Verified Commit 1792b364 authored by Xueshan Feng's avatar Xueshan Feng
Browse files

added more makefile_parts to share cross projects.

parent 84a492da

makefile_parts/cert-manager.mk

0 → 100644
+82 −0
Original line number Diff line number Diff line 
################################################################################

# cert-manager.mk

# See https://github.com/jetstack/cert-manager/blob/master/docs/user-guides/deploying.md

# See https://github.com/kubernetes/charts/blob/master/stable/cert-manager/README.md

################################################################################



ifndef ACME_URL

	export ACME_URL := https://acme-staging.api.letsencrypt.org/directory

endif



ifndef CERT_MANAGER_NS

	export CERT_MANAGER_NS := kube-system

endif



# NOTE cert-manager is not currently support set up renew-before-days, but the defualt is 30 days.

# See https://github.com/jetstack/cert-manager/blob/ce9e5ede2bc6d8ccbc8e4db086f84c17e3f4d3af/docs/user-guides/acme-http-validation.md

ifndef CERT_RENEW_BEFORE_DAYS

	export CERT_RENEW_BEFORE_DAYS := 30

endif



# TEMPLATES is the parent dir of the cert-manager/*.yaml files

ifndef TEMPLATES

	missing_vars := ${missing_vars} TEMPLATES

else

	CERT_TEMPLATES := ${TEMPLATES}/cert-manager

endif



.PHONY: create-cert-manager-ns

cert-manager-ns: config-kube ## create cert-manager namespace

	@if ! kubectl get namespace ${CERT_MANAGER_NS} &> /dev/null ; then \

		kubectl create namespace ${CERT_MANAGER_NS} ; \

	fi



# See Tiller issue on create RBAC: https://github.com/jetstack/cert-manager/issues/256

.PHONY: deploy-cert-manager

deploy-cert-manager: cert-manager-ns ## create the cert-manager

	@helm install \

    	--name cert-manager \

    	--namespace ${CERT_MANAGER_NS} \

		--set rbac.create=false \

    	stable/cert-manager || $(MAKE) deploy-cert-manager-wo-helm



.PHONY: deploy-cert-manager-wo-helm

deploy-cert-manager-wo-helm: CERT_CRD_RESOURCES := 00-namespace.yaml serviceaccount.yaml certificate-crd.yaml clusterissuer-crd.yaml deployment.yaml issuer-crd.yaml rbac.yaml

deploy-cert-manager-wo-helm:  ## Deploy cert manager, without helm

	@for i in ${CERT_CRD_RESOURCES}; do \

		kubectl apply -f ${CERT_TEMPLATES}/$$i ; \

	done



.PHONY: ls-cert-manager

ls-cert-manager: ## list the cert-manager

	@helm ls --all cert-manager



.PHONY: cert-manager-status

cert-manager-status: ## check cert-manager status

	@helm status cert-manager || kubectl describe deployment cert-manager -n ${CERT_MANAGER_NS}



.PHONY: destroy-cert-manager

destroy-cert-manager: config-kube ## destroy the cert-manager 

	@helm delete --purge cert-manager || $(MAKE) destroy-cert-manager-wo-helm

.PHONY: destroy-cert-manager-wo-helm

destroy-cert-manager-wo-helm: CERT_CRD_RESOURCES := certificate-crd.yaml clusterissuer-crd.yaml deployment.yaml issuer-crd.yaml rbac.yaml serviceaccount.yaml 00-namespace.yaml 

destroy-cert-manager-wo-helm: config-kube ## destroy the cert-manager

	@for i in ${CERT_CRD_RESOURCES}; do \

		echo $$i ; \

		kubectl delete -f ${CERT_TEMPLATES}/$$i ; \

	done

	

