Skip to content

Commit f214fc8

Browse files
viveksinghggitsviveksinghggits
authored
[CLOUDP-352579] Add evergreen function to promote and release kubectl plugin (#325)
1 parent 326072a commit f214fc8

File tree

11 files changed

+536
-22
lines changed

11 files changed

+536
-22
lines changed

‎.evergreen-functions.yml‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -512,7 +512,7 @@ functions:
512512
- command: subprocess.exec
513513
params:
514514
working_dir: src/github.com/mongodb/mongodb-kubernetes
515-
binary: scripts/dev/run_python.sh scripts/release/kubectl-mongodb/python/build_kubectl_plugin.py
515+
binary: scripts/dev/run_python.sh scripts/release/kubectl_mongodb/python/build_kubectl_plugin.py
516516

517517
build_and_push_appdb_database:
518518
- command: subprocess.exec
@@ -888,7 +888,7 @@ functions:
888888
release_kubectl_mongodb_plugin:
889889
- command: github.generate_token
890890
params:
891-
expansion_name: generated_token
891+
expansion_name: GH_TOKEN
892892
- command: shell.exec
893893
type: setup
894894
params:
@@ -911,10 +911,5 @@ functions:
911911
GOROOT: "/opt/golang/go1.24"
912912
MACOS_NOTARY_KEY: ${macos_notary_keyid}
913913
MACOS_NOTARY_SECRET: ${macos_notary_secret}
914-
# shell.exec EVG Task doesn't have add_to_path, so we need to explicitly add the path export below.
915-
script: |
916-
set -Eeu pipefail
917-
export GORELEASER_CURRENT_TAG=${OPERATOR_VERSION|*triggered_by_git_tag}
918-
export PATH=$GOROOT/bin:$PATH
919-
export GITHUB_TOKEN=${generated_token}
920-
${workdir}/goreleaser release --clean
914+
GH_TOKEN: ${GH_TOKEN}
915+
script: scripts/dev/run_python.sh scripts/release/kubectl_mongodb/python/promote_kubectl_plugin.py

‎.evergreen-release.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ tasks:
121121
- func: clone
122122
- func: install_goreleaser
123123
- func: install_macos_notarization_service
124+
- func: python_venv
124125
- func: release_kubectl_mongodb_plugin
125126

126127
- name: create_chart_release_pr

‎.goreleaser.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ builds:
1919
hooks:
2020
# This will notarize Apple binaries and replace goreleaser bins with the notarized ones
2121
post:
22-
- cmd: ./scripts/release/kubectl-mongodb/kubectl_mac_notarize.sh
22+
- cmd: ./scripts/release/kubectl_mongodb/kubectl_mac_notarize.sh
2323
output: true
24-
- cmd: ./scripts/release/kubectl-mongodb/sign.sh {{ .Path }}
24+
- cmd: ./scripts/release/kubectl_mongodb/sign.sh {{ .Path }}
2525
env:
2626
- GRS_USERNAME={{ .Env.GRS_USERNAME }}
2727
- GRS_PASSWORD={{ .Env.GRS_PASSWORD }}
@@ -30,7 +30,7 @@ builds:
3030
- SIGNING_IMAGE_URI={{ .Env.SIGNING_IMAGE_URI }}
3131
- ARTIFACTORY_USERNAME=mongodb-enterprise-kubernetes-operator
3232
- ARTIFACTORY_PASSWORD={{ .Env.ARTIFACTORY_PASSWORD }}
33-
- cmd: ./scripts/release/kubectl-mongodb/verify.sh {{ .Path }} && echo "VERIFIED OK"
33+
- cmd: ./scripts/release/kubectl_mongodb/verify.sh {{ .Path }} && echo "VERIFIED OK"
3434

