func getReferencedServiceAccountToken(c *client.Client, ns string, name string, shouldWait bool) (string, string, error) {
tokenName := ""
token := ""
findToken := func() (bool, error) {
user, err := c.ServiceAccounts(ns).Get(name)
if errors.IsNotFound(err) {
return false, nil
}
if err != nil {
return false, err
}
for _, ref := range user.Secrets {
secret, err := c.Secrets(ns).Get(ref.Name)
if errors.IsNotFound(err) {
continue
}
if err != nil {
return false, err
}
if secret.Type != api.SecretTypeServiceAccountToken {
continue
}
name := secret.Annotations[api.ServiceAccountNameKey]
uid := secret.Annotations[api.ServiceAccountUIDKey]
tokenData := secret.Data[api.ServiceAccountTokenKey]
if name == user.Name && uid == string(user.UID) && len(tokenData) > 0 {
tokenName = secret.Name
token = string(tokenData)
return true, nil
}
}
return false, nil
}
if shouldWait {
err := wait.Poll(time.Second, 10*time.Second, findToken)
if err != nil {
return "", "", err
}
} else {
ok, err := findToken()
if err != nil {
return "", "", err
}
if !ok {
return "", "", fmt.Errorf("No token found for %s/%s", ns, name)
}
}
return tokenName, token, nil
}
// GetSecretList - return all secrets in the given namespace.
func GetSecretList(client *client.Client, namespace *common.NamespaceQuery,
dsQuery *dataselect.DataSelectQuery) (*SecretList, error) {
secretList, err := client.Secrets(namespace.ToRequestParam()).List(api.ListOptions{
LabelSelector: labels.Everything(),
FieldSelector: fields.Everything(),
})
if err != nil {
return nil, err
}
return NewSecretList(secretList.Items, dsQuery), err
}
func getServiceAccountPullSecret(client *kclient.Client, ns, name string) (string, error) {
secrets, err := client.Secrets(ns).List(labels.Everything(), fields.Everything())
if err != nil {
return "", err
}
for _, secret := range secrets.Items {
if secret.Type == api.SecretTypeDockercfg && secret.Annotations[api.ServiceAccountNameKey] == name {
return string(secret.Data[api.DockerConfigKey]), nil
}
}
return "", nil
}
func deleteSecrets(c *k8sclient.Client, ns string, selector labels.Selector) error {
secrets, err := c.Secrets(ns).List(api.ListOptions{LabelSelector: selector})
if err != nil {
return err
}
for _, s := range secrets.Items {
err := c.Secrets(ns).Delete(s.Name)
if err != nil {
return errors.Wrap(err, fmt.Sprintf("failed to delete Secret %s", s.Name))
}
}
return nil
}
func generatePrivateKeySecrets(c *client.Client, ns string, hostEntries []*HostEntry, rc *api.ReplicationController, podSpec *api.PodSpec, container *api.Container) error {
secrets := map[string]string{}
rcName := rc.ObjectMeta.Name
for _, hostEntry := range hostEntries {
privateKey := hostEntry.PrivateKey
if len(privateKey) != 0 {
volumeMount := secrets[privateKey]
if len(volumeMount) == 0 {
buffer, err := ioutil.ReadFile(privateKey)
if err != nil {
return err
}
hostName := hostEntry.Name
secretName := rcName + "-" + hostName
keyName := "sshkey"
secret := &api.Secret{
ObjectMeta: api.ObjectMeta{
Name: secretName,
Labels: rc.ObjectMeta.Labels,
},
Data: map[string][]byte{
keyName: buffer,
},
}
// lets create or update the secret
secretClient := c.Secrets(ns)
current, err := secretClient.Get(secretName)
if err != nil || current == nil {
_, err = secretClient.Create(secret)
} else {
_, err = secretClient.Update(secret)
}
if err != nil {
return err
}
volumeMount = "/secrets/" + hostName
secrets[privateKey] = volumeMount
hostEntry.PrivateKey = volumeMount + "/" + keyName
// lets add the volume mapping to the container
secretVolumeName := "secret-" + hostName
k8s.EnsurePodSpecHasSecretVolume(podSpec, secretVolumeName, secretName)
k8s.EnsureContainerHasVolumeMount(container, secretVolumeName, volumeMount)
}
}
}
return nil
}
func getSecret(kubeClient *client.Client, name string, ns string) (*api.Secret, error) {
secretClient := kubeClient.Secrets(ns)
secret, err := secretClient.Get(name)
if err != nil {
statusErr, ok := err.(*errors.StatusError)
// If the issue is just that no such secret was found, that's ok.
