Skip to content

Commit 5275ada

Browse files
sebglsebgl
committed
Merge branch 'master' into merge-master
2 parents c0194f6 + 51c4be8 commit 5275ada

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+1441
-285
lines changed

‎.ci/jobs/gke-e2e-versions.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,10 @@
88
artifactNumToKeep: 10
99
name: cloud-on-k8s-versions-gke
1010
project-type: pipeline
11-
triggers:
12-
- timed: '0 0 * * 1-5'
11+
parameters:
12+
- string:
13+
name: IMAGE
14+
description: "Docker image with ECK"
1315
pipeline-scm:
1416
scm:
1517
- git:

‎build/ci/Makefile

Lines changed: 9 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ VAULT_GKE_CREDS_SECRET ?= secret/cloud-team/cloud-ci/ci-gcp-k8s-operator
1111
GKE_CREDS_FILE ?= credentials.json
1212
VAULT_PUBLIC_KEY ?= secret/release/license
1313
PUBLIC_KEY_FILE ?= license.key
14-
VAULT_DOCKER_CREDENTIALS ?= secret/cloud-team/cloud-ci/cloudadmin
14+
VAULT_DOCKER_CREDENTIALS ?= secret/devops-ci/cloud-on-k8s/eckadmin
1515
DOCKER_CREDENTIALS_FILE ?= docker_credentials.file
1616
VAULT_AWS_CREDS ?= secret/cloud-team/cloud-ci/eck-release
1717
VAULT_AWS_ACCESS_KEY_FILE ?= aws_access_key.file
@@ -48,7 +48,7 @@ vault-docker-creds:
4848
@ VAULT_TOKEN=$(VAULT_TOKEN) \
4949
vault read \
5050
-address=$(VAULT_ADDR) \
51-
-field=password \
51+
-field=value \
5252
$(VAULT_DOCKER_CREDENTIALS) \
5353
> $(DOCKER_CREDENTIALS_FILE)
5454

@@ -71,7 +71,7 @@ vault-aws-creds:
7171

7272
ci-pr: check-license-header
7373
docker build -f Dockerfile -t cloud-on-k8s-ci-pr .
74-
docker run --rm -t \
74+
@ docker run --rm -t \
7575
-v /var/run/docker.sock:/var/run/docker.sock \
7676
-v $(ROOT_DIR):$(GO_MOUNT_PATH) \
7777
-w $(GO_MOUNT_PATH) \
@@ -86,7 +86,7 @@ ci-pr: check-license-header
8686

8787
ci-release: vault-public-key vault-docker-creds
8888
docker build -f Dockerfile -t cloud-on-k8s-ci-release .
89-
docker run --rm -t \
89+
@ docker run --rm -t \
9090
-v /var/run/docker.sock:/var/run/docker.sock \
9191
-v $(ROOT_DIR):$(GO_MOUNT_PATH) \
9292
-w $(GO_MOUNT_PATH) \
@@ -105,7 +105,7 @@ ci-release: vault-public-key vault-docker-creds
105105
# Will be uploaded to https://download.elastic.co/downloads/eck/$TAG_NAME/all-in-one.yaml
106106
yaml-upload: vault-aws-creds
107107
docker build -f Dockerfile -t cloud-on-k8s-ci-release .
108-
docker run --rm -t \
108+
@ docker run --rm -t \
109109
-v $(ROOT_DIR):$(GO_MOUNT_PATH) \
110110
-w $(GO_MOUNT_PATH) \
111111
-e "AWS_ACCESS_KEY_ID=$(shell cat $(VAULT_AWS_ACCESS_KEY_FILE))" \
@@ -119,7 +119,7 @@ yaml-upload: vault-aws-creds
119119
# Spawn a k8s cluster, and run e2e tests against it
120120
ci-e2e: vault-gke-creds
121121
docker build -f Dockerfile -t cloud-on-k8s-ci-e2e .
122-
docker run --rm -t \
122+
@ docker run --rm -t \
123123
-v /var/run/docker.sock:/var/run/docker.sock \
124124
-v $(ROOT_DIR):$(GO_MOUNT_PATH) \
125125
-w $(GO_MOUNT_PATH) \
@@ -137,7 +137,7 @@ ci-e2e: vault-gke-creds
137137
# Run e2e tests in GKE against provided ECK image
138138
ci-e2e-rc: vault-gke-creds
139139
docker build -f Dockerfile -t cloud-on-k8s-ci-e2e .
140-
docker run --rm -t \
140+
@ docker run --rm -t \
141141
-v /var/run/docker.sock:/var/run/docker.sock \
142142
-v $(ROOT_DIR):$(GO_MOUNT_PATH) \
143143
-w $(GO_MOUNT_PATH) \
@@ -156,7 +156,7 @@ ci-e2e-rc: vault-gke-creds
156156
# Remove k8s cluster
157157
ci-e2e-delete-cluster: vault-gke-creds
158158
docker build -f Dockerfile -t cloud-on-k8s-ci-e2e .
159-
docker run --rm -t \
159+
@ docker run --rm -t \
160160
-v /var/run/docker.sock:/var/run/docker.sock \
161161
-v $(ROOT_DIR):$(GO_MOUNT_PATH) \
162162
-w $(GO_MOUNT_PATH) \
@@ -168,7 +168,7 @@ ci-e2e-delete-cluster: vault-gke-creds
168168

