Unified bootstrap script with everything in one script, opt-in portio…

…ns are handled by hook.env. Reduces duplicate scripting logic and ensures fewer executions of kubectl

hooks/hook.env.example

@@ -6,3 +6,5 @@ CLIENT_ID="changeme"
 CLIENT_SECRET="changeme"
 IMAGE_PULL_SECRET=""
 REGISTRY_DOCKER_CONFIG_JSON="/some/path/to/docker/config.json"
+USE_POD_SECURITY_POLICY=false
+USE_JOB_POD_REAPER=false

hooks/k8s-bootstrap-ondemand.sh

@@ -29,6 +29,23 @@ envsubst < "${YAML_DIR}/namespace.yaml" > "$TMPFILE"
 envsubst < "${YAML_DIR}/network-policy.yaml" >> "$TMPFILE"
 envsubst < "${YAML_DIR}/rolebinding.yaml" >> "$TMPFILE"
 
+if $USE_POD_SECURITY_POLICY ; then
+  PASSWD=$(getent passwd "$ONDEMAND_USERNAME")
+  if ! [[ "$PASSWD" =~ "${ONDEMAND_USERNAME}:"* ]]; then
+    echo "level=error msg=\"Unable to perform lookup of user\" user=$ONDEMAND_USERNAME"
+    exit 1
+  fi
+  UID=$(echo "$PASSWD" | cut -d':' -f3)
+  GID=$(echo "$PASSWD" | cut -d':' -f4)
+  export USER_UID=$UID
+  export USER_GID=$GID
+  envsubst < "${YAML_DIR}/pod-security-policy.yaml" >> "$TMPFILE"
+fi
+
+if $USE_JOB_POD_REAPER ; then
+  envsubst < "${YAML_DIR}/job-pod-reaper.yaml" >> "$TMPFILE"
+fi
+
 kubectl apply -f "$TMPFILE"
 rm -f "$TMPFILE"
 

hooks/k8s-bootstrap/job-pod-reaper.yaml

@@ -0,0 +1,15 @@
+---
+# allow job-pod-reaper to see this namespace
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "$ONDEMAND_USERNAME-job-pod-reaper-rolebinding"
+  namespace: "$NAMESPACE"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: job-pod-reaper
+subjects:
+- kind: ServiceAccount
+  name: job-pod-reaper
+  namespace: job-pod-reaper

hooks/k8s-bootstrap-pod-security-policy.sh → hooks/k8s-bootstrap/pod-security-policy.yaml

@@ -1,32 +1,3 @@
-#!/bin/bash
-
-ONDEMAND_USERNAME="$1"
-if [ "x${ONDEMAND_USERNAME}" = "x" ]; then
-  echo "Must specify username"
-  exit 1
-fi
-HOOK_ENV="$2"
-if [ "x${HOOK_ENV}" = "x" ]; then
-  echo "Must specify hook.env path"
-  exit 1
-fi
-
-set -e
-
-# shellcheck disable=SC1090
-source "$HOOK_ENV"
-
-TMPFILE=$(mktemp "/tmp/k8-ondemand-bootstrap-${ONDEMAND_USERNAME}.XXXXXX")
-PASSWD=$(getent passwd "$ONDEMAND_USERNAME")
-if ! [[ "$PASSWD" =~ "${ONDEMAND_USERNAME}:"* ]]; then
-  echo "level=error msg=\"Unable to perform lookup of user\" user=$ONDEMAND_USERNAME"
-  exit 1
-fi
-USER_UID=$(echo "$PASSWD" | cut -d':' -f3)
-USER_GID=$(echo "$PASSWD" | cut -d':' -f4)
-NAMESPACE="${NAMESPACE_PREFIX}${ONDEMAND_USERNAME}"
-
-cat > "$TMPFILE" <<EOF
 ---
 # the pod security policy such that you can only run pods as a single uid/gid pair
 apiVersion: policy/v1beta1
@@ -103,10 +74,3 @@ subjects:
   kind: User
   name: "$ONDEMAND_USERNAME"
   namespace: "$NAMESPACE"
-EOF
-
-
-export PATH=/usr/local/bin:/bin:$PATH
-kubectl apply -f "$TMPFILE"
-
-rm -f "$TMPFILE"