installer

#!/usr/bin/env bash

# Copyright 2021-2024 The Tekton Authors
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#     http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# dashboard flavour
READONLY="true"

# configuration default values
DEBUG="false"
INSTALLER_ONLY="false"
INSTALL_NAMESPACE="tekton-pipelines"
PIPELINES_NAMESPACE="tekton-pipelines"
TRIGGERS_NAMESPACE="tekton-pipelines"
EXTENSIONS_RBAC="false"
LOGOUT_URL=""
LOG_LEVEL="info"
LOG_FORMAT="json"
DEFAULT_NAMESPACE=""
TENANT_NAMESPACES=""
STREAM_LOGS="true"
EXTERNAL_LOGS=""
BASE_RELEASE_URL="https://storage.googleapis.com/tekton-releases/dashboard"

# additional options passed to ko resolve
KO_RESOLVE_OPTIONS="--image-label=org.opencontainers.image.source=https://github.com/tektoncd/dashboard"
PLATFORM=""

# Display a box banner.
# Parameters: $1 - character to use for the box.
#             $2 - banner message.
make_banner() {
    local msg="$1$1$1$1 WARNING: $2 $1$1$1$1"
    local border="${msg//[-0-9A-Za-z _.,:\/()]/$1}"
    echo -e "\n${border}\n${msg}\n${border}\n"
}

# Simple warning banner for logging purposes.
warning() {
  make_banner "!" "$1"
}

initOS() {
  OS=$(echo `uname`|tr '[:upper:]' '[:lower:]')

  case "$OS" in
    # Minimalist GNU for Windows
    mingw*)
      OS='windows'
      ;;
    darwin*)
      ARCH=$(uname -m)
      if [ "$ARCH" == "arm64" ] && [ -z "$PLATFORM" ]; then
        debug "Detected Apple M1 and no custom platform specified"
        PLATFORM="--platform linux/arm64"
      fi
      ;;
  esac

  debug "Detected OS: $OS"
}

verifySupported() {
  if ( [ "$ACTION" == "install" ] || [ "$ACTION" == "uninstall" ] ) && ! type "kubectl" > /dev/null 2>&1; then
    echo "kubectl is required"
    exit 1
  fi

  if [ -z "$DASHBOARD_VERSION" ] && ! type "kustomize" > /dev/null 2>&1; then
    echo "kustomize is required"
    exit 1
  fi

  if [ -z "$DASHBOARD_VERSION" ] && ! type "ko" > /dev/null 2>&1; then
    echo "ko is required"
    exit 1
  fi

  if ! type "sed" > /dev/null 2>&1; then
    echo "sed is required"
    exit 1
  fi

  if ! type "curl" > /dev/null 2>&1 && ! type "wget" > /dev/null 2>&1; then
    echo "Either curl or wget is required"
    exit 1
  fi
}

debug() {
  local message=$1

  if [ "$DEBUG" == "true" ]; then
    echo $message
  fi
}

bootstrapFromInstallerManifest() {
  debug "Copying input file $INPUT_FILE -> $TMP_FILE …"
  cp "$INPUT_FILE" $TMP_FILE
}

compile() {
  debug "Building config …"
  kustomize build --load-restrictor LoadRestrictionsNone config | ko resolve $KO_RESOLVE_OPTIONS $PLATFORM -f - > "$TMP_FILE"
}

download() {
  if [ $DASHBOARD_VERSION == "latest" ]; then
    local url="$BASE_RELEASE_URL/latest/installer-"
  else
    local url="$BASE_RELEASE_URL/previous/$DASHBOARD_VERSION/installer-"
  fi

  url="${url}release.yaml"

  debug "Downloading $url -> $TMP_FILE …"

  if type "curl" > /dev/null 2>&1; then
    curl -s "$url" -o "$TMP_FILE"
  elif type "wget" > /dev/null 2>&1; then
    wget -q -O "$TMP_FILE" "$url"
  fi
}

setup() {
  if [ ! -z "$OVERRIDE_NAMESPACE" ]; then
    INSTALL_NAMESPACE="$OVERRIDE_NAMESPACE"
  fi

  if [ ! -z "$OVERRIDE_PIPELINES_NAMESPACE" ]; then
    PIPELINES_NAMESPACE="$OVERRIDE_PIPELINES_NAMESPACE"
  fi

  if [ ! -z "$OVERRIDE_TRIGGERS_NAMESPACE" ]; then
    TRIGGERS_NAMESPACE="$OVERRIDE_TRIGGERS_NAMESPACE"
  fi
}

replace() {
  local src=$1
  local dest=$2

  debug "REPLACE $src -> $dest"

  if [ "$OS" == "darwin" ]; then
    sed -i "" "s~$src~$dest~g" $TMP_FILE
  else
    sed -i "s~$src~$dest~g" $TMP_FILE
  fi
}

