mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-16 11:24:35 -05:00
968cdc1a38
* cli: move internal packages Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * cli: fix buildfiles Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * bazel: fix exclude dir Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * cli: move back libraries that will not be used by TF provider Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> --------- Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
49 lines
2.5 KiB
Bash
49 lines
2.5 KiB
Bash
# shellcheck disable=SC2086
|
|
# shellcheck disable=SC2139
|
|
set -e
|
|
|
|
echo "Waiting for spire process to start"
|
|
while ! pgrep spire-server > /dev/null; do sleep 5; done
|
|
|
|
SPIRE_SERVER_ROOT_PATH="/proc/$(pgrep spire-server)/root"
|
|
|
|
alias spire_server="${SPIRE_SERVER_ROOT_PATH}/opt/spire/bin/spire-server"
|
|
SOCKET_PATH="${SPIRE_SERVER_ROOT_PATH}/tmp/spire-server/private/api.sock"
|
|
SOCKET_FLAG="-socketPath ${SOCKET_PATH}"
|
|
|
|
echo "Checking spire-server status"
|
|
while ! spire_server entry show ${SOCKET_FLAG} &> /dev/null; do
|
|
echo "Waiting for spire-server to start..."
|
|
sleep 5
|
|
done
|
|
|
|
echo "Spire Server is up, initializing cilium spire entries..."
|
|
|
|
AGENT_SPIFFE_ID="spiffe://{{ .Values.authentication.mutual.spire.trustDomain }}/ns/{{ .Values.authentication.mutual.spire.install.namespace }}/sa/spire-agent"
|
|
AGENT_SELECTORS="-selector k8s_psat:agent_ns:{{ .Values.authentication.mutual.spire.install.namespace }} -selector k8s_psat:agent_sa:spire-agent"
|
|
CILIUM_AGENT_SPIFFE_ID="spiffe://{{ .Values.authentication.mutual.spire.trustDomain }}/cilium-agent"
|
|
CILIUM_AGENT_SELECTORS="-selector k8s:ns:{{ .Release.Namespace }} -selector k8s:sa:{{ .Values.serviceAccounts.cilium.name }}"
|
|
CILIUM_OPERATOR_SPIFFE_ID="spiffe://{{ .Values.authentication.mutual.spire.trustDomain }}/cilium-operator"
|
|
CILIUM_OPERATOR_SELECTORS="-selector k8s:ns:{{ .Release.Namespace }} -selector k8s:sa:{{ .Values.serviceAccounts.operator.name }}"
|
|
|
|
while pgrep spire-server > /dev/null;
|
|
do
|
|
echo "Ensuring agent entry"
|
|
if spire_server entry show ${SOCKET_FLAG} -spiffeID $AGENT_SPIFFE_ID $AGENT_SELECTORS | grep -q "Found 0 entries" &> /dev/null; then
|
|
spire_server entry create ${SOCKET_FLAG} -spiffeID $AGENT_SPIFFE_ID $AGENT_SELECTORS -node
|
|
fi
|
|
|
|
echo "Ensuring cilium-agent entry (required for the delegated identity to work)"
|
|
if spire_server entry show ${SOCKET_FLAG} -spiffeID $CILIUM_AGENT_SPIFFE_ID $CILIUM_AGENT_SELECTORS | grep -q "Found 0 entries" &> /dev/null; then
|
|
spire_server entry create ${SOCKET_FLAG} -spiffeID $CILIUM_AGENT_SPIFFE_ID -parentID $AGENT_SPIFFE_ID $CILIUM_AGENT_SELECTORS
|
|
fi
|
|
|
|
echo "Ensuring cilium-operator entry (required for creating SPIFFE identities)"
|
|
if spire_server entry show ${SOCKET_FLAG} -spiffeID $CILIUM_OPERATOR_SPIFFE_ID $CILIUM_OPERATOR_SELECTORS | grep -q "Found 0 entries" &> /dev/null; then
|
|
spire_server entry create ${SOCKET_FLAG} -spiffeID $CILIUM_OPERATOR_SPIFFE_ID -parentID $AGENT_SPIFFE_ID $CILIUM_OPERATOR_SELECTORS
|
|
fi
|
|
|
|
echo "Cilium Spire entries are initialized successfully or already in-sync"
|
|
sleep 30;
|
|
done
|