k8s-installation/cluster

#!/bin/bash

set -Eeuo pipefail
trap "exit" INT

function init () {
  local cluster_name="${1:-}"

  if [ -d "$cluster_name" ]; then
    echo "Cluster '$cluster_name' already initialized !"
    exit 1
  fi

  cluster_name="$1"

  mkdir -p "$cluster_name"
  sed "s/__CLUSTER_NAME__/$cluster_name/" install-config.yaml > "$cluster_name/install-config.yaml"
  sed "s/__CLUSTER_NAME__/$cluster_name/" terraform.tfvars > "$cluster_name/terraform.tfvars"

  echo "Cluster $cluster_name initialized successfully!"
  echo
  echo "Review and adjust the following files to your needs:"
  echo "- $cluster_name/install-config.yaml"
  echo "- $cluster_name/terraform.tfvars"
  echo
  exit 0
}

function destroy () {
  local cluster_name="${1:-}"

  if [ ! -d "$cluster_name" ]; then
    echo "Cluster '$cluster_name' does not exist!"
    exit 1
  fi

  terraform destroy -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate"
  sed -i.bak 's/^\s*bootstrap_nodes\s*=\s*.*$/bootstrap_nodes = 1/' "$cluster_name/terraform.tfvars"
}

function apply () {
  local cluster_name="${1:-}"

  if [ ! -d "$cluster_name" ]; then
    echo "Cluster '$cluster_name' does not exist!"
    exit 1
  fi

  # Create installation files
  openshift-install create manifests --dir="$cluster_name"
  openshift-install create ignition-configs --dir="$cluster_name"

  # Provision the infrastructure and wait for bootstrap to complete
  terraform apply -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate" -auto-approve
  openshift-install --dir="$cluster_name" wait-for bootstrap-complete --log-level=info

  # Destroy the bootstrap node
  sed -i.bak 's/^\s*bootstrap_nodes\s*=\s*.*$/bootstrap_nodes = 0/' "$cluster_name/terraform.tfvars"
  terraform apply -var-file="$cluster_name/terraform.tfvars" -state="$cluster_name/terraform.tfstate" -auto-approve

  # Auto-approve all pending CSRs
  for i in {0..240}; do
    oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" get csr --no-headers \
      | awk '/Pending/ {print $1}' \
      | xargs --no-run-if-empty oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" adm certificate approve
    sleep 15
  done &

  # Wait for the installation to complete
  openshift-install --dir="$cluster_name" wait-for install-complete
}

function post_install_nfs () {
  local cluster_name="${1:-}"

  oc apply --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" -f "$cluster_name/registry-pv.yaml"
  oc patch --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" configs.imageregistry.operator.openshift.io cluster --type=json --patch-file=/dev/fd/0 <<EOF
[{"op": "remove", "path": "/spec/storage" },{"op": "add", "path": "/spec/storage", "value": {"pvc":{"claim": "registry-storage"}}}]
EOF
  oc apply --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" -f "$cluster_name/nfs-provisioner.yaml"
  oc patch --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" configs.imageregistry.operator.openshift.io cluster --type merge --patch-file=/dev/fd/0 <<EOF
{"spec":{"managementState": "Managed"}}
EOF
}

function post_install_le () {
  local cluster_name="${1:-}"

  # Generated by terraform
  source "$cluster_name/dns.env"

  # Get a certificate from Let's Encrypt
  lego -m "nmasse@redhat.com" -d "$LE_API_HOSTNAME" -d "$LE_ROUTER_HOSTNAME" -a --dns gandiv5 run --no-bundle
  
  # Deploy certificate to ingress
  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret tls router-certs-$(date "+%Y-%m-%d") --cert=.lego/certificates/$LE_API_HOSTNAME.crt --key=.lego/certificates/$LE_API_HOSTNAME.key -n openshift-ingress --dry-run -o yaml > "$cluster_name/router-certs.yaml"
  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/router-certs.yaml" -n openshift-ingress
  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" patch ingresscontroller default -n openshift-ingress-operator --type=merge --patch-file=/dev/fd/0 <<EOF
{"spec": { "defaultCertificate": { "name": "router-certs-$(date "+%Y-%m-%d")" }}}
EOF

  # Deploy certificate to api
  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret tls api-certs-$(date "+%Y-%m-%d") --cert=.lego/certificates/$LE_API_HOSTNAME.crt --key=.lego/certificates/$LE_API_HOSTNAME.key -n openshift-config --dry-run -o yaml > "$cluster_name/api-certs.yaml"
  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/api-certs.yaml" -n openshift-config
  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" patch apiserver cluster --type=merge --patch-file=/dev/fd/0 <<EOF
{"spec":{"servingCerts":{"namedCertificates":[{"names":["$LE_API_HOSTNAME"],"servingCertificate":{"name": "api-certs-$(date "+%Y-%m-%d")"}}]}}}
EOF
}

function post_install_sso () {
  local cluster_name="${1:-}"

  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" create secret generic redhat-sso-client-secret -n openshift-config --from-literal="clientSecret=$GOOGLE_CLIENT_SECRET" --dry-run -o yaml > "$cluster_name/sso-secret.yaml"
  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f "$cluster_name/sso-secret.yaml"
  oc --insecure-skip-tls-verify --kubeconfig="$cluster_name/auth/kubeconfig" apply -f - <<EOF
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - google:
      clientID: "$GOOGLE_CLIENT_ID"
      clientSecret:
        name: redhat-sso-client-secret
      hostedDomain: redhat.com
    mappingMethod: claim
    name: RedHatSSO
    type: Google
EOF
}

function post_install () {
  local cluster_name="${1:-}"
  shift

  if [ ! -d "$cluster_name" ]; then
    echo "Cluster '$cluster_name' does not exist!"
    exit 1
  fi

  if [ $# -eq 0 ]; then
    set nfs sso le
  fi
  
  for i; do
    post_install_$i "$cluster_name"
  done
}

if [ ! -e "local.env" ]; then
  echo "Please create local.env first!"
  exit 1
fi

source local.env

case "${1:-}" in
init)
  if [ -z "${2:-}" ]; then
    echo "Usage: $0 init cluster-name"
    exit 1
  fi
  shift
  bootstrap "$@"
;;
apply)
  if [ -z "${2:-}" ]; then
    echo "Usage: $0 apply cluster-name"
    exit 1
  fi
  shift
  apply "$@"
;;
destroy)
  if [ -z "${2:-}" ]; then
    echo "Usage: $0 destroy cluster-name"
    exit 1
  fi
  shift
  destroy "$@"
;;
post-install)
  if [ -z "${2:-}" ]; then
    echo "Usage: $0 post-install cluster-name"
    exit 1
  fi
  shift
  post_install "$@"
;;
*)
  echo "Usage: $0 {init|apply|post-install|destroy} cluster-name"
  exit 1
;;
esac