Merge pull request #456 from yuvipanda/support

Provision per-cluster support components

.github/actions/deploy/action.yml

@@ -27,6 +27,10 @@ runs:
         python3 -m pip install -r requirements.txt
         python3 -m pip install -r dev-requirements.txt
       shell: bash
+    - name: Deploy support components
+      run: |
+        python3 deployer deploy-support ${{ inputs.cluster }}
+      shell: bash
     - name: Deploy and test hubs
       run: |
         python3 deployer deploy ${{ inputs.cluster }}

.sops.yaml

@@ -4,4 +4,6 @@ creation_rules:
   - path_regex: .*/kops/ssh-keys/.*
     gcp_kms: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs
   - path_regex: config/secrets.yaml$
+    gcp_kms: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs
+  - path_regex: support/secrets.yaml$
     gcp_kms: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs

deployer/hub.py

@@ -8,6 +8,7 @@
 import tempfile
 from contextlib import contextmanager, redirect_stderr, redirect_stdout
 from textwrap import dedent
+from pathlib import Path
 
 import pytest
 from ruamel.yaml import YAML
@@ -93,14 +94,17 @@ def deploy_support(self):
 
         print("Support charts...")
 
-        with tempfile.NamedTemporaryFile(mode='w') as f:
+        support_dir = Path(__file__).parent.parent / 'support'
+        support_secrets_file = support_dir / 'secrets.yaml'
+
+        with tempfile.NamedTemporaryFile(mode='w') as f, decrypt_file(support_secrets_file) as secret_file:
             yaml.dump(self.support.get('config', {}), f)
             f.flush()
             subprocess.check_call([
                 'helm', 'upgrade', '--install', '--create-namespace',
                 '--namespace', 'support',
-                'support', 'support',
-                '-f', f.name,
+                'support', str(support_dir),
+                '-f', secret_file, '-f', f.name,
                 '--wait'
             ])
         print("Done!")

support/secrets.yaml

@@ -0,0 +1,16 @@
+grafana:
+    adminPassword: ENC[AES256_GCM,data:vuzbI2lRpVSihmzQmQ38BD7N2rKSQ5YR4UcgsyKWsQGQBA5yfZvVj8osDOjEYVoZLDijRI6IJHfqZ4SaFMMg8w==,iv:U9m6wTNVVJDiHufBeaD0nBPMTjleDu2pKcR8G83/H1s=,tag:BDflHP0IzmNSRt5j2k9nrg==,type:str]
+sops:
+    kms: []
+    gcp_kms:
+        - resource_id: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs
+          created_at: "2021-06-16T12:29:14Z"
+          enc: CiQA4OM7eOWv40yySpNyEbCz1opatQP5+t5LrofdgGRay6VmYBgSSQB6TpsYWgnbo18yEE/gn9tYk5gkuqm/Jg3DPAXDWmyDDb819DrTw17vDUc/yBxmRrxaCVfsefMLV5PSejDvszU8WGwJgYUq01Y=
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2021-06-16T12:32:16Z"
+    mac: ENC[AES256_GCM,data:XTX8q2v21rNSzFqIUegqpk0Ne2erEKbxm42LnEu+lpGIdQ4dw1ebsri8WslalOAxklZYPXut+zOV6E0gyoiLmJO9dblj/HgdInDqf42AjS91RUSGXQH2otz6ajmU0GrUHehSAVRC7tRKqgp819NudNmcgfdF32N9g1W1Mab0z8s=,iv:FPv2Jjxgsa0mk+n9eOoaAvtCTY2RDOyjB0BY+bz2hv4=,tag:qgoq9CduOQbQcX5Vr8sXoA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.1