if ok && statusErr.Status().Code == 404 {
// We'll just return nil instead of a found *api.Secret
return nil, nil
}
return nil, err
}
return secret, nil
}
func GetClientForServiceAccount(adminClient *kclient.Client, clientConfig kclient.Config, namespace, name string) (*client.Client, *kclient.Client, *kclient.Config, error) {
_, err := adminClient.Namespaces().Create(&kapi.Namespace{ObjectMeta: kapi.ObjectMeta{Name: namespace}})
if err != nil && !kerrs.IsAlreadyExists(err) {
return nil, nil, nil, err
}
sa, err := adminClient.ServiceAccounts(namespace).Create(&kapi.ServiceAccount{ObjectMeta: kapi.ObjectMeta{Name: name}})
if kerrs.IsAlreadyExists(err) {
sa, err = adminClient.ServiceAccounts(namespace).Get(name)
}
if err != nil {
return nil, nil, nil, err
}
token := ""
err = wait.Poll(time.Second, 30*time.Second, func() (bool, error) {
selector := fields.OneTermEqualSelector(kclient.SecretType, string(kapi.SecretTypeServiceAccountToken))
secrets, err := adminClient.Secrets(namespace).List(kapi.ListOptions{FieldSelector: selector})
if err != nil {
return false, err
}
for _, secret := range secrets.Items {
if serviceaccounts.IsValidServiceAccountToken(sa, &secret) {
token = string(secret.Data[kapi.ServiceAccountTokenKey])
return true, nil
}
}
return false, nil
})
if err != nil {
return nil, nil, nil, err
}
saClientConfig := clientcmd.AnonymousClientConfig(clientConfig)
saClientConfig.BearerToken = token
kubeClient, err := kclient.New(&saClientConfig)
if err != nil {
return nil, nil, nil, err
}
osClient, err := client.New(&saClientConfig)
if err != nil {
return nil, nil, nil, err
}
return osClient, kubeClient, &saClientConfig, nil
}
//checkKibanaSecret confirms the secret used by kibana matches that configured in the oauth client
func checkKibanaSecret(r types.DiagnosticResult, osClient *client.Client, kClient *kclient.Client, project string, oauthclient *oauthapi.OAuthClient) {
r.Debug("AGL0100", "Checking oauthclient secrets...")
secret, err := kClient.Secrets(project).Get(kibanaProxySecretName)
if err != nil {
r.Error("AGL0105", err, fmt.Sprintf("Error retrieving the secret '%s': %s", kibanaProxySecretName, err))
return
}
decoded, err := decodeSecret(secret, oauthSecretKeyName)
if err != nil {
r.Error("AGL0110", err, fmt.Sprintf("Unable to decode Kibana Secret: %s", err))
return
}
if decoded != oauthclient.Secret {
r.Debug("AGL0120", fmt.Sprintf("OauthClient Secret: '%s'", oauthclient.Secret))
r.Debug("AGL0125", fmt.Sprintf("Decoded Kibana Secret: '%s'", decoded))
message := fmt.Sprintf("The %s OauthClient.Secret does not match the decoded oauth secret in '%s'", kibanaProxyOauthClientName, kibanaProxySecretName)
r.Error("AGL0130", errors.New(message), message)
}
}
// GetSecretDetail returns returns detailed information about a secret
func GetSecretDetail(client *client.Client, namespace, name string) (*SecretDetail, error) {
log.Printf("Getting details of %s secret in %s namespace", name, namespace)
rawSecret, err := client.Secrets(namespace).Get(name)
if err != nil {
return nil, err
}
return getSecretDetail(rawSecret), nil
}
// createSecret creates a secret containing TLS certificates for the given Ingress.