3535
archives:
3636
- format: tar.gz

‎scripts/release/kubectl_mongodb/install_istio_separate_network.sh‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
#!/usr/bin/env bash
2+
3+
set -eux
4+
5+
# define here or provide the cluster names externally
6+
export CTX_CLUSTER1=${CTX_CLUSTER1}
7+
export CTX_CLUSTER2=${CTX_CLUSTER2}
8+
export CTX_CLUSTER3=${CTX_CLUSTER3}
9+
export ISTIO_VERSION=${ISTIO_VERSION}
10+
11+
# download Istio under the path
12+
curl -L https://istio.io/downloadIstio | sh -
13+
14+
# checks if external IP has been assigned to a service object, in our case we are interested in east-west gateway
15+
function_check_external_ip_assigned() {
16+
while : ; do
17+
ip=$(kubectl --context="$1" get svc istio-eastwestgateway -n istio-system --output jsonpath='{.status.loadBalancer.ingress[0].ip}')
18+
if [ -n "${ip}" ]
19+
then
20+
echo "external ip assigned ${ip}"
21+
break
22+
else
23+
echo "waiting for external ip to be assigned"
24+
fi
25+
done
26+
}
27+
28+
cd "istio-${ISTIO_VERSION}"
29+
mkdir -p certs
30+
pushd certs
31+
32+
# create root trust for the clusters
33+
make -f ../tools/certs/Makefile.selfsigned.mk root-ca
34+
make -f ../tools/certs/Makefile.selfsigned.mk "${CTX_CLUSTER1}-cacerts"
35+
make -f ../tools/certs/Makefile.selfsigned.mk "${CTX_CLUSTER2}-cacerts"
36+
make -f ../tools/certs/Makefile.selfsigned.mk "${CTX_CLUSTER3}-cacerts"
37+
38+
kubectl --context="${CTX_CLUSTER1}" create ns istio-system
39+
kubectl --context="${CTX_CLUSTER1}" create secret generic cacerts -n istio-system \
40+
--from-file="${CTX_CLUSTER1}/ca-cert.pem" \
41+
--from-file="${CTX_CLUSTER1}/ca-key.pem" \
42+
--from-file="${CTX_CLUSTER1}/root-cert.pem" \
43+
--from-file="${CTX_CLUSTER1}/cert-chain.pem"
44+
45+
kubectl --context="${CTX_CLUSTER2}" create ns istio-system
46+
kubectl --context="${CTX_CLUSTER2}" create secret generic cacerts -n istio-system \
47+
--from-file="${CTX_CLUSTER2}/ca-cert.pem" \
48+
--from-file="${CTX_CLUSTER2}/ca-key.pem" \
49+
--from-file="${CTX_CLUSTER2}/root-cert.pem" \
50+
--from-file="${CTX_CLUSTER2}/cert-chain.pem"
51+
52+
kubectl --context="${CTX_CLUSTER3}" create ns istio-system
53+
kubectl --context="${CTX_CLUSTER3}" create secret generic cacerts -n istio-system \
54+
--from-file="${CTX_CLUSTER3}/ca-cert.pem" \
55+
--from-file="${CTX_CLUSTER3}/ca-key.pem" \
56+
--from-file="${CTX_CLUSTER3}/root-cert.pem" \
57+
--from-file="${CTX_CLUSTER3}/cert-chain.pem"
58+
popd
59+
60+
# label namespace in cluster1
61+
kubectl --context="${CTX_CLUSTER1}" get namespace istio-system && \
62+
kubectl --context="${CTX_CLUSTER1}" label namespace istio-system topology.istio.io/network=network1
63+
64+
cat <<EOF > cluster1.yaml
65+
apiVersion: install.istio.io/v1alpha1
66+
kind: IstioOperator
67+
spec:
68+
values:
69+
global:
70+
meshID: mesh1
71+
multiCluster:
72+
clusterName: cluster1
73+
network: network1
74+
EOF
75+
bin/istioctl install --context="${CTX_CLUSTER1}" -f cluster1.yaml
76+
samples/multicluster/gen-eastwest-gateway.sh \
77+
--mesh mesh1 --cluster cluster1 --network network1 | \
78+
bin/istioctl --context="${CTX_CLUSTER1}" install -y -f -
79+
80+
81+
# check if external IP is assigned to east-west gateway in cluster1
82+
function_check_external_ip_assigned "${CTX_CLUSTER1}"
83+
84+
85+
# expose services in cluster1
86+