169169
# Remove all unused resources in GKE
170170
ci-gke-cleanup: ci-e2e-delete-cluster
171-
docker run --rm -t \
171+
@ docker run --rm -t \
172172
-v $(ROOT_DIR):$(GO_MOUNT_PATH) \
173173
-w $(GO_MOUNT_PATH) \
174174
-e "GCLOUD_PROJECT=$(GCLOUD_PROJECT)" \
@@ -177,12 +177,3 @@ ci-gke-cleanup: ci-e2e-delete-cluster
177177
cloud-on-k8s-ci-e2e \
178178
bash -c "GKE_CLUSTER_VERSION=1.11 $(GO_MOUNT_PATH)/operators/hack/gke-cluster.sh auth && \
179179
$(GO_MOUNT_PATH)/build/ci/delete_unused_disks.py"
180-
181-
# Run docs build
182-
ci-build-docs:
183-
docker run --rm -t \
184-
-v $(ROOT_DIR):$(GO_MOUNT_PATH) \
185-
docker.elastic.co/docs/build:1 \
186-
bash -c "git clone https://github.com/elastic/docs.git && \
187-
/docs/build_docs.pl --doc $(GO_MOUNT_PATH)/docs/index.asciidoc --out $(GO_MOUNT_PATH)/docs/html --chunk 1 && \
188-
test -e $(GO_MOUNT_PATH)/docs/html/index.html"

‎build/ci/e2e/GKE_k8s_versions.jenkinsfile

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ pipeline {
1414
VAULT_SECRET_ID = credentials('vault-secret-id')
1515
REGISTRY = "eu.gcr.io"
1616
GCLOUD_PROJECT = credentials('k8s-operators-gcloud-project')
17+
OPERATOR_IMAGE = "${IMAGE}"
18+
LATEST_RELEASED_IMG = "${IMAGE}"
1719
}
1820

1921
stages {
@@ -26,7 +28,7 @@ pipeline {
2628
}
2729
steps {
2830
checkout scm
29-
sh 'make -C build/ci ci-e2e'
31+
sh 'make -C build/ci ci-e2e-rc'
3032
}
3133
}
3234
stage("1.12") {
@@ -39,7 +41,7 @@ pipeline {
3941
}
4042
steps {
4143
checkout scm
42-
sh 'make -C build/ci ci-e2e'
44+
sh 'make -C build/ci ci-e2e-rc'
4345
}
4446
}
4547
stage("1.13") {
@@ -52,7 +54,7 @@ pipeline {
5254
}
5355
steps {
5456
checkout scm
55-
sh 'make -C build/ci ci-e2e'
57+
sh 'make -C build/ci ci-e2e-rc'
5658
}
5759
}
5860
}