patch() {
  replace "--pipelines-namespace=--pipelines-namespace" "--pipelines-namespace=$PIPELINES_NAMESPACE"
  replace "--triggers-namespace=--triggers-namespace" "--triggers-namespace=$TRIGGERS_NAMESPACE"
  replace "--log-level=--log-level" "--log-level=$LOG_LEVEL"
  replace "--log-format=--log-format" "--log-format=$LOG_FORMAT"
  replace "--logout-url=--logout-url" "--logout-url=$LOGOUT_URL"
  replace "--read-only=--read-only" "--read-only=$READONLY"
  replace "--default-namespace=--default-namespace" "--default-namespace=$DEFAULT_NAMESPACE"
  replace "--namespaces=--tenant-namespaces" "--namespaces=$TENANT_NAMESPACES"
  replace "--stream-logs=--stream-logs" "--stream-logs=$STREAM_LOGS"
  replace "--external-logs=--external-logs" "--external-logs=$EXTERNAL_LOGS"
  replace "namespace: tekton-dashboard" "namespace: $INSTALL_NAMESPACE"
}

role_binding() {
  local bindingName=$1
  local roleName=$2
  local namespace=$3

cat <<EOF >> $TMP_FILE
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: dashboard
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-dashboard
    rbac.dashboard.tekton.dev/subject: tekton-dashboard
  name: $bindingName
  namespace: $namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: $roleName
subjects:
  - kind: ServiceAccount
    name: tekton-dashboard
    namespace: $INSTALL_NAMESPACE
EOF
}

cluster_role_binding() {
  local bindingName=$1
  local roleName=$2

cat <<EOF >> $TMP_FILE
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: dashboard
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-dashboard
    rbac.dashboard.tekton.dev/subject: tekton-dashboard
  name: $bindingName
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: $roleName
subjects:
  - kind: ServiceAccount
    name: tekton-dashboard
    namespace: $INSTALL_NAMESPACE
EOF
}

rbac() {
if [ "$EXTENSIONS_RBAC" == "true" ]; then
cat <<EOF >> $TMP_FILE
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tekton-dashboard-extensions
  labels:
    app.kubernetes.io/component: dashboard
    app.kubernetes.io/instance: default
    app.kubernetes.io/part-of: tekton-dashboard
aggregationRule:
  clusterRoleSelectors:
    - matchLabels:
        rbac.dashboard.tekton.dev/aggregate-to-dashboard: 'true'
EOF
fi

  # Use ClusterRoles defined by Pipelines and Triggers to ensure we stay in
  # sync with resources supported by the deployed versions.
  # `tekton-aggregate-*` are the ClusterRoles for Tekton Pipelines
  if [ ! -z "$TENANT_NAMESPACES" ]; then
    IFS=','
    for namespace in ${TENANT_NAMESPACES}; do
      role_binding tekton-dashboard-tenant-view tekton-dashboard-tenant-view $namespace
      role_binding tekton-dashboard-pipelines-view tekton-aggregate-view $namespace
      role_binding tekton-dashboard-triggers-view tekton-triggers-aggregate-view $namespace

      if [ "$READONLY" == "false" ]; then
        role_binding tekton-dashboard-backend-edit tekton-dashboard-backend-edit $namespace
        role_binding tekton-dashboard-pipelines-edit tekton-aggregate-edit $namespace
        role_binding tekton-dashboard-triggers-edit tekton-triggers-aggregate-edit $namespace
      fi

      if [ "$EXTENSIONS_RBAC" == "true" ]; then
        role_binding tekton-dashboard-extensions tekton-dashboard-extensions $namespace
      fi
    done
    unset IFS
  else
    cluster_role_binding tekton-dashboard-tenant-view tekton-dashboard-tenant-view
    cluster_role_binding tekton-dashboard-pipelines-view tekton-aggregate-view
    cluster_role_binding tekton-dashboard-triggers-view tekton-triggers-aggregate-view

    if [ "$READONLY" == "false" ]; then
      cluster_role_binding tekton-dashboard-backend-edit tekton-dashboard-backend-edit
      cluster_role_binding tekton-dashboard-pipelines-edit tekton-aggregate-edit
      cluster_role_binding tekton-dashboard-triggers-edit tekton-triggers-aggregate-edit
    fi

    if [ "$EXTENSIONS_RBAC" == "true" ]; then
      cluster_role_binding tekton-dashboard-extensions tekton-dashboard-extensions
    fi
  fi
}

ingress() {
INGRESS_DEFAULT_CLASS_NAME_CONFIG=""
if [ "$INGRESS_DEFAULT_CLASS" == "true" ]; then
INGRESS_DEFAULT_CLASS_NAME_CONFIG="ingressClassName: nginx"
cat <<EOF >> $TMP_FILE
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  labels:
    app.kubernetes.io/component: controller
  name: nginx
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"
spec:
  controller: k8s.io/ingress-nginx
EOF
fi

