac.yaml"
|
||||
continue
|
||||
fi
|
||||
|
||||
cp "${HELM_DIR}/templates/manager-rbac.yaml" "${HELM_DIR}/templates/manager-rbac.yaml.bkp"
|
||||
|
||||
# extract the rules section from the original file
|
||||
rules_section=$(sed -n '/^rules:/,/^---/p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp" | sed '$d')
|
||||
# extract the original label lines
|
||||
original_labels=$(sed -n '/^ labels:/,/^roleRef:/p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp" | grep "app.kubernetes.io")
|
||||
|
||||
# create a new file from scratch with exactly what we want
|
||||
{
|
||||
# first section: Role/ClusterRole
|
||||
echo "apiVersion: rbac.authorization.k8s.io/v1"
|
||||
echo "{{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo "kind: Role"
|
||||
echo "{{- else }}"
|
||||
echo "kind: ClusterRole"
|
||||
echo "{{- end }}"
|
||||
echo "metadata:"
|
||||
echo " name: {{ include \"secrets-operator.fullname\" . }}-manager-role"
|
||||
echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo " namespace: {{ .Values.scopedNamespace | quote }}"
|
||||
echo " {{- end }}"
|
||||
echo " labels:"
|
||||
echo " {{- include \"secrets-operator.labels\" . | nindent 4 }}"
|
||||
|
||||
# add the existing rules section from helm-generated file
|
||||
echo "$rules_section"
|
||||
|
||||
# second section: RoleBinding/ClusterRoleBinding
|
||||
echo "---"
|
||||
echo "apiVersion: rbac.authorization.k8s.io/v1"
|
||||
echo "{{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo "kind: RoleBinding"
|
||||
echo "{{- else }}"
|
||||
echo "kind: ClusterRoleBinding"
|
||||
echo "{{- end }}"
|
||||
echo "metadata:"
|
||||
echo " name: {{ include \"secrets-operator.fullname\" . }}-manager-rolebinding"
|
||||
echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo " namespace: {{ .Values.scopedNamespace | quote }}"
|
||||
echo " {{- end }}"
|
||||
echo " labels:"
|
||||
echo "$original_labels"
|
||||
echo " {{- include \"secrets-operator.labels\" . | nindent 4 }}"
|
||||
|
||||
# add the roleRef section with custom logic
|
||||
echo "roleRef:"
|
||||
echo " apiGroup: rbac.authorization.k8s.io"
|
||||
echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo " kind: Role"
|
||||
echo " {{- else }}"
|
||||
echo " kind: ClusterRole"
|
||||
echo " {{- end }}"
|
||||
echo " name: '{{ include \"secrets-operator.fullname\" . }}-manager-role'"
|
||||
|
||||
# add the subjects section
|
||||
sed -n '/^subjects:/,$ p' "${HELM_DIR}/templates/manager-rbac.yaml.bkp"
|
||||
} > "${HELM_DIR}/templates/manager-rbac.yaml.new"
|
||||
|
||||
mv "${HELM_DIR}/templates/manager-rbac.yaml.new" "${HELM_DIR}/templates/manager-rbac.yaml"
|
||||
rm "${HELM_DIR}/templates/manager-rbac.yaml.bkp"
|
||||
|
||||
echo "Completed processing for manager-rbac.yaml with both role conditions and metadata applied"
|
||||
fi
|
||||
filename=$(basename "$rbac_file")
|
||||
base_name="${filename%-rbac.yaml}"
|
||||
|
||||
# ? NOTE(Daniel): Processes proxy-rbac.yaml and metrics-reader-rbac.yaml
|
||||
for rbac_file in "${HELM_DIR}/templates/proxy-rbac.yaml" "${HELM_DIR}/templates/metrics-reader-rbac.yaml"; do
|
||||
echo "Processing $(basename "$rbac_file") file specifically"
|
||||
|
||||
cp "${rbac_file}" "${rbac_file}.bkp"
|
||||
|
||||
# extract the rules section from the original file
|
||||
# Extract from 'rules:' until we hit a document separator or another top-level key
|
||||
|
||||
if grep -q "^---" "${rbac_file}.bkp"; then
|
||||
# File has document separator, extract until ---
|
||||
rules_section=$(sed -n '/^rules:/,/^---/p' "${rbac_file}.bkp" | sed '$d')
|
||||
else
|
||||
# Simple file, extract everything from rules to end
|
||||
rules_section=$(sed -n '/^rules:/,$ p' "${rbac_file}.bkp")
|
||||
fi
|
||||
# extract the original label lines
|
||||
original_labels=$(sed -n '/^ labels:/,/^roleRef:/p' "${HELM_DIR}/templates/${rbac_file}.bkp" | grep "app.kubernetes.io" || true)
|
||||
|
||||
# create a new file from scratch with exactly what we want
|
||||
{
|
||||
# first section: Role/ClusterRole
|
||||
echo "apiVersion: rbac.authorization.k8s.io/v1"
|
||||
echo "{{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo "kind: Role"
|
||||
echo "{{- else }}"
|
||||
echo "kind: ClusterRole"
|
||||
echo "{{- end }}"
|
||||
echo "metadata:"
|
||||
echo " name: {{ include \"secrets-operator.fullname\" . }}-${base_name}-role"
|
||||
echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo " namespace: {{ .Values.scopedNamespace | quote }}"
|
||||
echo " {{- end }}"
|
||||