‎build/ci/nightly/Jenkinsfile

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
pipeline {
2+
3+
agent {
4+
label 'linux'
5+
}
6+
7+
options {
8+
timeout(time: 1, unit: 'HOURS')
9+
}
10+
11+
environment {
12+
VAULT_ADDR = credentials('vault-addr')
13+
VAULT_ROLE_ID = credentials('vault-role-id')
14+
VAULT_SECRET_ID = credentials('vault-secret-id')
15+
GCLOUD_PROJECT = credentials('k8s-operators-gcloud-project')
16+
REGISTRY = "push.docker.elastic.co"
17+
REPOSITORY = "eck-snapshots"
18+
IMG_NAME = "eck-operator"
19+
SNAPSHOT = "true"
20+
DOCKER_IMAGE_NO_TAG = "docker.elastic.co/${REPOSITORY}/${IMG_NAME}"
21+
}
22+
23+
stages {
24+
stage('Run unit and integration tests') {
25+
steps {
26+
sh 'make -C build/ci ci-pr'
27+
}
28+
}
29+
stage('Build and push Docker image') {
30+
steps {
31+
sh """
32+
export VERSION=\$(cat $WORKSPACE/operators/VERSION)-\$(date +%F)-\$(git rev-parse --short --verify HEAD)
33+
export OPERATOR_IMAGE=${REGISTRY}/${REPOSITORY}/${IMG_NAME}:\$VERSION
34+
make -C build/ci ci-release
35+
"""
36+
}
37+
}
38+
}
39+
40+
post {
41+
success {
42+
script {
43+
def version = sh(returnStdout: true, script: 'cat $WORKSPACE/operators/VERSION')
44+
def hash = sh(returnStdout: true, script: 'git rev-parse --short --verify HEAD')
45+
def date = new Date()
46+
def image = env.DOCKER_IMAGE_NO_TAG + ":" + version + "-" + date.format("yyyy-MM-dd") + "-" + hash
47+
currentBuild.description = image
48+
49+
build job: 'cloud-on-k8s-versions-gke',
50+
parameters: [string(name: 'IMAGE', value: image)],
51+
wait: false
52+
}
53+
}
54+
cleanup {
55+
cleanWs()
56+
}
57+
}
58+
59+
}

‎build/ci/pr/Jenkinsfile

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,16 @@ pipeline {
3838
}
3939
stage("Run docs build") {
4040
steps {
41-
checkout scm
42-
sh 'make -C build/ci ci-build-docs'
41+
cleanWs()
42+
sh 'git clone [email protected]:elastic/docs.git'
43+
sh 'git clone [email protected]:elastic/cloud-on-k8s.git'
44+
sh """
45+
$WORKSPACE/docs/build_docs \
46+
--doc $WORKSPACE/cloud-on-k8s/docs/index.asciidoc \
47+
--out $WORKSPACE/cloud-on-k8s/docs/html \
48+
--chunk 1
49+
"""
50+
sh 'test -e $WORKSPACE/cloud-on-k8s/docs/html/index.html'
4351
}
4452
}
4553
stage("Run smoke E2E tests") {
@@ -61,17 +69,6 @@ pipeline {
6169
}
6270

6371
post {
64-
success {
65-
withEnv([
66-
'REGISTRY=push.docker.elastic.co',
67-
'REPOSITORY=eck-snapshots',
68-
'IMG_SUFFIX=',
69-
'SNAPSHOT_RELEASE=true',
70-
'TAG_NAME=${ghprbPullId}'
71-
]) {
72-
sh 'make -C build/ci ci-release'
73-
}
74-
}
7572
cleanup {
7673
script {
7774
if (notOnlyDocs()) {

‎docs/accessing-services.asciidoc

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ To access Elasticsearch, Kibana or APM Server, the operator manages a default us
2525

2626
[source,sh]
2727
----
28-
> kubectl get secret hulk-elastic-user -o go-template='{{.data.elastic | base64decode }}'
28+
> kubectl get secret hulk-es-elastic-user -o go-template='{{.data.elastic | base64decode }}'
2929
42xyz42citsale42xyz42
3030
----
3131

