Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tf/k8s-infra-prow-build: add ExternalSecrets #2858

Merged
merged 2 commits into from
Sep 30, 2021
Merged

tf/k8s-infra-prow-build: add ExternalSecrets #2858

merged 2 commits into from
Sep 30, 2021

Conversation

spiffxp
Copy link
Member

@spiffxp spiffxp commented Sep 30, 2021 •
edited
Loading

Related:

Turns out the k8s secret has two fields: ssh-private and ssh-public, so we'll instead make a GSM secret per field

I populated the GSM secrets, and have added ExternalSecret CRDs to sync the values back to the Kubernetes secrets

@spiffxp
tf/k8s-infra-prow-build: redo prow-build-ssh-key-secret
39504cd 
Turns out the k8s secret has two fields: ssh-private and ssh-public, so
we'll instead make a GSM secret per field
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Sep 30, 2021
@spiffxp
Copy link
Member Author

spiffxp commented Sep 30, 2021

I have already run terraform apply

@k8s-ci-robot k8s-ci-robot added the area/infra Infrastructure management, infrastructure design, code in infra/ label Sep 30, 2021
@k8s-ci-robot k8s-ci-robot added area/prow Setting up or working with prow in general, prow.k8s.io, prow build clusters approved Indicates a PR has been approved by an approver from all required OWNERS files. area/terraform Terraform modules, testing them, writing more of them, code in infra/gcp/clusters/ sig/k8s-infra Categorizes an issue or PR as relevant to SIG K8s Infra. sig/testing Categorizes an issue or PR as relevant to SIG Testing. labels Sep 30, 2021
@spiffxp spiffxp changed the title tf/k8s-infra-prow-build: redo prow-build-ssh-key-secret tf/k8s-infra-prow-build: add ExternalSecrets Sep 30, 2021
@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Sep 30, 2021
@spiffxp spiffxp mentioned this pull request Sep 30, 2021
Closed
30 tasks
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 30, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chaodaiG, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot merged commit d5ce046 into kubernetes:main Sep 30, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.23 milestone Sep 30, 2021
@spiffxp spiffxp deleted the redo-prow-build-ssh-key-secret branch September 30, 2021 14:39
@spiffxp
Copy link
Member Author

spiffxp commented Sep 30, 2021

This appears to have caused kubernetes/kubernetes#105381

@spiffxp
Copy link
Member Author

spiffxp commented Sep 30, 2021 

I0930 16:46:54.902] Failure Finished Test Suite on Host 
I0930 16:46:54.903] unable to create gce instance with running docker daemon for image cos-81-12871-1317-1.  instance tmp-node-e2e-abe2f419-cos-81-12871-1317-1 not running docker/containerd/crio daemon - Command failed: load pubkey "/workspace/.ssh/google_compute_engine": invalid format
I0930 16:46:54.903] Load key "/workspace/.ssh/google_compute_engine": invalid format
I0930 16:46:54.903] [email protected]: Permission denied (publickey).
I0930 16:46:54.903]

@spiffxp
Copy link
Member Author

spiffxp commented Sep 30, 2021

Found a test pod running a node-e2e job

spiffxp@spiffxp-macbookpro:~$ k --context=prow-build -n test-pods exec 436ec7fb-220f-11ec-9d33-e61a535a6f12 -- /bin/bash -c "cat /workspace/.ssh/google_compute_engine" | tail -n1
-----END OPENSSH PRIVATE KEY-----spiffxp@spiffxp-macbookpro:~$

I think that should have an extra newline at the end of it

Updated secret value for prow-build-ssh-key-secret-ssh-private

@spiffxp
Copy link
Member Author

spiffxp commented Sep 30, 2021

There's now a newline at the end of the the private key

$ k --context=prow-build -n test-pods get secret ssh-key-secret -o=json | jq -r '.data["ssh-private"]' | base64 -d | tail -n1
-----END OPENSSH PRIVATE KEY-----
$

@spiffxp spiffxp mentioned this pull request Sep 30, 2021
Closed
@spiffxp
Copy link
Member Author

spiffxp commented Sep 30, 2021

I'll post future updates over in kubernetes/kubernetes#105381

@spiffxp spiffxp mentioned this pull request Oct 1, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@chaodaiG chaodaiG chaodaiG approved these changes

@jeremyrickard jeremyrickard Awaiting requested review from jeremyrickard

Assignees

@chaodaiG chaodaiG

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/infra Infrastructure management, infrastructure design, code in infra/ area/prow Setting up or working with prow in general, prow.k8s.io, prow build clusters area/terraform Terraform modules, testing them, writing more of them, code in infra/gcp/clusters/ cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/k8s-infra Categorizes an issue or PR as relevant to SIG K8s Infra. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
v1.23
Development

Successfully merging this pull request may close these issues.
3 participants
@spiffxp @k8s-ci-robot @chaodaiG