Compare commits
13 Commits
Author | SHA1 | Date | |
---|---|---|---|
08097450de
|
|||
08a5536690
|
|||
0d6187bd30
|
|||
ddbc71d3a6
|
|||
fa50208978
|
|||
654ba5abf9
|
|||
55803d3a5c
|
|||
f46f7b06d1
|
|||
8af7497bad
|
|||
87bb67365a
|
|||
fcdf97a9fa
|
|||
7483095d5f
|
|||
e2e497270d
|
@ -15,14 +15,12 @@ steps:
|
|||||||
- event: [push, tag]
|
- event: [push, tag]
|
||||||
|
|
||||||
deploy:
|
deploy:
|
||||||
image: portainer/kubectl-shell:latest
|
image: quay.io/wollud1969/k8s-admin-helper:0.1.3
|
||||||
secrets:
|
environment:
|
||||||
- source: kube_config
|
KUBE_CONFIG_CONTENT:
|
||||||
target: KUBE_CONFIG_CONTENT
|
from_secret: kube_config
|
||||||
- source: encryption_key
|
GPG_PASSPHRASE:
|
||||||
target: ENCRYPTION_KEY
|
from_secret: gpg_passphrase
|
||||||
- source: secrets_checksum
|
|
||||||
target: MD5_CHECKSUM
|
|
||||||
commands:
|
commands:
|
||||||
- export IMAGE_TAG=$CI_COMMIT_TAG
|
- export IMAGE_TAG=$CI_COMMIT_TAG
|
||||||
- printf "$KUBE_CONFIG_CONTENT" > /tmp/kubeconfig
|
- printf "$KUBE_CONFIG_CONTENT" > /tmp/kubeconfig
|
||||||
|
@ -13,6 +13,7 @@ USER $NB_USER
|
|||||||
RUN \
|
RUN \
|
||||||
conda update -y -n base conda && \
|
conda update -y -n base conda && \
|
||||||
pip install psycopg && \
|
pip install psycopg && \
|
||||||
|
pip install plotly && \
|
||||||
conda install -y pandas-datareader && \
|
conda install -y pandas-datareader && \
|
||||||
fix-permissions $CONDA_DIR && \
|
fix-permissions $CONDA_DIR && \
|
||||||
fix-permissions /home/$NB_USER
|
fix-permissions /home/$NB_USER
|
||||||
|
@ -1,43 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
if [ "$ENCRYPTION_KEY" = "" ]; then
|
|
||||||
echo "ENCRYPTION_KEY not set"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$MD5_CHECKSUM" = "" ]; then
|
|
||||||
echo "No checksum given"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
SECRETS_CIPHERTEXT_FILE=secrets.enc
|
|
||||||
SECRETS_PLAINTEXT_FILE=/tmp/secrets
|
|
||||||
TMP_FILE=`mktemp`
|
|
||||||
POD_NAME_SUFFIX=`date +%s`
|
|
||||||
|
|
||||||
cat $SECRETS_CIPHERTEXT_FILE | \
|
|
||||||
kubectl run openssl-$POD_NAME_SUFFIX \
|
|
||||||
--rm \
|
|
||||||
--image bitnami/debian-base-buildpack:latest \
|
|
||||||
--env KEY=$ENCRYPTION_KEY \
|
|
||||||
-i \
|
|
||||||
-q \
|
|
||||||
-- \
|
|
||||||
/bin/sh -c "openssl enc -aes-256-cbc -salt -pass env:KEY -a -d" > \
|
|
||||||
$TMP_FILE
|
|
||||||
|
|
||||||
if [ `uname` = "Darwin" ]; then
|
|
||||||
CALCULATED_CHECKSUM=`cat $TMP_FILE | md5`
|
|
||||||
elif [ `uname` = "Linux" ]; then
|
|
||||||