if [ ! -z "$INGRESS_URL" ] && [ ! -z "$INGRESS_SECRET" ]; then
cat <<EOF >> $TMP_FILE
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tekton-dashboard
  namespace: $INSTALL_NAMESPACE
spec:
  $INGRESS_DEFAULT_CLASS_NAME_CONFIG
  tls:
  - hosts:
    - $INGRESS_URL
    secretName: $INGRESS_SECRET
  rules:
  - host: $INGRESS_URL
    http:
      paths:
      - pathType: ImplementationSpecific
        backend:
          service:
            name: tekton-dashboard
            port:
              number: 9097
EOF
elif [ ! -z "$INGRESS_URL" ]; then
cat <<EOF >> $TMP_FILE
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tekton-dashboard
  namespace: $INSTALL_NAMESPACE
spec:
  $INGRESS_DEFAULT_CLASS_NAME_CONFIG
  rules:
  - host: $INGRESS_URL
    http:
      paths:
      - pathType: ImplementationSpecific
        backend:
          service:
            name: tekton-dashboard
            port:
              number: 9097
EOF
fi
}

# install invokes kubectl apply with the built manifest.
install() {
  echo "Installing …"
  kubectl create ns $INSTALL_NAMESPACE > /dev/null 2>&1 || true
  kubectl apply -f $TMP_FILE
}

uninstall() {
  echo "Uninstalling …"
  resourceKinds=(
    "deployments.apps"
    "serviceaccounts"
    "services"
    "customresourcedefinitions.apiextensions.k8s.io"
    "clusterrolebindings.rbac.authorization.k8s.io"
    "clusterroles.rbac.authorization.k8s.io"
    "rolebindings.rbac.authorization.k8s.io"
    "roles.rbac.authorization.k8s.io"
  )
  for resourceKind in "${resourceKinds[@]}";do
    echo "Deleting ${resourceKind}"
    kubectl delete ${resourceKind} --ignore-not-found -l=app.kubernetes.io/instance=default,app.kubernetes.io/part-of=tekton-dashboard --all-namespaces
  done
}

additionalResources() {
  COMBINED_FILE=${TMP_FILE}.tmp
  cat /dev/null > $COMBINED_FILE
  if [ "$READONLY" == "false" ]; then
    cat ./config/100-namespace.yaml > $COMBINED_FILE
    echo '---' >> $COMBINED_FILE
  fi
  cat $TMP_FILE >> $COMBINED_FILE
  mv $COMBINED_FILE $TMP_FILE
}

build() {
  if [ -z "$OUTPUT_FILE" ]; then
    cat $TMP_FILE
  else
    cat $TMP_FILE > $OUTPUT_FILE
  fi
}

# fail_trap is executed if an error occurs.
fail_trap() {
  result=$?
  cleanup
  exit $result
}

# help provides possible cli installation arguments
help () {
  echo -e "Global command syntax:"
  echo -e "\tinstaller COMMAND [OPTIONS]"
  echo -e ""
  echo -e "Accepted commands:"
  echo -e "\thelp|h\t\t\t\t\tPrints this help"
  echo -e "\tinstall|i\t\t\t\tInstalls the dashboard"
  echo -e "\tuninstall|u\t\t\t\tUninstalls the dashboard"
  echo -e "\tbuild|b\t\t\t\t\tBuilds the manifests and dashboard docker image"
  echo -e ""
  echo -e "Accepted options:"
  echo -e "\t[--debug]\t\t\t\tPrints additional messages in the console"
  echo -e "\t[--extensions-rbac]\t\t\tEnable ClusterRole aggregation for easier management of extensions RBAC"
  echo -e "\t[--external-logs <logs-provider-url>]\tExternal URL from which to fetch logs when logs are not available in the cluster"
  echo -e "\t[--ingress-secret <secret>]\t\tWill add SSL support to the ingress"
  echo -e "\t[--ingress-url <url>]\t\t\tWill create an additional ingress with the specified URL"
  echo -e "\t[--log-format <log-format>]\t\tSpecifies the log format (json or console), default is json"
  echo -e "\t[--log-level <log-level>]\t\tSpecifies the log level (debug, info, warn, error, dpanic, panic, fatal), default is info"
  echo -e "\t[--logout-url <logout-url>]\t\tWill set up the logout URL"
  echo -e "\t[--namespace <namespace>]\t\tWill override install namespace"
  echo -e "\t[--nightly]\t\t\t\tWill download manifests from the nightly releases channel"
  echo -e "\t[--output <file>]\t\t\tWill output built manifests in the file instead of in the console"
  echo -e "\t[--pipelines-namespace <namespace>]\tOverride the namespace where Tekton Pipelines is installed (defaults to Dashboard install namespace)"
  echo -e "\t[--platform <platform>]\t\t\tOverride the platform to build for"
  echo -e "\t[--read-write]\t\t\t\tWill build manifests for a read/write deployment"
  echo -e "\t[--stream-logs false]\t\t\tWill disable log streaming and use polling instead"
  echo -e "\t[--tag <tag>]\t\t\t\tTag used for the image produced by ko"
  echo -e "\t[--tenant-namespaces <namespaces>]\tWill limit the visibility to the specified comma-separated namespaces only"
  echo -e "\t[--triggers-namespace <namespace>]\tOverride the namespace where Tekton Triggers is installed (defaults to Dashboard install namespace)"
  echo -e "\t[--version <version>]\t\t\tWill download manifests for specified version or build everything using kustomize/ko"
}

