fix ci script

.woodpecker.yml

@@ -15,14 +15,13 @@ steps:
       - event: [push, tag]
 
   deploy:
-    image: portainer/kubectl-shell:latest
-    secrets:
-      - source: kube_config
-        target: KUBE_CONFIG_CONTENT
-      - source: encryption_key
-        target: ENCRYPTION_KEY
-      - source: secrets_checksum
-        target: MD5_CHECKSUM
+    image: quay.io/wollud1969/k8s-admin-helper:0.1.3
+    environment:
+      KUBE_CONFIG_CONTENT:
+        from_secret: kube_config
+      GPG_PASSPHRASE:
+        from_secret: gpg_passphrase
+      HOME: /home/user
     commands:
       - export IMAGE_TAG=$CI_COMMIT_TAG
       - printf "$KUBE_CONFIG_CONTENT" > /tmp/kubeconfig

Dockerfile

@@ -13,6 +13,7 @@ USER $NB_USER
 RUN \
   conda update -y -n base conda && \
   pip install psycopg && \
+  pip install plotly && \
   conda install -y pandas-datareader && \
   fix-permissions $CONDA_DIR && \
   fix-permissions /home/$NB_USER 

deployment/decrypt-secrets.sh

@@ -1,43 +0,0 @@
-#!/bin/bash
-
-if [ "$ENCRYPTION_KEY" = "" ]; then
-  echo "ENCRYPTION_KEY not set"
-  exit 1
-fi
-
-if [ "$MD5_CHECKSUM" = "" ]; then
-  echo "No checksum given"
-  exit 1
-fi
-
-SECRETS_CIPHERTEXT_FILE=secrets.enc
-SECRETS_PLAINTEXT_FILE=/tmp/secrets
-TMP_FILE=`mktemp`
-POD_NAME_SUFFIX=`date +%s`
-
-cat $SECRETS_CIPHERTEXT_FILE | \
-  kubectl run openssl-$POD_NAME_SUFFIX \
-    --rm \
-    --image bitnami/debian-base-buildpack:latest \
-    --env KEY=$ENCRYPTION_KEY \
-    -i \
-    -q \
-    -- \
-    /bin/sh -c "openssl enc -aes-256-cbc -salt -pass env:KEY -a -d" > \
-    $TMP_FILE
-
-if [ `uname` = "Darwin" ]; then
-  CALCULATED_CHECKSUM=`cat $TMP_FILE | md5`
-elif [ `uname` = "Linux" ]; then
-  CALCULATED_CHECKSUM=`cat $TMP_FILE | md5sum - | awk '{print $1}'`
-fi
-
-if [ "$MD5_CHECKSUM" != "$CALCULATED_CHECKSUM" ]; then
-  echo "Invalid checksum"
-  exit 1
-fi
-
-# cat $TMP_FILE
-mv $TMP_FILE $SECRETS_PLAINTEXT_FILE
-
-

deployment/deploy-yml.tmpl

@@ -19,6 +19,8 @@ metadata:
   name: traefik-forward-auth
   labels:
     app: traefik-forward-auth
+  annotations:
+    secret.reloader.stakater.com/reload: traefik-forward-auth
 spec:
   replicas: 1
   selector:
@@ -144,6 +146,18 @@ spec:
       - X-Forwarded-User
 
 ---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: jupyter-workspace
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-client
+  resources:
+    requests:
+      storage: 100Mi
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -169,6 +183,17 @@ spec:
           env:
             - name: JUPYTER_PORT
               value: "8888"
+          envFrom:
+            - secretRef:
+                name: jupyter
+          volumeMounts:
+            - mountPath: /home/jovyan/work
+              name: work
+      volumes:
+        - name: work
+          persistentVolumeClaim:
+            claimName: jupyter-workspace
+
 ---
 apiVersion: v1
 kind: Service

deployment/deploy.sh

@@ -4,16 +4,23 @@ if [ "$IMAGE_TAG" == "" ]; then
   echo "Make sure IMAGE_TAG is set"
   exit 1
 fi
-
+if [ "$GPG_PASSPHRASE" == "" ]; then
+  echo "Make sure GPG_PASSPHRASE is set"
+  exit 1
+fi
 
