nsplease.sh

#!/usr/bin/env sh

# config
CREATE_SA="${CREATE_SA:-true}"
NSPLEASE_SERVICEACCOUNT_NAME="${NSPLEASE_SERVICEACCOUNT_NAME:-nsplease-sa}"
NSPLEASE_ROLEBINDING_NAME="${NSPLEASE_ROLEBINDING_NAME:-nsplease-rb}"
NSPLEASE_ROLE_NAME="${NSPLEASE_ROLE_NAME:-nsplease-role}"

info() {
  printf "[INFO]\t%s\n" "$*"
}

out() {
  "$@" | while read -r line; do
    printf "[EXEC]\t%s\n" "$line"
  done
}

create_resources() { (
  # exit function if any command fails
  set -e

  # create ServiceAccount in CI Namespace
  if [ "$CREATE_SA" = true ]; then
    out kubectl create serviceaccount "$NSPLEASE_SERVICEACCOUNT_NAME" \
      --namespace="$CI_NAMESPACE"
  else
    if ! kubectl get "$NSPLEASE_SERVICEACCOUNT_NAME" \
      --namespace "$CI_NAMESPACE"; then
      info "ServiceAccount $NSPLEASE_SERVICEACCOUNT_NAME not found in CI Namespace $CI_NAMESPACE and CREATE_SA not set to true, aborting"
      return 1
    fi
  fi

  # create privileged Role in requested Namespace
  out kubectl create role "$NSPLEASE_ROLE_NAME" \
    --namespace="$REQUESTED_NAMESPACE" \
    --verb="*" \
    --resource="*"

  # give rights on requested Namespace to project's CI ServiceAccount
  out kubectl create rolebinding "$NSPLEASE_ROLEBINDING_NAME-$CI_NAMESPACE" \
    --namespace="$REQUESTED_NAMESPACE" \
    --role="$NSPLEASE_ROLE_NAME" \
    --serviceaccount="$CI_NAMESPACE:$NSPLEASE_SERVICEACCOUNT_NAME"

  # create privileged Role in CI Namespace
  out kubectl create role "$NSPLEASE_ROLE_NAME" \
    --namespace="$CI_NAMESPACE" \
    --verb="*" \
    --resource="*"

  # give rights on CI Namespace to project's CI ServiceAccount
  out kubectl create rolebinding "$NSPLEASE_ROLEBINDING_NAME" \
    --namespace="$CI_NAMESPACE" \
    --role="$NSPLEASE_ROLE_NAME" \
    --serviceaccount="$CI_NAMESPACE:$NSPLEASE_SERVICEACCOUNT_NAME"
); }

main() {
  info "waiting for namespaces with label 'nsplease/done=false'..."

  # watch namespace creations, only ADDED type and labeled with nsplease/project
  kubectl get namespace --watch --output-watch-events -o json |
    jq --unbuffered --raw-output \
      'if (.object.metadata.labels | has("nsplease/project"))
       and (.object.metadata.labels."nsplease/done" == "false")
       and (.type == "ADDED") then
        [.object.metadata.name, .object.metadata.labels."nsplease/project"] | @tsv
       else empty
       end' |
    while read -r REQUESTED_NAMESPACE PROJECT; do
      info "got labeled namespace: $REQUESTED_NAMESPACE $PROJECT"

      # get the CI Namespace according to the convention
      CI_NAMESPACE="$PROJECT-ci"

      if create_resources; then
        # remove label to avoid doing this again for the same namespace
        out kubectl label namespace --overwrite "$NAMESPACE" nsplease/done=true
      else
        info "todo retry"
      fi

    done
}

main