# cleanup temporary files
cleanup() {
  if [[ -d "${TMP_ROOT:-}" ]]; then
    rm -rf "$TMP_ROOT"
  fi
}

# Execution

#Stop execution on any error
trap "fail_trap" EXIT

set -e

# Parsing command
case $1 in
  'help'|h)
    help
    exit 0
    ;;
  'install'|i)
    ACTION="install"
    shift
    ;;
  'uninstall'|u)
    uninstall
    exit 0
    ;;
  'build'|b)
    ACTION="build"
    shift
    ;;
  *)
    ACTION="build"
    ;;
esac

set -u

# Parsing options (if any)

while [[ $# -gt 0 ]]; do
  case $1 in
    '--debug')
      DEBUG="true"
      ;;
    '--default-namespace')
      shift
      DEFAULT_NAMESPACE="${1}"
      ;;
    '--extensions-rbac')
      EXTENSIONS_RBAC="true"
      ;;
    '--external-logs')
      shift
      EXTERNAL_LOGS="${1}"
      ;;
    '--ingress-default-class')
      INGRESS_DEFAULT_CLASS="true"
      ;;
    '--ingress-secret')
      shift
      INGRESS_SECRET="${1}"
      ;;
    '--ingress-url')
      shift
      INGRESS_URL="${1}"
      ;;
    '--input')
      shift
      INPUT_FILE="${1}"
      if [ ! -f "$INPUT_FILE" ]; then
        echo "ERROR: input file not found"
        exit 1
      fi
      ;;
    '--installer-only')
      INSTALLER_ONLY="true"
      ;;
    '--log-format')
      shift
      LOG_FORMAT="${1}"
      ;;
    '--log-level')
      shift
      LOG_LEVEL="${1}"
      ;;
    '--logout-url')
      shift
      LOGOUT_URL="${1}"
      ;;
    '--namespace')
      shift
      OVERRIDE_NAMESPACE="${1}"
      ;;
    '--nightly')
      BASE_RELEASE_URL="https://storage.googleapis.com/tekton-releases-nightly/dashboard"
      ;;
    '--output')
      shift
      OUTPUT_FILE="${1}"
      ;;
    '--pipelines-namespace')
      shift
      OVERRIDE_PIPELINES_NAMESPACE="${1}"
      ;;
    '--platform')
      shift
      PLATFORM="--platform ${1}"
      ;;
    '--preserve-import-paths')
      KO_RESOLVE_OPTIONS="$KO_RESOLVE_OPTIONS --preserve-import-paths"
      ;;
    '--read-write')
      READONLY="false"
      ;;
    '--stream-logs')
      shift
      STREAM_LOGS="${1}"
      ;;
    '--tag')
      shift
      KO_RESOLVE_OPTIONS="$KO_RESOLVE_OPTIONS -t ${1}"
      ;;
    '--tenant-namespaces')
      shift
      TENANT_NAMESPACES="${1}"
      ;;
    '--triggers-namespace')
      shift
      OVERRIDE_TRIGGERS_NAMESPACE="${1}"
      ;;
    '--version')
      shift
      DASHBOARD_VERSION="${1}"
      ;;
    *)
      echo "ERROR: Unknown option $1"
      help
      exit 1
      ;;
  esac
  shift
done

set +u

TMP_ROOT="$(mktemp -dt tekton-dashboard-installer.XXXXXX)"
TMP_FILE="$TMP_ROOT/manifest.yaml"

initOS
verifySupported
setup
if [ ! -z "$INPUT_FILE" ]; then
  bootstrapFromInstallerManifest
elif [ ! -z "$DASHBOARD_VERSION" ]; then
  download
else
  compile
fi
if [ "$INSTALLER_ONLY" == "false" ]; then
  patch
  rbac
  ingress
fi
additionalResources
eval $ACTION
cleanup