kubectl --context="${CTX_CLUSTER1}" apply -n istio-system -f \
87+
samples/multicluster/expose-services.yaml
88+
89+
90+
kubectl --context="${CTX_CLUSTER2}" get namespace istio-system && \
91+
kubectl --context="${CTX_CLUSTER2}" label namespace istio-system topology.istio.io/network=network2
92+
93+
94+
cat <<EOF > cluster2.yaml
95+
apiVersion: install.istio.io/v1alpha1
96+
kind: IstioOperator
97+
spec:
98+
values:
99+
global:
100+
meshID: mesh1
101+
multiCluster:
102+
clusterName: cluster2
103+
network: network2
104+
EOF
105+
106+
bin/istioctl install --context="${CTX_CLUSTER2}" -f cluster2.yaml
107+
108+
samples/multicluster/gen-eastwest-gateway.sh \
109+
--mesh mesh1 --cluster cluster2 --network network2 | \
110+
bin/istioctl --context="${CTX_CLUSTER2}" install -y -f -
111+
112+
# check if external IP is assigned to east-west gateway in cluster2
113+
function_check_external_ip_assigned "${CTX_CLUSTER2}"
114+
115+
kubectl --context="${CTX_CLUSTER2}" apply -n istio-system -f \
116+
samples/multicluster/expose-services.yaml
117+
118+
# cluster3
119+
kubectl --context="${CTX_CLUSTER3}" get namespace istio-system && \
120+
kubectl --context="${CTX_CLUSTER3}" label namespace istio-system topology.istio.io/network=network3
121+
122+
cat <<EOF > cluster3.yaml
123+
apiVersion: install.istio.io/v1alpha1
124+
kind: IstioOperator
125+
spec:
126+
values:
127+
global:
128+
meshID: mesh1
129+
multiCluster:
130+
clusterName: cluster3
131+
network: network3
132+
EOF
133+
134+
bin/istioctl install --context="${CTX_CLUSTER3}" -f cluster3.yaml
135+
136+
samples/multicluster/gen-eastwest-gateway.sh \
137+
--mesh mesh1 --cluster cluster3 --network network3 | \
138+
bin/istioctl --context="${CTX_CLUSTER3}" install -y -f -
139+
140+
141+
# check if external IP is assigned to east-west gateway in cluster3
142+
function_check_external_ip_assigned "${CTX_CLUSTER3}"
143+
144+
kubectl --context="${CTX_CLUSTER3}" apply -n istio-system -f \
145+
samples/multicluster/expose-services.yaml
146+
147+
148+
# enable endpoint discovery
149+
bin/istioctl x create-remote-secret \
150+
--context="${CTX_CLUSTER1}" \
151+
-n istio-system \
152+
--name=cluster1 | \
153+
kubectl apply -f - --context="${CTX_CLUSTER2}"
154+
155+
bin/istioctl x create-remote-secret \
156+
--context="${CTX_CLUSTER1}" \
157+
-n istio-system \
158+
--name=cluster1 | \
159+
kubectl apply -f - --context="${CTX_CLUSTER3}"
160+
161+
bin/istioctl x create-remote-secret \
162+
--context="${CTX_CLUSTER2}" \
163+
-n istio-system \
164+
--name=cluster2 | \
165+
kubectl apply -f - --context="${CTX_CLUSTER1}"
166+
167+
bin/istioctl x create-remote-secret \
168+
--context="${CTX_CLUSTER2}" \
169+
-n istio-system \
170+
--name=cluster2 | \
171+
kubectl apply -f - --context="${CTX_CLUSTER3}"
172+
173+
bin/istioctl x create-remote-secret \
174+
--context="${CTX_CLUSTER3}" \
175+
-n istio-system \
176+
--name=cluster3 | \
177+
kubectl apply -f - --context="${CTX_CLUSTER1}"
178+
179+
bin/istioctl x create-remote-secret \
180+
--context="${CTX_CLUSTER3}" \
181+
-n istio-system \
182+
--name=cluster3 | \
183+
kubectl apply -f - --context="${CTX_CLUSTER2}"
184+
185+
# cleanup: delete the istio repo at the end
186+
cd ..
187+
rm -r "istio-${ISTIO_VERSION}"
188+
rm -f cluster1.yaml cluster2.yaml cluster3.yaml

