create-namespace

#!/bin/sh
# Based on https://docs.helm.sh/service_accounts/

set -e

if [ -z "$1" ]; then
 echo "Usage: $0 <namespace(-stg|-prod)> [--dry-run]" >&2
 exit 1
fi

NAMESPACE=$1
TILLER=tiller
DEPLOY_USER=deploy

# This makes sure that only the helm client can access tiller (using a portforward).
# Otherwise, any pod in the network can contact the tiller port and let it install random yml files.
HELM_OVERRIDE="spec.template.spec.containers[0].command={/tiller,--listen=localhost:44134}"

if [ "$2" == "--dry-run" ]; then
  CMD="cat"
  DRY_RUN="--dry-run -o yaml"
  echo "Creating namespace: $NAMESPACE" >&2
  echo "Creating service account: $NAMESPACE/$TILLER" >&2
  echo "Creating role: $NAMESPACE/$TILLER-admin" >&2
  echo "Installing tiller on namespace $NAMESPACE" >&2
elif [ -n "$2" ]; then
  echo "Usage: $0 $1 [--dry-run]" >&2
  exit 1
else
  CMD="kubectl apply -f -"
  DRY_RUN=""
fi

$CMD <<EOF
---
## Create namespace $NAMESPACE:
## kubectl create namespace $NAMESPACE --dry-run -o yaml
apiVersion: v1
kind: Namespace
metadata:
  name: $NAMESPACE

---
## Create tiller service account:
## kubectl create serviceaccount $TILLER --namespace=$NAMESPACE --dry-run -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: $TILLER
  namespace: $NAMESPACE

---
## Create admin role:
## kubectl create role $TILLER --namespace $NAMESPACE --resource=deployments,replicasets,... --verb=get,list,... --dry-run -o yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: $NAMESPACE
  name: $TILLER
rules:
- apiGroups: ["", "batch", "extensions", "apps"]
  resources: ["deployments", "replicasets", "pods", "configmaps", "ingresses", "jobs", "secrets", "services", "namespaces", "persistentvolumeclaims"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # You can also use ["*"]

---
## Associate admin role with $TILLER account
## kubectl create rolebinding $TILLER --user=$TILLER --role=$TILLER --dry-run -o yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: $TILLER
  namespace: $NAMESPACE
roleRef:
  kind: Role
  name: $TILLER
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: $TILLER
  namespace: $NAMESPACE

---
## Create deploy account:
## kubectl create serviceaount $DEPLOY_USER --namespace=$NAMESPACE --dry-run -o yam
apiVersion: v1
kind: ServiceAccount
metadata:
  name: $DEPLOY_USER
  namespace: $NAMESPACE

---
## Create deploy role
## kubectl create role $DEPLOY_USER --namespace $NAMESPACE --resource=pods/portforward --verb=create ... --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: $DEPLOY_USER
  namespace: $NAMESPACE
rules:
- apiGroups: [""]
  resources: ["pods/portforward"]
  verbs: ["create"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]
#- apiGroups: [""]
#  resources: ["pods/exec"]
#  verbs: ["create"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "list", "delete"]
- apiGroups: ["", "extensions"]
  resources: ["deployments"]
  verbs: ["get", "watch"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get"]

---
## Associate deploy role with $DEPLOY_USER accout
## kubectl create rolebinding $DEPLOY_USER --user=$DEPLOY_USER --role=$DEPLOY_USER --dry-run -o yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: $DEPLOY_USER
  namespace: $NAMESPACE
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: $DEPLOY_USER
subjects:
- kind: ServiceAccount
  name: $DEPLOY_USER
  namespace: $NAMESPACE

---
## Install tiller in $NAMESPACE
## helm init --service-account $TILLER --tiller-namespace $NAMESPACE --history-max 5 --override="$HELM_OVERRIDE" --dry-run -o yaml
EOF
helm init --skip-refresh --upgrade --service-account $TILLER --tiller-namespace $NAMESPACE --history-max 5 --override="$HELM_OVERRIDE" $DRY_RUN

if [ "$DRY_RUN" == "" ]; then
  echo "Namespace configured"
  export NAMESPACE
  ./get-gitlab-settings $DEPLOY_USER --namespace=$NAMESPACE

  echo
  echo
  echo "Or, create a KUBE_CONFIG to perform the deployment:"
  echo
  echo "  create-kubeconfig $DEPLOY_USER --namespace=$NAMESPACE"
fi