Skip to content

Commit 4c38389

Browse files
anandsyncsanandsyncs
committed
break down big snippet file
1 parent 7ef1ae2 commit 4c38389

File tree

4 files changed

+196
-1
lines changed

4 files changed

+196
-1
lines changed

‎docs/search/01-search-community-deploy/code_snippets/01_0306_install_cert_manager.sh‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
required=(
6+
K8S_CTX
7+
CERT_MANAGER_NAMESPACE
8+
)
9+
missing=()
10+
for var in "${required[@]}"; do
11+
[[ -n "${!var:-}" ]] || missing+=("${var}")
12+
done
13+
if (( ${#missing[@]} )); then
14+
echo "Missing required environment variables: ${missing[*]}" >&2
15+
exit 1
16+
fi
17+
18+
helm repo add jetstack https://charts.jetstack.io --force-update >/dev/null 2>&1 || true
19+
helm upgrade --install \
20+
cert-manager jetstack/cert-manager \
21+
--kube-context "${K8S_CTX}" \
22+
--namespace "${CERT_MANAGER_NAMESPACE}" \
23+
--create-namespace \
24+
--set crds.enabled=true >/dev/null 2>&1
25+
26+
for deployment in cert-manager cert-manager-cainjector cert-manager-webhook; do
27+
kubectl --context "${K8S_CTX}" \
28+
-n "${CERT_MANAGER_NAMESPACE}" \
29+
wait --for=condition=Available "deployment/${deployment}" --timeout=300s
30+
done
31+
32+
echo "cert-manager is ready in namespace ${CERT_MANAGER_NAMESPACE}."

‎docs/search/01-search-community-deploy/code_snippets/01_0307_prepare_cert_manager_issuer.sh‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
required=(
6+
K8S_CTX
7+
MDB_NS
8+
MDB_RESOURCE_NAME
9+
MDB_TLS_CA_SECRET_NAME
10+
)
11+
missing=()
12+
for var in "${required[@]}"; do
13+
[[ -n "${!var:-}" ]] || missing+=("${var}")
14+
done
15+
if (( ${#missing[@]} )); then
16+
echo "Missing required environment variables: ${missing[*]}" >&2
17+
exit 1
18+
fi
19+
20+
self_signed_issuer="${MDB_RESOURCE_NAME}-selfsigned-issuer"
21+
ca_cert_name="${MDB_RESOURCE_NAME}-ca"
22+
ca_issuer="${MDB_RESOURCE_NAME}-ca-issuer"
23+
24+
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF_MANIFEST
25+
apiVersion: cert-manager.io/v1
26+
kind: Issuer
27+
metadata:
28+
name: ${self_signed_issuer}
29+
namespace: ${MDB_NS}
30+
spec:
31+
selfSigned: {}
32+
---
33+
apiVersion: cert-manager.io/v1
34+
kind: Certificate
35+
metadata:
36+
name: ${ca_cert_name}
37+
namespace: ${MDB_NS}
38+
spec:
39+
isCA: true
40+
secretName: ${MDB_TLS_CA_SECRET_NAME}
41+
commonName: ${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local
42+
privateKey:
43+
algorithm: RSA
44+
size: 2048
45+
issuerRef:
46+
kind: Issuer
47+
name: ${self_signed_issuer}
48+
duration: 240h0m0s
49+
renewBefore: 120h0m0s
50+
---
51+
apiVersion: cert-manager.io/v1
52+
kind: Issuer
53+
metadata:
54+
name: ${ca_issuer}
55+
namespace: ${MDB_NS}
56+
spec:
57+
ca:
58+
secretName: ${MDB_TLS_CA_SECRET_NAME}
59+
EOF_MANIFEST
60+
61+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready issuer "${self_signed_issuer}" --timeout=120s
62+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${ca_cert_name}" --timeout=300s
63+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready issuer "${ca_issuer}" --timeout=120s
64+
65+
echo "cert-manager issuer ${ca_issuer} is ready to sign certificates."