// If a secret with the same name already exists in the namespace of the
// Ingress, it's updated.
func createSecret(kubeClient *client.Client, ing *extensions.Ingress) (host string, rootCA, privKey []byte, err error) {
var k, c bytes.Buffer
tls := ing.Spec.TLS[0]
host = strings.Join(tls.Hosts, ",")
framework.Logf("Generating RSA cert for host %v", host)
if err = generateRSACerts(host, true, &k, &c); err != nil {
return
}
cert := c.Bytes()
key := k.Bytes()
secret := &api.Secret{
ObjectMeta: api.ObjectMeta{
Name: tls.SecretName,
},
Data: map[string][]byte{
api.TLSCertKey: cert,
api.TLSPrivateKeyKey: key,
},
}
var s *api.Secret
if s, err = kubeClient.Secrets(ing.Namespace).Get(tls.SecretName); err == nil {
// TODO: Retry the update. We don't really expect anything to conflict though.
framework.Logf("Updating secret %v in ns %v with hosts %v for ingress %v", secret.Name, secret.Namespace, host, ing.Name)
s.Data = secret.Data
_, err = kubeClient.Secrets(ing.Namespace).Update(s)
} else {
framework.Logf("Creating secret %v in ns %v with hosts %v for ingress %v", secret.Name, secret.Namespace, host, ing.Name)
_, err = kubeClient.Secrets(ing.Namespace).Create(secret)
}
return host, cert, key, err
}
// CreateSecret - create a single secret using the cluster API client
func CreateSecret(client *client.Client, spec SecretSpec) (*Secret, error) {
namespace := spec.GetNamespace()
secret := &api.Secret{
ObjectMeta: api.ObjectMeta{
Name: spec.GetName(),
Namespace: namespace,
},
Type: spec.GetType(),
Data: spec.GetData(),
}
_, err := client.Secrets(namespace).Create(secret)
return &Secret{Name: secret.ObjectMeta.Name}, err
}
func getServiceAccountToken(client *kclient.Client, ns, name string) (string, error) {
secrets, err := client.Secrets(ns).List(labels.Everything(), fields.Everything())
if err != nil {
return "", err
}
for _, secret := range secrets.Items {
if secret.Type == api.SecretTypeServiceAccountToken && secret.Annotations[api.ServiceAccountNameKey] == name {
sa, err := client.ServiceAccounts(ns).Get(name)
if err != nil {
return "", err
}
for _, ref := range sa.Secrets {
if ref.Name == secret.Name {
return string(secret.Data[api.ServiceAccountTokenKey]), nil
}
}
}
}
return "", nil
}
// createSecret creates a secret containing TLS certificates for the given Ingress.
func createSecret(kubeClient *client.Client, ing *extensions.Ingress) (host string, rootCA, privKey []byte, err error) {
var k, c bytes.Buffer
tls := ing.Spec.TLS[0]
host = strings.Join(tls.Hosts, ",")
Logf("Generating RSA cert for host %v", host)
if err = generateRSACerts(host, true, &k, &c); err != nil {
return
}
cert := c.Bytes()
key := k.Bytes()
secret := &api.Secret{
ObjectMeta: api.ObjectMeta{
Name: tls.SecretName,
},
Data: map[string][]byte{
api.TLSCertKey: cert,
api.TLSPrivateKeyKey: key,
},
}
Logf("Creating secret %v in ns %v with hosts %v for ingress %v", secret.Name, secret.Namespace, host, ing.Name)
_, err = kubeClient.Secrets(ing.Namespace).Create(secret)
return host, cert, key, err
}
// GetSecrets - return all secrets in the given namespace.
