Deploy the preflight agent

Signed-off-by: Richard Wall <[email protected]>

Author: wallrj

README.md

@@ -27,19 +27,22 @@ docker pull quay.io/jetstack/cert-manager-controller:v1.1.0
 docker pull quay.io/jetstack/cert-manager-cainjector:v1.1.0
 docker pull quay.io/jetstack/cert-manager-webhook:v1.1.0
 docker pull quay.io/jetstack/cert-manager-google-cas-issuer:0.1.0
-docker tag quay.io/jetstack/cert-manager-controller:v1.1.0 $REGISTRY/$APP_NAME/cert-manager-controller:1.1.0
-docker tag quay.io/jetstack/cert-manager-cainjector:v1.1.0 $REGISTRY/$APP_NAME/cert-manager-cainjector:1.1.0
-docker tag quay.io/jetstack/cert-manager-webhook:v1.1.0 $REGISTRY/$APP_NAME/cert-manager-webhook:1.1.0
-docker tag quay.io/jetstack/cert-manager-google-cas-issuer:latest $REGISTRY/$APP_NAME/cert-manager-google-cas-issuer:0.1.0
-docker push $REGISTRY/$APP_NAME/cert-manager-controller:1.1.0
-docker push $REGISTRY/$APP_NAME/cert-manager-cainjector:1.1.0
-docker push $REGISTRY/$APP_NAME/cert-manager-webhook:1.1.0
-docker push $REGISTRY/$APP_NAME/cert-manager-google-cas-issuer:0.1.0
+docker pull quay.io/jetstack/preflight:0.1.27
+docker tag quay.io/jetstack/cert-manager-controller:v1.1.0 $REGISTRY/$APP_NAME/cert-manager-controller:1.0.0
+docker tag quay.io/jetstack/cert-manager-cainjector:v1.1.0 $REGISTRY/$APP_NAME/cert-manager-cainjector:1.0.0
+docker tag quay.io/jetstack/cert-manager-webhook:v1.1.0 $REGISTRY/$APP_NAME/cert-manager-webhook:1.0.0
+docker tag quay.io/jetstack/cert-manager-google-cas-issuer:latest $REGISTRY/$APP_NAME/cert-manager-google-cas-issuer:1.0.0
+docker tag quay.io/jetstack/preflight:latest $REGISTRY/$APP_NAME/cert-manager-preflight:1.0.0
+docker push $REGISTRY/$APP_NAME/cert-manager-controller:1.0.0
+docker push $REGISTRY/$APP_NAME/cert-manager-cainjector:1.0.0
+docker push $REGISTRY/$APP_NAME/cert-manager-webhook:1.0.0
+docker push $REGISTRY/$APP_NAME/cert-manager-google-cas-issuer:1.0.0
+docker push $REGISTRY/$APP_NAME/cert-manager-preflight:1.0.0
 ```
 
-> Note: although cert-manager's tags are of the form "v1.1.0", we chose to
-> use tags of the form "1.1.0" for the Google Marketplace for the sake of
-> consistency.
+> Note: although cert-manager's tags are of the form "v1.1.0", we 
+> use the same JSP version tag for all the Google Marketplace images, 
+> for consistency with other marketplace packages.
 
 Then, build and push the deployer image:
 

chart/jetstacksecure-mp/Chart.yaml

@@ -10,3 +10,6 @@ dependencies:
   - name: google-cas-issuer
     appVersion: 0.1.0
     repository: ./charts/google-cas-issuer
+  - name: preflight
+    appVersion: 0.1.27
+    repository: ../preflight

chart/jetstacksecure-mp/values.yaml

@@ -22,3 +22,9 @@ google-cas-issuer:
   installCRDs: true
   serviceAccount:
     create: false # see note (1)
+
+preflight:
+  serviceAccount:
+    create: false # see note (1)
+  rbac:
+    create: false # see note (1)

cloudbuild.yaml

@@ -6,7 +6,32 @@ substitutions:
   _APP_VERSION: 1.0.0
   _CERT_MANAGER_VERSION: 1.1.0
   _CAS_ISSUER_VERSION: 0.1.0
+  _PREFLIGHT_VERSION: 0.1.27
 steps:
+  - id: pull-preflight
+    name: gcr.io/cloud-builders/docker
+    args:
+      - pull
+      - quay.io/jetstack/preflight:v${_PREFLIGHT_VERSION}
+    waitFor: ["-"]
+
+  - id: tag-preflight
+    name: gcr.io/cloud-builders/docker
+    args:
