6 Commits
0.1.0 ... 0.2.5

Author SHA1 Message Date
55803d3a5c debug
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/tag/woodpecker Pipeline was successful
2025-01-22 16:00:53 +01:00
f46f7b06d1 gpg fix
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
ci/woodpecker/tag/woodpecker Pipeline was successful
2025-01-22 15:46:44 +01:00
8af7497bad secrets
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
ci/woodpecker/tag/woodpecker Pipeline was successful
2025-01-22 15:16:39 +01:00
87bb67365a secrets
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
2025-01-22 15:08:18 +01:00
fcdf97a9fa new secret
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
2025-01-21 22:17:38 +01:00
7483095d5f add plotly
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
ci/woodpecker/tag/woodpecker Pipeline was successful
2025-01-21 18:42:52 +01:00
8 changed files with 36 additions and 83 deletions

View File

@ -15,18 +15,18 @@ steps:
- event: [push, tag]
deploy:
image: portainer/kubectl-shell:latest
image: quay.io/wollud1969/k8s-admin-helper:0.1.2
secrets:
- source: kube_config
target: KUBE_CONFIG_CONTENT
- source: encryption_key
target: ENCRYPTION_KEY
- source: secrets_checksum
target: MD5_CHECKSUM
- source: gpg_passphrase
target: GPG_PASSPHRASE
commands:
- export IMAGE_TAG=$CI_COMMIT_TAG
- printf "$KUBE_CONFIG_CONTENT" > /tmp/kubeconfig
- export KUBECONFIG=/tmp/kubeconfig
- id
- pwd
- ./deployment/deploy.sh
when:
- event: tag

View File

@ -13,6 +13,7 @@ USER $NB_USER
RUN \
conda update -y -n base conda && \
pip install psycopg && \
pip install plotly && \
conda install -y pandas-datareader && \
fix-permissions $CONDA_DIR && \
fix-permissions /home/$NB_USER

View File

@ -1,43 +0,0 @@
#!/bin/bash
if [ "$ENCRYPTION_KEY" = "" ]; then
echo "ENCRYPTION_KEY not set"
exit 1
fi
if [ "$MD5_CHECKSUM" = "" ]; then
echo "No checksum given"
exit 1
fi
SECRETS_CIPHERTEXT_FILE=secrets.enc
SECRETS_PLAINTEXT_FILE=/tmp/secrets
TMP_FILE=`mktemp`
POD_NAME_SUFFIX=`date +%s`
cat $SECRETS_CIPHERTEXT_FILE | \
kubectl run openssl-$POD_NAME_SUFFIX \
--rm \
--image bitnami/debian-base-buildpack:latest \
--env KEY=$ENCRYPTION_KEY \
-i \
-q \
-- \
/bin/sh -c "openssl enc -aes-256-cbc -salt -pass env:KEY -a -d" > \
$TMP_FILE
if [ `uname` = "Darwin" ]; then
CALCULATED_CHECKSUM=`cat $TMP_FILE | md5`
elif [ `uname` = "Linux" ]; then
CALCULATED_CHECKSUM=`cat $TMP_FILE | md5sum - | awk '{print $1}'`
fi
if [ "$MD5_CHECKSUM" != "$CALCULATED_CHECKSUM" ]; then
echo "Invalid checksum"
exit 1
fi
# cat $TMP_FILE
mv $TMP_FILE $SECRETS_PLAINTEXT_FILE

View File

@ -183,6 +183,9 @@ spec:
env:
- name: JUPYTER_PORT
value: "8888"
envFrom:
- secretRef:
name: jupyter
volumeMounts:
- mountPath: /home/jovyan/work
name: work