func GetSecrets(client *client.Client, namespace string) (*SecretsList,
error) {
secretsList := &SecretsList{}
secrets, err := client.Secrets(namespace).List(api.ListOptions{
LabelSelector: labels.Everything(),
FieldSelector: fields.Everything(),
})
if err != nil {
return nil, err
}
for _, secret := range secrets.Items {
secretsList.Secrets = append(secretsList.Secrets, secret.ObjectMeta.Name)
}
return secretsList, err
}
func doServiceAccountAPIRequests(t *testing.T, c *client.Client, ns string, authenticated bool, canRead bool, canWrite bool) {
testSecret := &api.Secret{
ObjectMeta: api.ObjectMeta{Name: "testSecret"},
Data: map[string][]byte{"test": []byte("data")},
}
readOps := []testOperation{
func() error {
_, err := c.Secrets(ns).List(api.ListOptions{})
return err
},
func() error {
_, err := c.Pods(ns).List(api.ListOptions{})
return err
},
}
writeOps := []testOperation{
func() error { _, err := c.Secrets(ns).Create(testSecret); return err },
func() error { return c.Secrets(ns).Delete(testSecret.Name) },
}
for _, op := range readOps {
err := op()
unauthorizedError := errors.IsUnauthorized(err)
forbiddenError := errors.IsForbidden(err)
switch {
case !authenticated && !unauthorizedError:
t.Fatalf("expected unauthorized error, got %v", err)
case authenticated && unauthorizedError:
t.Fatalf("unexpected unauthorized error: %v", err)
case authenticated && canRead && forbiddenError:
t.Fatalf("unexpected forbidden error: %v", err)
case authenticated && !canRead && !forbiddenError:
t.Fatalf("expected forbidden error, got: %v", err)
}
}
for _, op := range writeOps {
err := op()
unauthorizedError := errors.IsUnauthorized(err)
forbiddenError := errors.IsForbidden(err)
switch {
case !authenticated && !unauthorizedError:
t.Fatalf("expected unauthorized error, got %v", err)
case authenticated && unauthorizedError:
t.Fatalf("unexpected unauthorized error: %v", err)
case authenticated && canWrite && forbiddenError:
t.Fatalf("unexpected forbidden error: %v", err)
case authenticated && !canWrite && !forbiddenError:
t.Fatalf("expected forbidden error, got: %v", err)
}
}
}
// serviceAccountSecretsExist checks whether the given service account has at least a token and a dockercfg
// secret associated with it.
func serviceAccountSecretsExist(client *kclient.Client, namespace string, sa *kapi.ServiceAccount) bool {
foundTokenSecret := false
foundDockercfgSecret := false
for _, secret := range sa.Secrets {
ns := namespace
if len(secret.Namespace) > 0 {
ns = secret.Namespace
}
secret, err := client.Secrets(ns).Get(secret.Name)
if err == nil {
switch secret.Type {
case kapi.SecretTypeServiceAccountToken:
foundTokenSecret = true
case kapi.SecretTypeDockercfg:
foundDockercfgSecret = true
}
}
}
return foundTokenSecret && foundDockercfgSecret
}
func secretsWatchFunc(c *client.Client, ns string) func(options api.ListOptions) (watch.Interface, error) {
return func(options api.ListOptions) (watch.Interface, error) {
return c.Secrets(ns).Watch(options)
}
}
func secretsListFunc(c *client.Client, ns string) func(api.ListOptions) (runtime.Object, error) {
return func(opts api.ListOptions) (runtime.Object, error) {
return c.Secrets(ns).List(opts)
}
}
// create secrets for the server
secret := api.Secret{
TypeMeta: unversioned.TypeMeta{
Kind: "Secret",
APIVersion: "v1",
},
ObjectMeta: api.ObjectMeta{
Name: config.prefix + "-secret",
},
Data: map[string][]byte{
// from test/images/volumes-tester/rbd/keyring
"key": []byte("AQDRrKNVbEevChAAEmRC+pW/KBVHxa0w/POILA=="),
},
}
secClient := c.Secrets(config.namespace)
defer func() {
if clean {
secClient.Delete(config.prefix + "-secret")
}
}()
if _, err := secClient.Create(&secret); err != nil {