echo " labels:"
|
||||
echo " {{- include \"secrets-operator.labels\" . | nindent 4 }}"
|
||||
|
||||
# add the existing rules section from helm-generated file
|
||||
echo "$rules_section"
|
||||
|
||||
# second section: RoleBinding/ClusterRoleBinding
|
||||
echo "---"
|
||||
echo "apiVersion: rbac.authorization.k8s.io/v1"
|
||||
echo "{{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo "kind: RoleBinding"
|
||||
echo "{{- else }}"
|
||||
echo "kind: ClusterRoleBinding"
|
||||
echo "{{- end }}"
|
||||
echo "metadata:"
|
||||
echo " name: {{ include \"secrets-operator.fullname\" . }}-${base_name}-rolebinding"
|
||||
echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo " namespace: {{ .Values.scopedNamespace | quote }}"
|
||||
echo " {{- end }}"
|
||||
echo " labels:"
|
||||
echo "$original_labels"
|
||||
echo " {{- include \"secrets-operator.labels\" . | nindent 4 }}"
|
||||
|
||||
# add the roleRef section with custom logic
|
||||
echo "roleRef:"
|
||||
echo " apiGroup: rbac.authorization.k8s.io"
|
||||
echo " {{- if and .Values.scopedNamespace .Values.scopedRBAC }}"
|
||||
echo " kind: Role"
|
||||
echo " {{- else }}"
|
||||
echo " kind: ClusterRole"
|
||||
echo " {{- end }}"
|
||||
echo " name: '{{ include \"secrets-operator.fullname\" . }}-${base_name}-role'"
|
||||
|
||||
# add the subjects section
|
||||
sed -n '/^subjects:/,$ p' "${rbac_file}.bkp"
|
||||
} > "${rbac_file}.new"
|
||||
|
||||
mv "${rbac_file}.new" "${rbac_file}"
|
||||
rm "${rbac_file}.bkp"
|
||||
|
||||
echo "Completed processing for $(basename "$rbac_file") with both role conditions and metadata applied"
|
||||
fi
|
||||
done
|
||||
|
||||
# ? NOTE(Daniel): Processes and metrics-reader-rbac.yaml
|
||||
for rbac_file in "${HELM_DIR}/templates/metrics-reader-rbac.yaml"; do
|
||||
if [ -f "$rbac_file" ]; then
|
||||
echo "Adding scopedNamespace condition to $(basename "$rbac_file")"
|
||||
|
||||
@@ -172,9 +194,39 @@ if [ -f "${HELM_DIR}/templates/deployment.yaml" ]; then
|
||||
securityContext_replaced=0
|
||||
in_first_securityContext=0
|
||||
first_securityContext_found=0
|
||||
containers_fixed=0
|
||||
next_line_needs_dash=0
|
||||
|
||||
# process the file line by line
|
||||
while IFS= read -r line; do
|
||||
# Fix containers array syntax issue
|
||||
if [[ "$line" =~ ^[[:space:]]*containers:[[:space:]]*$ ]] && [ "$containers_fixed" -eq 0 ]; then
|
||||
echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new"
|
||||
next_line_needs_dash=1
|
||||
containers_fixed=1
|
||||
continue
|
||||
fi
|
||||
|
||||
# Add dash to first container item if missing
|
||||
if [ "$next_line_needs_dash" -eq 1 ]; then
|
||||
# Check if line already starts with a dash (after whitespace)
|
||||
if [[ "$line" =~ ^[[:space:]]*-[[:space:]] ]]; then
|
||||
# Already has dash, just add the line
|
||||
echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new"
|
||||
elif [[ "$line" =~ ^[[:space:]]*[a-zA-Z] ]]; then
|
||||
# No dash but has content, add dash before the content
|
||||
# Extract indentation and content
|
||||
indent=$(echo "$line" | sed 's/^\([[:space:]]*\).*/\1/')
|
||||
content=$(echo "$line" | sed 's/^[[:space:]]*\(.*\)/\1/')
|
||||
echo "${indent}- ${content}" >> "${HELM_DIR}/templates/deployment.yaml.new"
|
||||
else
|
||||
# Empty line or other, just add as-is
|
||||
echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new"
|
||||
fi
|
||||
next_line_needs_dash=0
|
||||
continue
|
||||
fi
|
||||
|
||||
# check if this is the first securityContext line (for kube-rbac-proxy)
|
||||
if [[ "$line" =~ securityContext.*Values.controllerManager.kubeRbacProxy ]] && [ "$first_securityContext_found" -eq 0 ]; then
|
||||
echo "$line" >> "${HELM_DIR}/templates/deployment.yaml.new"
|
||||
@@ -240,17 +292,6 @@ if [ -f "${HELM_DIR}/values.yaml" ]; then
|
||||
previous_line=""
|
||||
# Process the file line by line
|
||||
while IFS= read -r line; do
|
||||
|
||||
# Check if previous line includes infisical/kubernetes-operator and this line includes tag:
|
||||
if [[ "$previous_line" =~ infisical/kubernetes-operator ]] && [[ "$line" =~ ^[[:space:]]*tag: ]]; then
|
||||
# Get the indentation
|
||||
indent=$(echo "$line" | sed 's/\(^[[:space:]]*\).*/\1/')
|
||||
# Replace with our custom tag
|
||||
echo "${indent}tag: <helm-pr-will-update-this-automatically>" >> "${HELM_DIR}/values.yaml.new"
|
||||
continue
|
||||
fi
|
||||
|
||||
|
||||
if [[ "$line" =~ resources: ]]; then
|
||||
in_resources_section=1
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user