CALCULATED_CHECKSUM=`cat $TMP_FILE | md5sum - | awk '{print $1}'`
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$MD5_CHECKSUM" != "$CALCULATED_CHECKSUM" ]; then
|
|
||||||
echo "Invalid checksum"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# cat $TMP_FILE
|
|
||||||
mv $TMP_FILE $SECRETS_PLAINTEXT_FILE
|
|
||||||
|
|
||||||
|
|
@ -146,6 +146,18 @@ spec:
|
|||||||
- X-Forwarded-User
|
- X-Forwarded-User
|
||||||
|
|
||||||
---
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: jupyter-workspace
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
storageClassName: nfs-client
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 100Mi
|
||||||
|
---
|
||||||
apiVersion: apps/v1
|
apiVersion: apps/v1
|
||||||
kind: Deployment
|
kind: Deployment
|
||||||
metadata:
|
metadata:
|
||||||
@ -171,6 +183,17 @@ spec:
|
|||||||
env:
|
env:
|
||||||
- name: JUPYTER_PORT
|
- name: JUPYTER_PORT
|
||||||
value: "8888"
|
value: "8888"
|
||||||
|
envFrom:
|
||||||
|
- secretRef:
|
||||||
|
name: jupyter
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /home/jovyan/work
|
||||||
|
name: work
|
||||||
|
volumes:
|
||||||
|
- name: work
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: jupyter-workspace
|
||||||
|
|
||||||
---
|
---
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Service
|
kind: Service
|
||||||
|
@ -4,16 +4,23 @@ if [ "$IMAGE_TAG" == "" ]; then
|
|||||||
echo "Make sure IMAGE_TAG is set"
|
echo "Make sure IMAGE_TAG is set"
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
if [ "$GPG_PASSPHRASE" == "" ]; then
|
||||||
|
echo "Make sure GPG_PASSPHRASE is set"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
IMAGE_NAME=gitea.hottis.de/wn/jupyter-scipy-database-extension
|
IMAGE_NAME=gitea.hottis.de/wn/jupyter-scipy-database-extension
|
||||||
NAMESPACE=jupyter
|
NAMESPACE=jupyter
|
||||||
DEPLOYMENT_DIR=$PWD/deployment
|
DEPLOYMENT_DIR=$PWD/deployment
|
||||||
|
|
||||||
pushd $DEPLOYMENT_DIR > /dev/null
|
pushd $DEPLOYMENT_DIR > /dev/null
|
||||||
./decrypt-secrets.sh || exit 1
|
SECRETS_FILE=`mktemp`
|
||||||
. /tmp/secrets
|
pwd
|
||||||
rm /tmp/secrets
|
id
|
||||||
|
echo $HOME
|
||||||
|
gpg --decrypt --passphrase $GPG_PASSPHRASE --yes --batch --homedir /tmp/.gnupg --output $SECRETS_FILE secrets.asc
|
||||||
|
. $SECRETS_FILE
|
||||||
|
rm $SECRETS_FILE
|
||||||
|
|
||||||
kubectl create namespace $NAMESPACE \
|
kubectl create namespace $NAMESPACE \
|
||||||
--dry-run=client \
|
--dry-run=client \
|
||||||
@ -28,6 +35,15 @@ kubectl create secret generic traefik-forward-auth \
|
|||||||