framework.Failf("Failed to create secrets for Ceph RBD: %v", err)
}
volume := api.VolumeSource{
RBD: &api.RBDVolumeSource{
CephMonitors: []string{serverIP},
RBDPool: "rbd",
// create secrets for the server
secret := api.Secret{
TypeMeta: api.TypeMeta{
Kind: "Secret",
APIVersion: "v1",
},
ObjectMeta: api.ObjectMeta{
Name: config.prefix + "-secret",
},
Data: map[string][]byte{
// from test/images/volumes-tester/rbd/keyring
"key": []byte("AQDRrKNVbEevChAAEmRC+pW/KBVHxa0w/POILA=="),
},
}
secClient := c.Secrets(config.namespace)
defer func() {
if clean {
secClient.Delete(config.prefix + "-secret")
}
}()
if _, err := secClient.Create(&secret); err != nil {
Failf("Failed to create secrets for Ceph RBD: %v", err)
}
volume := api.VolumeSource{
RBD: &api.RBDVolumeSource{
CephMonitors: []string{serverIP},
RBDPool: "rbd",
func build(
conf *Config,
storageDriver storagedriver.StorageDriver,
kubeClient *client.Client,
fs sys.FS,
env sys.Env,
builderKey,
rawGitSha string) error {
dockerBuilderImagePullPolicy, err := k8s.PullPolicyFromString(conf.DockerBuilderImagePullPolicy)
if err != nil {
return err
}
slugBuilderImagePullPolicy, err := k8s.PullPolicyFromString(conf.SlugBuilderImagePullPolicy)
if err != nil {
return err
}
repo := conf.Repository
gitSha, err := git.NewSha(rawGitSha)
if err != nil {
return err
}
appName := conf.App()
repoDir := filepath.Join(conf.GitHome, repo)
buildDir := filepath.Join(repoDir, "build")
slugName := fmt.Sprintf("%s:git-%s", appName, gitSha.Short())
if err := os.MkdirAll(buildDir, os.ModeDir); err != nil {
return fmt.Errorf("making the build directory %s (%s)", buildDir, err)
}
tmpDir, err := ioutil.TempDir(buildDir, "tmp")
if err != nil {
return fmt.Errorf("unable to create tmpdir %s (%s)", buildDir, err)
}
defer func() {
if err := os.RemoveAll(tmpDir); err != nil {
log.Info("unable to remove tmpdir %s (%s)", tmpDir, err)
}
}()
client, err := controller.New(conf.ControllerHost, conf.ControllerPort)
if err != nil {
return err
}
// Get the application config from the controller, so we can check for a custom buildpack URL
appConf, err := hooks.GetAppConfig(client, conf.Username, appName)
if controller.CheckAPICompat(client, err) != nil {
return err
}
log.Debug("got the following config back for app %s: %+v", appName, appConf)
var buildPackURL string
if buildPackURLInterface, ok := appConf.Values["BUILDPACK_URL"]; ok {
if bpStr, ok := buildPackURLInterface.(string); ok {
log.Debug("found custom buildpack URL %s", bpStr)
buildPackURL = bpStr
}
}
_, disableCaching := appConf.Values["DEIS_DISABLE_CACHE"]
slugBuilderInfo := NewSlugBuilderInfo(appName, gitSha.Short(), disableCaching)
if slugBuilderInfo.DisableCaching() {
log.Debug("caching disabled for app %s", appName)
// If cache file exists, delete it
if _, err := storageDriver.Stat(context.Background(), slugBuilderInfo.CacheKey()); err == nil {
log.Debug("deleting cache %s for app %s", slugBuilderInfo.CacheKey(), appName)
if err := storageDriver.Delete(context.Background(), slugBuilderInfo.CacheKey()); err != nil {
return err
}
}
}
// build a tarball from the new objects
appTgz := fmt.Sprintf("%s.tar.gz", appName)
gitArchiveCmd := repoCmd(repoDir, "git", "archive", "--format=tar.gz", fmt.Sprintf("--output=%s", appTgz), gitSha.Short())
gitArchiveCmd.Stdout = os.Stdout
gitArchiveCmd.Stderr = os.Stderr
if err := run(gitArchiveCmd); err != nil {
return fmt.Errorf("running %s (%s)", strings.Join(gitArchiveCmd.Args, " "), err)
}
absAppTgz := fmt.Sprintf("%s/%s", repoDir, appTgz)
// untar the archive into the temp dir
tarCmd := repoCmd(repoDir, "tar", "-xzf", appTgz, "-C", fmt.Sprintf("%s/", tmpDir))
tarCmd.Stdout = os.Stdout
tarCmd.Stderr = os.Stderr
if err := run(tarCmd); err != nil {