‎scripts/release/kubectl-mongodb/kubectl_mac_notarize.sh‎ renamed to ‎scripts/release/kubectl_mongodb/kubectl_mac_notarize.sh‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,16 +20,27 @@ set -Eeou pipefail
2020
# This depends on binaries being generated in a goreleaser manner and gon being set up.
2121
# goreleaser should already take care of calling this script as a hook.
2222

23-
if [[ -f "./dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb" && -f "./dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb" && ! -f "./dist/kubectl-mongodb_macos_signed.zip" ]]; then
23+
if [ -z "${1-}" ]; then
24+
echo "Error: Missing required argument <version> as first positional parameter to script"
25+
echo "Usage: ./kubectl_mac_notarize.sh <version>"
26+
exit 1
27+
fi
28+
29+
version=$1
30+
31+
darwin_amd64_dir="./artifacts/kubectl-mongodb_${version}_darwin_amd64"
32+
darwin_arm64_dir="./artifacts/kubectl-mongodb_${version}_darwin_arm64"
33+
34+
if [[ -f "${darwin_amd64_dir}/kubectl-mongodb" && -f "${darwin_arm64_dir}/kubectl-mongodb" && ! -f "./artifacts/kubectl-mongodb_macos_signed.zip" ]]; then
2435
echo "notarizing macOs binaries"
25-
zip -r ./dist/kubectl-mongodb_amd64_arm64_bin.zip ./dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb ./dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb # The Notarization Service takes an archive as input
36+
zip -r ./artifacts/kubectl-mongodb_amd64_arm64_bin.zip "${darwin_amd64_dir}/kubectl-mongodb" "${darwin_arm64_dir}/kubectl-mongodb" # The Notarization Service takes an archive as input
2637
"${workdir:-.}"/linux_amd64/macnotary \
27-
-f ./dist/kubectl-mongodb_amd64_arm64_bin.zip \
38+
-f ./artifacts/kubectl-mongodb_amd64_arm64_bin.zip \
2839
-m notarizeAndSign -u https://dev.macos-notary.build.10gen.cc/api \
2940
-b com.mongodb.mongodb-kubectl-mongodb \
30-
-o ./dist/kubectl-mongodb_macos_signed.zip
41+
-o ./artifacts/kubectl-mongodb_macos_signed.zip
3142

3243
echo "replacing original files"
33-
unzip -oj ./dist/kubectl-mongodb_macos_signed.zip dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb -d ./dist/kubectl-mongodb_darwin_amd64_v1/
34-
unzip -oj ./dist/kubectl-mongodb_macos_signed.zip dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb -d ./dist/kubectl-mongodb_darwin_arm64/
44+
unzip -oj ./artifacts/kubectl-mongodb_macos_signed.zip "artifacts/kubectl-mongodb_${version}_darwin_amd64/kubectl-mongodb" -d "${darwin_amd64_dir}/"
45+
unzip -oj ./artifacts/kubectl-mongodb_macos_signed.zip "artifacts/kubectl-mongodb_${version}_darwin_arm64/kubectl-mongodb" -d "${darwin_arm64_dir}/"
3546
fi

‎scripts/release/kubectl-mongodb/python/build_kubectl_plugin.py‎ renamed to ‎scripts/release/kubectl_mongodb/python/build_kubectl_plugin.py‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,10 @@
99
from scripts.release.build.build_info import (
1010
load_build_info,
1111
)
12+
from scripts.release.kubectl_mongodb.python.consts import *
1213

13-
AWS_REGION = "eu-north-1"
14-
KUBECTL_PLUGIN_BINARY_NAME = "kubectl-mongodb"
1514
S3_BUCKET_KUBECTL_PLUGIN_SUBPATH = KUBECTL_PLUGIN_BINARY_NAME
1615

17-
GORELEASER_DIST_DIR = "dist"
18-
1916

2017
def run_goreleaser():
2118
try:

‎scripts/release/kubectl_mongodb/python/consts.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
AWS_REGION = "eu-north-1"
2+
KUBECTL_PLUGIN_BINARY_NAME = "kubectl-mongodb"
3+
4+
GITHUB_REPO = "mongodb/mongodb-kubernetes"
5+
6+
LOCAL_ARTIFACTS_DIR = "artifacts"
7+
CHECKSUMS_PATH = f"{LOCAL_ARTIFACTS_DIR}/checksums.txt"
8+
9+
GORELEASER_DIST_DIR = "dist"
10+
11+
BUILD_SCENARIO_RELEASE = "release"
12+
BUILD_SCENARIO_STAGING = "staging"

0 commit comments

Comments
 (0)