.PHONY: deploy-issuer

deploy-issuers: KUBE_SEC_DEF_FILE = ${CERT_TEMPLATES}/secret.yaml

deploy-issuers: kube-sec ## create cert issuers

	@kube_apply.sh ${TEMPLATES}/cert-issuers.yaml



.PHONY: destroy-issuer

destroy-issuers: destroy-kube-sec ## destroy cert issuers

	@kube_delete.sh ${CERT_TEMPLATES}/cert-issuers.yaml



.PHONY: show-issuers

show-issuers: ## show cert issuers

	@kubectl get clusterissuer,issuer --all-namespaces



## end of cert-manager.mk

makefile_parts/config.mk

0 → 100644
+32 −0
Original line number Diff line number Diff line 




################################################################################

## config.mk

# Targets for setting up gcloud configuration

# Depends on vault.mk, {SCRIPTS_DIR}

################################################################################



ifndef AWS_PROFILE

	missing_vars := ${missing_vars} AWS_PROFILE

endif



ifndef CLUSTER_NAME

	missing_vars := ${missing_vars} CLUSTER_NAME

endif



.PHONY: config-aws-kube

config-kube: ## Coonfigure AWS EKS kubeconfig

	@${SCRIPTS_DIR}/config-aws-kube.sh



.PHONY: config

config: config-aws-kube ## alias for config-kube



.PHONY: revoke-kube

revoke-kube: # revoke just kubernetes credentials

	@rm -f ~/.kube/config



.PHONY: cluster-info

cluster-info: config-aws-kube ## show EKS cluster info

	@kubectl cluster-info

	@kubectl get all --all-namespaces

## end of config.mk

makefile_parts/disk.mk

0 → 100644
+79 −0
Original line number Diff line number Diff line 




################################################################################

## disk.mk

# Makefile goals for persistent disk/volume management

################################################################################



ifndef DISK_DEF_FILE

	export DISK_DEF_FILE := ${COMMON}/disks.def

endif



.PHONY: create-disk

create-disks: config-gcloud ## create persistent disks

	@if [ -a ${DISK_DEF_FILE} ]; then \

		${SCRIPTS_DIR}/disk-create-all.sh ${DISK_DEF_FILE} ; \

	fi



.PHONY: destroy-disks

destroy-disks: config-gcloud destroy-pv ## destroy persistent disks

	@if [ -a ${DISK_DEF_FILE} ]; then \

		${SCRIPTS_DIR}/disk-rm-all.sh ${DISK_DEF_FILE} ; \

	fi



.PHONY: snapshot-disks

snapshot-disks: config-gcloud ## snapshot pd disks

	@if [ -a ${DISK_DEF_FILE} ]; then \

		${SCRIPTS_DIR}/disk-snapshot-all.sh ${DISK_DEF_FILE}; \

	fi



.PHONY: describe-disks

describe-disks: config-gcloud ## describe pd disks

	@if [ -a ${DISK_DEF_FILE} ]; then \

		${SCRIPTS_DIR}/disk-describe-all.sh ${DISK_DEF_FILE}; \

	fi



.PHONY: resize-disks

resize-disks: config-gcloud ## resize pd disks

	@if [ -a ${DISK_DEF_FILE} ]; then \

		${SCRIPTS_DIR}/disk-resize-all.sh ${DISK_DEF_FILE}; \

	fi

	# See K8s PV/PVC resize issue: https://github.com/kubernetes/features/issues/284



.PHONY: create-pv

create-pv: config-kube create-disks ## create gke pv

	@if [ -a ${TEMPLATES}/pv.yml ]; then \

		kube_apply.sh ${TEMPLATES}/pv.yml ; \

	fi

	@for i in ${TEMPLATES}/*-pv.yml; do \

		kube_apply.sh $$i ; \

	done



.PHONY: create-pvc

create-pvc: create-pv ## create gke pvc

	@if [ -a ${TEMPLATES}/pvc.yml ]; then \

		kube_apply.sh ${TEMPLATES}/pvc.yml ; \

	fi

	@for i in ${TEMPLATES}/*-pvc.yml; do \

		kube_apply.sh $$i ; \

	done



.PHONY: destroy-pvc

destroy-pvc: config-kube ## destroy gke pvc