return fmt.Errorf("running %s (%s)", strings.Join(tarCmd.Args, " "), err)
}
bType := getBuildTypeForDir(tmpDir)
usingDockerfile := bType == buildTypeDockerfile
appTgzdata, err := ioutil.ReadFile(absAppTgz)
if err != nil {
return fmt.Errorf("error while reading file %s: (%s)", appTgz, err)
}
log.Debug("Uploading tar to %s", slugBuilderInfo.TarKey())
if err := storageDriver.PutContent(context.Background(), slugBuilderInfo.TarKey(), appTgzdata); err != nil {
return fmt.Errorf("uploading %s to %s (%v)", absAppTgz, slugBuilderInfo.TarKey(), err)
}
var pod *api.Pod
var buildPodName string
image := appName
if usingDockerfile {
buildPodName = dockerBuilderPodName(appName, gitSha.Short())
registryLocation := conf.RegistryLocation
registryEnv := make(map[string]string)
if registryLocation != "on-cluster" {
registryEnv, err = getRegistryDetails(kubeClient, &image, registryLocation, conf.PodNamespace, conf.RegistrySecretPrefix)
if err != nil {
return fmt.Errorf("error getting private registry details %s", err)
}
image = image + ":git-" + gitSha.Short()
}
registryEnv["DEIS_REGISTRY_PROXY_PORT"] = conf.RegistryProxyPort
registryEnv["DEIS_REGISTRY_LOCATION"] = registryLocation
pod = dockerBuilderPod(
conf.Debug,
buildPodName,
conf.PodNamespace,
appConf.Values,
slugBuilderInfo.TarKey(),
gitSha.Short(),
slugName,
conf.StorageType,
conf.DockerBuilderImage,
conf.RegistryHost,
conf.RegistryPort,
registryEnv,
dockerBuilderImagePullPolicy,
)
} else {
buildPodName = slugBuilderPodName(appName, gitSha.Short())
cacheKey := ""
if !slugBuilderInfo.DisableCaching() {
cacheKey = slugBuilderInfo.CacheKey()
}
envSecretName := fmt.Sprintf("%s-build-env", appName)
err = createAppEnvConfigSecret(kubeClient.Secrets(conf.PodNamespace), envSecretName, appConf.Values)
if err != nil {
return fmt.Errorf("error creating/updating secret %s: (%s)", envSecretName, err)
}
defer func() {
if err := kubeClient.Secrets(conf.PodNamespace).Delete(envSecretName); err != nil {
log.Info("unable to delete secret %s (%s)", envSecretName, err)
}
}()
pod = slugbuilderPod(
conf.Debug,
buildPodName,
conf.PodNamespace,
envSecretName,
slugBuilderInfo.TarKey(),
slugBuilderInfo.PushKey(),
cacheKey,
gitSha.Short(),
buildPackURL,
conf.StorageType,
conf.SlugBuilderImage,
slugBuilderImagePullPolicy,
)
}
log.Info("Starting build... but first, coffee!")
log.Debug("Starting pod %s", buildPodName)
json, err := prettyPrintJSON(pod)
if err == nil {
log.Debug("Pod spec: %v", json)
} else {
log.Debug("Error creating json representaion of pod spec: %v", err)
}
podsInterface := kubeClient.Pods(conf.PodNamespace)
newPod, err := podsInterface.Create(pod)
if err != nil {
return fmt.Errorf("creating builder pod (%s)", err)
}
pw := k8s.NewPodWatcher(kubeClient, "deis")
stopCh := make(chan struct{})
defer close(stopCh)
go pw.Controller.Run(stopCh)
if err := waitForPod(pw, newPod.Namespace, newPod.Name, conf.SessionIdleInterval(), conf.BuilderPodTickDuration(), conf.BuilderPodWaitDuration()); err != nil {
return fmt.Errorf("watching events for builder pod startup (%s)", err)
}
req := kubeClient.Get().Namespace(newPod.Namespace).Name(newPod.Name).Resource("pods").SubResource("log").VersionedParams(
&api.PodLogOptions{
Follow: true,
}, api.ParameterCodec)
rc, err := req.Stream()
if err != nil {
return fmt.Errorf("attempting to stream logs (%s)", err)
}
defer rc.Close()
size, err := io.Copy(os.Stdout, rc)
if err != nil {
return fmt.Errorf("fetching builder logs (%s)", err)
}
log.Debug("size of streamed logs %v", size)
log.Debug(
"Waiting for the %s/%s pod to end. Checking every %s for %s",
newPod.Namespace,
newPod.Name,
conf.BuilderPodTickDuration(),
conf.BuilderPodWaitDuration(),
)
// check the state and exit code of the build pod.