View File

@ -4,16 +4,20 @@ if [ "$IMAGE_TAG" == "" ]; then
echo "Make sure IMAGE_TAG is set"
exit 1
fi
if [ "$GPG_PASSPHRASE" == "" ]; then
echo "Make sure GPG_PASSPHRASE is set"
exit 1
fi
IMAGE_NAME=gitea.hottis.de/wn/jupyter-scipy-database-extension
NAMESPACE=jupyter
DEPLOYMENT_DIR=$PWD/deployment
pushd $DEPLOYMENT_DIR > /dev/null
./decrypt-secrets.sh || exit 1
. /tmp/secrets
rm /tmp/secrets
SECRETS_FILE=`mktemp`
gpg --decrypt --passphrase $GPG_PASSPHRASE --yes --batch --output $SECRETS_FILE secrets.asc
. $SECRETS_FILE
rm $SECRETS_FILE
kubectl create namespace $NAMESPACE \
--dry-run=client \
@ -28,6 +32,15 @@ kubectl create secret generic traefik-forward-auth \
--from-literal=SECRET="$SECRET" | \
kubectl apply -f - -n $NAMESPACE
kubectl create secret generic jupyter \
--dry-run=client \
-o yaml \
--save-config \
--from-literal=PGHOST="$PGHOST" | \
--from-literal=PGUSER="$PGUSER" | \
--from-literal=PGPASSWORD="$PGPASSWORD" | \
--from-literal=PGSSLMODE="$PGSSLMODE" | \
kubectl apply -f - -n $NAMESPACE
cat $DEPLOYMENT_DIR/deploy-yml.tmpl | \
sed -e 's,%IMAGE%,'$IMAGE_NAME':'$IMAGE_TAG','g | \

View File

@ -1,28 +0,0 @@
#!/bin/bash
ENCRYPTION_KEY=`openssl rand -hex 32`
echo $ENCRYPTION_KEY
SECRETS_PLAINTEXT_FILE=secrets.txt
SECRETS_CIPHERTEXT_FILE=secrets.enc
if [ `uname` = "Darwin" ]; then
cat $SECRETS_PLAINTEXT_FILE | md5
elif [ `uname` = "Linux" ]; then
cat $SECRETS_PLAINTEXT_FILE | md5sum - | awk '{print $1}'
fi
POD_NAME_SUFFIX=`date +%s`
cat $SECRETS_PLAINTEXT_FILE | \
kubectl run openssl-$POD_NAME_SUFFIX \
--rm \
--image bitnami/debian-base-buildpack:latest \
--env KEY=$ENCRYPTION_KEY \
-i \
-q \
-- \
/bin/sh -c "openssl enc -aes-256-cbc -salt -pass env:KEY -a" > \
$SECRETS_CIPHERTEXT_FILE

10
deployment/secrets.asc Normal file
View File

@ -0,0 +1,10 @@
-----BEGIN PGP MESSAGE-----
jA0ECQMIDcQyZABQeUf80sBKAQqlG05S05vOpXgoo7dj3iuiAXzOXA+M49yRAJwO
2T4OhVeEeUAkrzWNWtarDh8K6FJMS9wxhU6PkoJmry3+krIN+IvGGiMvRaxekB2F
xS6hA4eSH0GIKf7bzYSBekuyI0PuIXWozy4u8cK17mguPjWml3pp7niRmhDlSHyA
S8RBgiYCuVE4xk9jmJUPosHbDDpzuNb46iYQQdL7XGTVuASB7sujptgmn+ZJrs3i
kS6Qzkc6eCd6aDqqNwcynwzIi1e/jBk/zihEEY7qYPcU2Wsw0y9QqFRFR7F3WGUz
8MNv4bnC60awXzO9O3FTxe1JrkWN+V+q25iElLm2rpUUaPTNjyehnAmK0ho=
=/vom
-----END PGP MESSAGE-----

View File

@ -1,3 +0,0 @@
U2FsdGVkX1+ieFWR0PfwpZvaYyk9EzC6noAzAyjeRxrX4UDdQ5cIE1Rdtymt/eo5
acU7SqzyrCRaJyCvAgqrqbNCn3qgL+PENLZbcyT8115MlIVSmMfkBXhN6Mc1KMOo
todGAfQ9twY/tsuoxwTeb621IBiq4XwhRPMI1+xsoNk=