+      - tag
+      - quay.io/jetstack/preflight:v${_PREFLIGHT_VERSION}
+      - gcr.io/$PROJECT_ID/${_SOLUTION_NAME}/cert-manager-preflight:${_APP_VERSION}
+    waitFor:
+      - pull-preflight
+
+  - id: push-preflight
+    name: gcr.io/cloud-builders/docker
+    args:
+      - push
+      - gcr.io/$PROJECT_ID/${_SOLUTION_NAME}/cert-manager-preflight:${_APP_VERSION}
+    waitFor:
+      - tag-preflight
+
   - id: pull-cas-issuer
     name: gcr.io/cloud-builders/docker
     args:
@@ -192,6 +217,7 @@ steps:
       - push-cainjector
       - push-webhook
       - push-cas-issuer
+      - push-preflight
 
   - id: publish
     name: gcr.io/cloud-marketplace-tools/k8s/dev
@@ -212,4 +238,5 @@ images:
   - gcr.io/$PROJECT_ID/${_SOLUTION_NAME}/cert-manager-cainjector:${_APP_VERSION}
   - gcr.io/$PROJECT_ID/${_SOLUTION_NAME}/cert-manager-webhook:${_APP_VERSION}
   - gcr.io/$PROJECT_ID/${_SOLUTION_NAME}/cert-manager-google-cas-issuer:${_APP_VERSION}
+  - gcr.io/$PROJECT_ID/${_SOLUTION_NAME}/cert-manager-preflight:${_APP_VERSION}
   - gcr.io/$PROJECT_ID/${_SOLUTION_NAME}/deployer:${_APP_VERSION}

schema.yaml

@@ -50,6 +50,12 @@ x-google-marketplace:
           type: REPO_WITH_REGISTRY
         google-cas-issuer.image.tag:
           type: TAG
+    cert-manager-preflight:
+      properties:
+        preflight.image.repository:
+          type: REPO_WITH_REGISTRY
+        preflight.image.tag:
+          type: TAG
 
   # Allow the deployer to create CRDs and webhook configurations
   # See https://github.com/GoogleCloudPlatform/marketplace-k8s-app-tools/blob/master/docs/schema.md#deployerserviceaccount
@@ -302,6 +308,52 @@ properties:
                 resources: [certificaterequests/status]
                 verbs: [get, patch, update]
 
+  preflight.serviceAccount.name:
+    type: string
+    x-google-marketplace:
+      type: SERVICE_ACCOUNT
+      serviceAccount:
+        description: Service account used by preflight
+        roles:
+          - type: ClusterRole
+            rulesType: CUSTOM
+            rules:
+              - apiGroups: [""]
+                resources: ["nodes"]
+                verbs: ["get", "list"]
+          - type: ClusterRole
+            rulesType: CUSTOM
+            rules:
+              - apiGroups: [""]
+                resources: ["secrets"]
+                verbs: ["get", "list"]
+          - type: ClusterRole
+            rulesType: CUSTOM
+            rules:
+              - apiGroups: ["cert-manager.io"]
+                resources:
+                - certificates
+                - certificaterequests
+                - issuers
+                - clusterissuers
+                verbs: ["get", "list"]
+          - type: ClusterRole
+            rulesType: CUSTOM
+            rules:
+              - apiGroups: ["cas-issuer.jetstack.io"]
+                resources:
+                - googlecasissuers
+                - googlecasclusterissuers
+                verbs: ["get", "list"]
+          - type: ClusterRole
+            rulesType: CUSTOM
+            rules:
+              - apiGroups: ["admissionregistration.k8s.io"]
+                resources:
+                - validatingwebhookconfigurations
+                - mutatingwebhookconfigurations
+                verbs: ["get", "list"]
+
 required:
   - name
   - namespace