86 lines
3.0 KiB
YAML
86 lines
3.0 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: postsync-create-roxsecrets-job
|
|
namespace: stackrox
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- image: quay.io/gnunn/tools:4.10-1
|
|
env:
|
|
- name: PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: central-htpasswd
|
|
envFrom:
|
|
- configMapRef:
|
|
name: roxsecret-namespaces
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
# Wait for central to be ready
|
|
attempt_counter=0
|
|
max_attempts=20
|
|
echo "Waiting for central to be available..."
|
|
until $(curl -k --output /dev/null --silent --head --fail https://$CENTRAL_URL); do
|
|
if [ ${attempt_counter} -eq ${max_attempts} ];then
|
|
echo "Max attempts reached"
|
|
exit 1
|
|
fi
|
|
printf '.'
|
|
attempt_counter=$(($attempt_counter+1))
|
|
echo "Made attempt $attempt_counter, waiting..."
|
|
sleep 10
|
|
done
|
|
|
|
API_ENDPOINT="/v1/apitokens/generate"
|
|
CENTRAL_URL_API="https://$CENTRAL_URL$API_ENDPOINT"
|
|
echo "Central API endpoint: $CENTRAL_URL_API"
|
|
echo "Creating secrets in namespaces $NAMESPACES"
|
|
|
|
for NAMESPACE in ${NAMESPACES//,/ }
|
|
do
|
|
echo "Creating secret for $NAMESPACE"
|
|
if [[ `oc get namespace $NAMESPACE 2>/dev/null` ]] ;
|
|
then
|
|
echo "Namespace '$NAMESPACE' exists, checking secret..."
|
|
else
|
|
echo "Namespace '$NAMESPACE' doesn't exist, skipping"
|
|
continue
|
|
fi
|
|
|
|
# If secret already exists, don't regenerate.
|
|
if [[ -n `oc get secret roxsecrets -n $NAMESPACE 2>/dev/null` ]] ;
|
|
then
|
|
echo "Stackrox token secret already exists in $NAMESPACE"
|
|
continue
|
|
fi
|
|
PAYLOAD="{\"name\": \"$NAMESPACE\", \"role\": \"Continuous Integration\"}"
|
|
echo "$PAYLOAD"
|
|
echo "Generate new token."
|
|
RESPONSE=$(curl -k \
|
|
-X POST -u "admin:$PASSWORD" \
|
|
-H "Content-Type: application/json" \
|
|
--data "$PAYLOAD" \
|
|
$CENTRAL_URL_API)
|
|
TOKEN=$(jq -r '.token' <<< "$RESPONSE")
|
|
|
|
# Create secret in target namespace
|
|
oc create secret generic roxsecrets \
|
|
--from-literal=rox_central_endpoint=$CENTRAL_URL:443 \
|
|
--from-literal=rox_api_token=$TOKEN \
|
|
-n $NAMESPACE
|
|
done
|
|
name: create-secrets
|
|
dnsPolicy: ClusterFirst
|
|
restartPolicy: Never
|
|
terminationGracePeriodSeconds: 30
|
|
serviceAccount: postsync-create-roxsecrets
|
|
serviceAccountName: postsync-create-roxsecrets
|