--from-literal=SECRET="$SECRET" | \
|
--from-literal=SECRET="$SECRET" | \
|
||||||
kubectl apply -f - -n $NAMESPACE
|
kubectl apply -f - -n $NAMESPACE
|
||||||
|
|
||||||
|
kubectl create secret generic jupyter \
|
||||||
|
--dry-run=client \
|
||||||
|
-o yaml \
|
||||||
|
--save-config \
|
||||||
|
--from-literal=PGHOST="$PGHOST" \
|
||||||
|
--from-literal=PGUSER="$PGUSER" \
|
||||||
|
--from-literal=PGPASSWORD="$PGPASSWORD" \
|
||||||
|
--from-literal=PGSSLMODE="$PGSSLMODE" | \
|
||||||
|
kubectl apply -f - -n $NAMESPACE
|
||||||
|
|
||||||
cat $DEPLOYMENT_DIR/deploy-yml.tmpl | \
|
cat $DEPLOYMENT_DIR/deploy-yml.tmpl | \
|
||||||
sed -e 's,%IMAGE%,'$IMAGE_NAME':'$IMAGE_TAG','g | \
|
sed -e 's,%IMAGE%,'$IMAGE_NAME':'$IMAGE_TAG','g | \
|
||||||
|
@ -1,28 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
|
|
||||||
ENCRYPTION_KEY=`openssl rand -hex 32`
|
|
||||||
echo $ENCRYPTION_KEY
|
|
||||||
|
|
||||||
SECRETS_PLAINTEXT_FILE=secrets.txt
|
|
||||||
SECRETS_CIPHERTEXT_FILE=secrets.enc
|
|
||||||
|
|
||||||
if [ `uname` = "Darwin" ]; then
|
|
||||||
cat $SECRETS_PLAINTEXT_FILE | md5
|
|
||||||
elif [ `uname` = "Linux" ]; then
|
|
||||||
cat $SECRETS_PLAINTEXT_FILE | md5sum - | awk '{print $1}'
|
|
||||||
fi
|
|
||||||
|
|
||||||
POD_NAME_SUFFIX=`date +%s`
|
|
||||||
|
|
||||||
cat $SECRETS_PLAINTEXT_FILE | \
|
|
||||||
kubectl run openssl-$POD_NAME_SUFFIX \
|
|
||||||
--rm \
|
|
||||||
--image bitnami/debian-base-buildpack:latest \
|
|
||||||
--env KEY=$ENCRYPTION_KEY \
|
|
||||||
-i \
|
|
||||||
-q \
|
|
||||||
-- \
|
|
||||||
/bin/sh -c "openssl enc -aes-256-cbc -salt -pass env:KEY -a" > \
|
|
||||||
$SECRETS_CIPHERTEXT_FILE
|
|
||||||
|
|
10
deployment/secrets.asc
Normal file
10
deployment/secrets.asc
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
jA0ECQMIDcQyZABQeUf80sBKAQqlG05S05vOpXgoo7dj3iuiAXzOXA+M49yRAJwO
|
||||||
|
2T4OhVeEeUAkrzWNWtarDh8K6FJMS9wxhU6PkoJmry3+krIN+IvGGiMvRaxekB2F
|
||||||
|
xS6hA4eSH0GIKf7bzYSBekuyI0PuIXWozy4u8cK17mguPjWml3pp7niRmhDlSHyA
|
||||||
|
S8RBgiYCuVE4xk9jmJUPosHbDDpzuNb46iYQQdL7XGTVuASB7sujptgmn+ZJrs3i
|
||||||
|
kS6Qzkc6eCd6aDqqNwcynwzIi1e/jBk/zihEEY7qYPcU2Wsw0y9QqFRFR7F3WGUz
|
||||||
|
8MNv4bnC60awXzO9O3FTxe1JrkWN+V+q25iElLm2rpUUaPTNjyehnAmK0ho=
|
||||||
|
=/vom
|
||||||
|
-----END PGP MESSAGE-----
|
@ -1,3 +0,0 @@
|
|||||||
U2FsdGVkX1+ieFWR0PfwpZvaYyk9EzC6noAzAyjeRxrX4UDdQ5cIE1Rdtymt/eo5
|
|
||||||
acU7SqzyrCRaJyCvAgqrqbNCn3qgL+PENLZbcyT8115MlIVSmMfkBXhN6Mc1KMOo
|
|
||||||
todGAfQ9twY/tsuoxwTeb621IBiq4XwhRPMI1+xsoNk=
|
|
Reference in New Issue
Block a user