// if the code is not 0 return error
if err := waitForPodEnd(pw, newPod.Namespace, newPod.Name, conf.BuilderPodTickDuration(), conf.BuilderPodWaitDuration()); err != nil {
return fmt.Errorf("error getting builder pod status (%s)", err)
}
log.Debug("Done")
log.Debug("Checking for builder pod exit code")
buildPod, err := kubeClient.Pods(newPod.Namespace).Get(newPod.Name)
if err != nil {
return fmt.Errorf("error getting builder pod status (%s)", err)
}
for _, containerStatus := range buildPod.Status.ContainerStatuses {
state := containerStatus.State.Terminated
if state.ExitCode != 0 {
return fmt.Errorf("Build pod exited with code %d, stopping build.", state.ExitCode)
}
}
log.Debug("Done")
procType := deisAPI.ProcessType{}
if procType, err = getProcFile(storageDriver, tmpDir, slugBuilderInfo.AbsoluteProcfileKey(), bType); err != nil {
return err
}
log.Info("Build complete.")
quit := progress("...", conf.SessionIdleInterval())
log.Info("Launching App...")
if !usingDockerfile {
image = slugBuilderInfo.AbsoluteSlugObjectKey()
}
release, err := hooks.CreateBuild(client, conf.Username, conf.App(), image, gitSha.Short(), procType, usingDockerfile)
quit <- true
<-quit
if controller.CheckAPICompat(client, err) != nil {
return fmt.Errorf("The controller returned an error when publishing the release: %s", err)
}
log.Info("Done, %s:v%d deployed to Workflow\n", appName, release)
log.Info("Use 'deis open' to view this application in your browser\n")
log.Info("To learn more, use 'deis help' or visit https://deis.com/\n")
run(repoCmd(repoDir, "git", "gc"))
return nil
}
func deleteSecretOrErrorf(t *testing.T, c *client.Client, ns, name string) {
if err := c.Secrets(ns).Delete(name); err != nil {
t.Errorf("unable to delete secret %v: %v", name, err)
}
}
// DoTestSecrets test secrets for one api version.
func DoTestSecrets(t *testing.T, client *client.Client, ns *api.Namespace) {
// Make a secret object.
s := api.Secret{
ObjectMeta: api.ObjectMeta{
Name: "secret",
Namespace: ns.Name,
},
Data: map[string][]byte{
"data": []byte("value1\n"),
},
}
if _, err := client.Secrets(s.Namespace).Create(&s); err != nil {
t.Errorf("unable to create test secret: %v", err)
}
defer deleteSecretOrErrorf(t, client, s.Namespace, s.Name)
// Template for pods that use a secret.
pod := &api.Pod{
ObjectMeta: api.ObjectMeta{
Name: "XXX",
Namespace: ns.Name,
},
Spec: api.PodSpec{
Volumes: []api.Volume{
{
Name: "secvol",
VolumeSource: api.VolumeSource{
Secret: &api.SecretVolumeSource{
SecretName: "secret",
},
},
},
},
Containers: []api.Container{
{
Name: "fake-name",
Image: "fakeimage",
VolumeMounts: []api.VolumeMount{
{
Name: "secvol",
MountPath: "/fake/path",
ReadOnly: true,
},
},
},
},
},
}
// Create a pod to consume secret.
pod.ObjectMeta.Name = "uses-secret"
if _, err := client.Pods(ns.Name).Create(pod); err != nil {
t.Errorf("Failed to create pod: %v", err)
}
defer deletePodOrErrorf(t, client, ns.Name, pod.Name)
// Create a pod that consumes non-existent secret.
pod.ObjectMeta.Name = "uses-non-existent-secret"
if _, err := client.Pods(ns.Name).Create(pod); err != nil {
t.Errorf("Failed to create pod: %v", err)
}
defer deletePodOrErrorf(t, client, ns.Name, pod.Name)
// This pod may fail to run, but we don't currently prevent this, and this
// test can't check whether the kubelet actually pulls the secret.
// Verifying contents of the volumes is out of scope for a
// apiserver<->kubelet integration test. It is covered by an e2e test.
}
func createSecret(c *k8sclient.Client, f *cmdutil.Factory, flags *flag.FlagSet, secretDataIdentifiers string, secretType string, keysNames []string) (Result, error) {
var secret = secret(secretDataIdentifiers, secretType, keysNames, flags)
ns, _, err := f.DefaultNamespace()
if err != nil {
return Failure, err
}
rs, err := c.Secrets(ns).Create(&secret)
if rs != nil {
return Success, err
}
return Failure, err
}