	@if [ -a ${TEMPLATES}/pvc.yml ]; then \

		kube_delete.sh ${TEMPLATES}/pvc.yml ; \

	fi

	@for i in ${TEMPLATES}/*-pvc.yml; do \

		kube_delete.sh $$i ; \

	done



.PHONY: destroy-pv

destroy-pv: destroy-pvc ## destroy gke pv

	@if [ -a ${TEMPLATES}/pv.yml ]; then \

		kube_delete.sh ${TEMPLATES}/pv.yml ; \

	fi

	@for i in ${TEMPLATES}/*-pv.yml; do \

		kube_delete.sh $$i ; \

	done



## end of disk.mk

makefile_parts/kube-cert.mk

0 → 100644
+49 −0
Original line number Diff line number Diff line 
################################################################################

# cert.mk

################################################################################



ifndef TEMPLATES

	missing_vars := ${missing_vars} TEMPLATES

endif



ifndef CERT_TEMPLATES

	export CERT_TEMPLATES := ${TEMPLATES}

endif



.PHONY: kube-cert

kube-cert: vault-login config-kube ## create certs defined in ${TEMPLATES}/cert.yml

	@if [ -a ${CERT_TEMPLATES}/cert.yml ]; then \

		kube_apply.sh ${CERT_TEMPLATES}/cert.yml ; \

	fi	

	@if [ -a ${CERT_TEMPLATES}/certs.yml ]; then \

		kube_apply.sh ${CERT_TEMPLATES}/certs.yml ; \

	fi

	@for i in ${CERT_TEMPLATES}/*-cert.yml; do \

		kube_apply.sh $$i ; \

	done



.PHONY: destroy-kube-cert

destroy-kube-cert: vault-login config-kube ## destroy certs defined in ${TEMPLATES}/certs.yml

	@if [ -a ${CERT_TEMPLATES}/cert.yml ]; then \

		kube_delete.sh ${CERT_TEMPLATES}/cert.yml ; \

	fi

	@if [ -a ${CERT_TEMPLATES}/certs.yml ]; then \

		kube_delete.sh ${CERT_TEMPLATES}/certs.yml ; \

	fi

	@for i in ${CERT_TEMPLATES}/*-cert.yml; do \

		kube_delete.sh $$i ; \

	done



.PHONY: ls-kube-cert

ls-kube-cert: ## list all certificates

	kubectl get certificates --all-namespaces



.PHONY: get-kube-cert

get-kube-cert: ## get all certificates

	kubectl get certificates --all-namespaces -o yaml



.PHONY: show-kube-cert

show-kube-cert: ## show cert in app namespace

	@show-kube-cert.sh ${APP_NAMESPACE}



## end of cert-manager.mk

makefile_parts/kube-cluster.mk

0 → 100644
+114 −0
Original line number Diff line number Diff line 




################################################################################

## kube-cluster.mk

# Makefile targets useful for kube cluster ops

################################################################################



ifndef GCP_ENVIRONMENT

	missing_vars := ${missing_vars} GCP_ENVIRONMENT

endif



ifndef GKE_CLUSTER_NAME

	missing_vars := ${missing_vars} GKE_CLUSTER_NAME

endif



ifndef GKE_CLUSTER_ZONE

	missing_vars := ${missing_vars} GKE_CLUSTER_ZONE

endif



ifndef GKE_CLUSTER_MACHINE_TYPE

	missing_vars := ${missing_vars} GKE_CLUSTER_MACHINE_TYPE

endif



ifndef GKE_CLUSTER_NUM_NODES

	missing_vars := ${missing_vars} GKE_CLUSTER_NUM_NODES

endif



ifndef TILLER_IMAGE

	TILLER_IMAGE := gcr.io/kubernetes-helm/tiller:v2.7.2

endif



.PHONY: cluster

cluster: config-gcloud  ## build GKE cluster

	@echo building GKE Cluster: ${GKE_CLUSTER_NAME}

	@echo GCP_ENVIRONMENT=${GCP_ENVIRONMENT}

	@echo GCP_PROJECT_ID=${GCP_PROJECT_ID}

	@${SCRIPTS_DIR}/create-cluster.sh

	@${SCRIPTS_DIR}/config-kube.sh



.PHONY: destroy-cluster

destroy-cluster: config-kube ## destroy the GKE cluster

	@echo "Please make sure ALL APPS/SERVICES hosted on this cluster have been destroyed before destroy the cluster."