‎docs/search/01-search-community-deploy/code_snippets/01_0308_issue_tls_certificates.sh‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
required=(
6+
K8S_CTX
7+
MDB_NS
8+
MDB_RESOURCE_NAME
9+
MDB_MEMBERS
10+
MDB_TLS_CA_SECRET_NAME
11+
MDB_TLS_SERVER_CERT_SECRET_NAME
12+
MDB_SEARCH_TLS_SECRET_NAME
13+
)
14+
missing=()
15+
for var in "${required[@]}"; do
16+
[[ -n "${!var:-}" ]] || missing+=("${var}")
17+
done
18+
if (( ${#missing[@]} )); then
19+
echo "Missing required environment variables: ${missing[*]}" >&2
20+
exit 1
21+
fi
22+
23+
ca_issuer="${MDB_RESOURCE_NAME}-ca-issuer"
24+
server_certificate="${MDB_RESOURCE_NAME}-server-tls"
25+
search_certificate="${MDB_RESOURCE_NAME}-search-tls"
26+
27+
mongo_dns_names=()
28+
for ((member = 0; member < ${MDB_MEMBERS}; member++)); do
29+
mongo_dns_names+=("${MDB_RESOURCE_NAME}-${member}")
30+
mongo_dns_names+=("${MDB_RESOURCE_NAME}-${member}.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local")
31+
done
32+
mongo_dns_names+=(
33+
"${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local"
34+
"*.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local"
35+
)
36+
37+
search_dns_names=(
38+
"${MDB_RESOURCE_NAME}-search-0"
39+
"${MDB_RESOURCE_NAME}-search-0.${MDB_RESOURCE_NAME}-search-svc.${MDB_NS}.svc.cluster.local"
40+
"${MDB_RESOURCE_NAME}-search-svc.${MDB_NS}.svc.cluster.local"
41+
)
42+
43+
render_dns_list() {
44+
local dns_list=("$@")
45+
for dns in "${dns_list[@]}"; do
46+
printf " - \"%s\"\n" "${dns}"
47+
done
48+
}
49+
50+
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF_MANIFEST
51+
apiVersion: cert-manager.io/v1
52+
kind: Certificate
53+
metadata:
54+
name: ${server_certificate}
55+
namespace: ${MDB_NS}
56+
spec:
57+
secretName: ${MDB_TLS_SERVER_CERT_SECRET_NAME}
58+
issuerRef:
59+
kind: Issuer
60+
name: ${ca_issuer}
61+
duration: 240h0m0s
62+
renewBefore: 120h0m0s
63+
usages:
64+
- digital signature
65+
- key encipherment
66+
- server auth
67+
- client auth
68+
dnsNames:
69+
$(render_dns_list "${mongo_dns_names[@]}")
70+
---
71+
apiVersion: cert-manager.io/v1
72+
kind: Certificate
73+
metadata:
74+
name: ${search_certificate}
75+
namespace: ${MDB_NS}
76+
spec:
77+
secretName: ${MDB_SEARCH_TLS_SECRET_NAME}
78+
issuerRef:
79+
kind: Issuer
80+
name: ${ca_issuer}
81+
duration: 240h0m0s
82+
renewBefore: 120h0m0s
83+
usages:
84+
- digital signature
85+
- key encipherment
86+
- server auth
87+
- client auth
88+
dnsNames:
89+
$(render_dns_list "${search_dns_names[@]}")
90+
EOF_MANIFEST
91+
92+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${server_certificate}" --timeout=300s
93+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${search_certificate}" --timeout=300s
94+
95+
echo "MongoDB TLS certificates have been issued."

‎docs/search/01-search-community-deploy/test.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,10 @@ run_for_output 01_0090_helm_add_mogodb_repo.sh
1818
run_for_output 01_0100_install_operator.sh
1919
run_for_output 01_0110_wait_for_operator_deployment.sh
2020
run 01_0305_create_mongodb_community_user_secrets.sh
21-
run 01_0306_configure_cert_manager_tls.sh
21+
22+
run 01_0306_install_cert_manager.sh
23+
run 01_0307_prepare_cert_manager_issuer.sh
24+
run 01_0308_issue_tls_certificates.sh
2225

2326
run 01_0310_create_mongodb_community_resource.sh
2427
run_for_output 01_0315_wait_for_community_resource.sh

0 commit comments

Comments
 (0)