@@ -46,6 +46,7 @@ For each resource, `Elasticsearch`, `Kibana` or `ApmServer`, the operator manage
4646
> kubectl get svc
4747
4848
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
49+
hulk-apm-http ClusterIP 10.19.212.105 <none> 8200:31000/TCP 1m
4950
hulk-es-http ClusterIP 10.19.252.160 <none> 9200:31320/TCP 1m
5051
hulk-kb-http ClusterIP 10.19.247.151 <none> 5601:31380/TCP 1m
5152
----
@@ -76,6 +77,7 @@ spec:
7677
> kubectl get svc
7778
7879
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
80+
hulk-apm-http ClusterIP 10.19.212.105 35.176.227.106 8200:31000/TCP 1m
7981
hulk-es-http LoadBalancer 10.19.252.160 35.198.131.115 9200:31320/TCP 1m
8082
hulk-kb-http LoadBalancer 10.19.247.151 35.242.197.228 5601:31380/TCP 1m
8183
----
@@ -141,8 +143,9 @@ spec:
141143
You can bring your own certificate to configure TLS to ensure that communication between HTTP clients and the cluster is encrypted.
142144

143145
Create a Kubernetes secret with:
144-
. tls.crt: the certificate (or a chain).
145-
. tls.key: the private key to the first certificate in the certificate chain.
146+
147+
- tls.crt: the certificate (or a chain).
148+
- tls.key: the private key to the first certificate in the certificate chain.
146149

147150
[source,sh]
148151
----
@@ -160,6 +163,23 @@ spec:
160163
secretName: my-cert
161164
----
162165

166+
[float]
167+
[id="{p}-disable-tls"]
168+
==== Disable TLS
169+
170+
You can explicitly disable TLS for Kibana or APM Server if you want to.
171+
172+
[source,yaml]
173+
----
174+
spec:
175+
http:
176+
tls:
177+
selfSignedCertificate:
178+
disabled: true
179+
----
180+
181+
TLS cannot be disabled for Elasticsearch.
182+
163183
[float]
164184
[id="{p}-request-elasticsearch-endpoint"]
165185
=== Requesting the Elasticsearch endpoint
@@ -178,7 +198,7 @@ NAME=hulk
178198
kubectl get secret "$NAME-ca" -o go-template='{{index .data "ca.pem" | base64decode }}' > ca.pem
179199
PW=$(kubectl get secret "$NAME-elastic-user" -o go-template='{{.data.elastic | base64decode }}')
180200
181-
curl --cacert ca.pem -u elastic:$PW https://$NAME-es:9200/
201+
curl --cacert ca.pem -u elastic:$PW https://$NAME-es-http:9200/
182202
----
183203

184204
*Outside the Kubernetes cluster*
@@ -191,11 +211,11 @@ curl --cacert ca.pem -u elastic:$PW https://$NAME-es:9200/
191211
----
192212
NAME=hulk
193213
194-
kubectl get secret "$NAME-ca" -o go-template='{{index .data "ca.pem" | base64decode }}' > ca.pem
195-
IP=$(kubectl get svc "$NAME-es" -o jsonpath='{.status.loadBalancer.ingress[].ip}')
196-
PW=$(kubectl get secret "$NAME-elastic-user" -o go-template='{{.data.elastic | base64decode }}')
214+
kubectl get secret "$NAME-es-http-certs-public" -o go-template='{{index .data "tls.crt" | base64decode }}' > tls.crt
215+
IP=$(kubectl get svc "$NAME-es-http" -o jsonpath='{.status.loadBalancer.ingress[].ip}')
216+
PW=$(kubectl get secret "$NAME-es-elastic-user" -o go-template='{{.data.elastic | base64decode }}')
197217
198-
curl --cacert ca.pem -u elastic:$PW https://$IP:9200/
218+
curl --cacert tls.crt -u elastic:$PW https://$IP:9200/
199219
----
200220

201221
Now you should get this message:

0 commit comments

Comments
 (0)