	@read -p "Are you sure to DESTROY cluster ${GKE_CLUSTER_NAME}? [YES/NO] " ; \

	if [ "$$REPLY" = 'YES' ] ; \

	then \

		${SCRIPTS_DIR}/delete-cluster.sh;  \

	else \

		echo "Destroy canceled" ; \

	fi



.PHONY: cluster-describe

cluster-describe: ## show all the settings of the GKE cluster

	@gcloud container clusters describe ${GKE_CLUSTER_NAME}



.PHONY: cluster-versions

cluster-versions: ## show the available cluster master & node versions for the given zone

	@gcloud container get-server-config --zone=${GKE_CLUSTER_ZONE}



.PHONY: cluster-upgrade-nodes

cluster-upgrade-nodes: ## upgrade the cluster's nodes to a new version

	@gcloud container get-server-config --zone=${GKE_CLUSTER_ZONE}

	@echo Enter in the node version you want to upgrade to: 

	@read node_version && \

	 	echo "upgrading to node version '$$node_version' (non-blocking, please monitor)" && \

		gcloud container clusters upgrade ${GKE_CLUSTER_NAME} --cluster-version $$node_version --zone=${GKE_CLUSTER_ZONE} --async



.PHONY: get-images

get-images: config-kube ## List all images running in the cluster

    @kubectl get pods --all-namespaces -o jsonpath="{..image}" | tr -s '[[:space:]]' '\n' | sort | uniq -c



.PHONY: tiller

tiller: config-kube ## install/upgrade helm tiller

	helm init --upgrade --tiller-image ${TILLER_IMAGE}



.PHONY: tag-nodes

tag-nodes: config-kube ## tag the cluster nodes for NAT

	tag-nodes-for-nat.sh ${GCP_NAT_TAGS}



.PHONY: check-images ## check all running images

check-images: config-kube

	kube-images-report.sh



# eg. allow from myip:

# 	export GKE_AUTHZ_NET="`curl -s ipinfo.io/ip`/32"

# allow from stanford:

#   export GKE_AUTHZ_NET=171.64.0.0/16,171.65.0.0/16,171.66.0.0/16,128.12.0.0/16

.PHONY: enable-authz-net

enable-authz-net: config ## enable master authorized networks

	@if [ -z ${GKE_AUTHZ_NET} ]; \

	then \

		echo GKE_AUTHZ_NET is not defined; \

	else \

		gcloud container clusters update ${GKE_CLUSTER_NAME} \

			--enable-master-authorized-networks \

			--master-authorized-networks ${GKE_AUTHZ_NET}; \

		echo Cluster ${GKE_CLUSTER_NAME} API can be accessed only from ${GKE_AUTHZ_NET} now ; \

	fi



.PHONY: disable-authz-net

disable-authz-net: config ## disable master authorized networks

	@gcloud container clusters update ${GKE_CLUSTER_NAME} \

			--no-enable-master-authorized-networks

	@echo Cluster ${GKE_CLUSTER_NAME} API can be accessed from anywhere now



.PHONY: enable-net-policy

enable-net-policy: config ## enable clsuter network policy

	@gcloud container clusters update ${GKE_CLUSTER_NAME} --update-addons=NetworkPolicy=ENABLED

	@gcloud container clusters update ${GKE_CLUSTER_NAME} --enable-network-policy

	echo Network policy is enabled for cluster ${GKE_CLUSTER_NAME}



.PHONY: disable-net-policy

disable-net-policy: config ## disable cluster network policy

	@gcloud container clusters update ${GKE_CLUSTER_NAME} --no-enable-network-policy

	echo Network policy is disabled for cluster ${GKE_CLUSTER_NAME}
 
 No newline at end of file