 IMAGE_NAME=gitea.hottis.de/wn/jupyter-scipy-database-extension
 NAMESPACE=jupyter
 DEPLOYMENT_DIR=$PWD/deployment
 
 pushd $DEPLOYMENT_DIR > /dev/null
-./decrypt-secrets.sh || exit 1 
-. /tmp/secrets
-rm /tmp/secrets
+SECRETS_FILE=`mktemp`
+pwd
+id
+echo $HOME
+gpg --decrypt --passphrase $GPG_PASSPHRASE --yes --batch --output $SECRETS_FILE secrets.asc
+. $SECRETS_FILE
+rm $SECRETS_FILE
 
 kubectl create namespace $NAMESPACE \
   --dry-run=client \
@@ -28,6 +35,15 @@ kubectl create secret generic traefik-forward-auth \
   --from-literal=SECRET="$SECRET" | \
   kubectl apply -f - -n $NAMESPACE
 
+kubectl create secret generic jupyter \
+  --dry-run=client \
+  -o yaml \
+  --save-config \
+  --from-literal=PGHOST="$PGHOST" | \
+  --from-literal=PGUSER="$PGUSER" | \
+  --from-literal=PGPASSWORD="$PGPASSWORD" | \
+  --from-literal=PGSSLMODE="$PGSSLMODE" | \
+  kubectl apply -f - -n $NAMESPACE
 
 cat $DEPLOYMENT_DIR/deploy-yml.tmpl | \
   sed -e 's,%IMAGE%,'$IMAGE_NAME':'$IMAGE_TAG','g | \

deployment/encrypt-secrets.sh

@@ -1,28 +0,0 @@
-#!/bin/bash
-
-
-ENCRYPTION_KEY=`openssl rand -hex 32`
-echo $ENCRYPTION_KEY
-
-SECRETS_PLAINTEXT_FILE=secrets.txt
-SECRETS_CIPHERTEXT_FILE=secrets.enc
-
-if [ `uname` = "Darwin" ]; then
-  cat $SECRETS_PLAINTEXT_FILE | md5
-elif [ `uname` = "Linux" ]; then
-  cat $SECRETS_PLAINTEXT_FILE | md5sum - | awk '{print $1}'
-fi
-
-POD_NAME_SUFFIX=`date +%s`
-
-cat $SECRETS_PLAINTEXT_FILE | \
-  kubectl run openssl-$POD_NAME_SUFFIX \
-    --rm \
-    --image bitnami/debian-base-buildpack:latest \
-    --env KEY=$ENCRYPTION_KEY \
-    -i \
-    -q \
-    -- \
-    /bin/sh -c "openssl enc -aes-256-cbc -salt -pass env:KEY -a" > \
-    $SECRETS_CIPHERTEXT_FILE
-

deployment/secrets.asc

@@ -0,0 +1,10 @@
+-----BEGIN PGP MESSAGE-----
+
+jA0ECQMIDcQyZABQeUf80sBKAQqlG05S05vOpXgoo7dj3iuiAXzOXA+M49yRAJwO
+2T4OhVeEeUAkrzWNWtarDh8K6FJMS9wxhU6PkoJmry3+krIN+IvGGiMvRaxekB2F
+xS6hA4eSH0GIKf7bzYSBekuyI0PuIXWozy4u8cK17mguPjWml3pp7niRmhDlSHyA
+S8RBgiYCuVE4xk9jmJUPosHbDDpzuNb46iYQQdL7XGTVuASB7sujptgmn+ZJrs3i
+kS6Qzkc6eCd6aDqqNwcynwzIi1e/jBk/zihEEY7qYPcU2Wsw0y9QqFRFR7F3WGUz
+8MNv4bnC60awXzO9O3FTxe1JrkWN+V+q25iElLm2rpUUaPTNjyehnAmK0ho=
+=/vom
+-----END PGP MESSAGE-----

deployment/secrets.enc

@@ -1,3 +0,0 @@
-U2FsdGVkX1+ieFWR0PfwpZvaYyk9EzC6noAzAyjeRxrX4UDdQ5cIE1Rdtymt/eo5
-acU7SqzyrCRaJyCvAgqrqbNCn3qgL+PENLZbcyT8115MlIVSmMfkBXhN6Mc1KMOo
-todGAfQ9twY/tsuoxwTeb621IBiq4XwhRPMI1+xsoNk=