79 lines
2.8 KiB
Bash
79 lines
2.8 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
|
|
||
|
|
[ -r "${SCRIPT_DIR}/env-cert_manager" ] && . "${SCRIPT_DIR}/env-cert_manager"
|
||
|
|
|
||
|
|
CERT_MANAGER_NAMESPACE="${CERT_MANAGER_NAMESPACE:-cert-manager}"
|
||
|
|
CERT_MANAGER_VERSION="${CERT_MANAGER_VERSION:-v1.19.5}"
|
||
|
|
BUNDLE_URL="https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.yaml"
|
||
|
|
BUNDLE_FILE="${SCRIPT_DIR}/cert-manager.yaml"
|
||
|
|
|
||
|
|
_kubectl() {
|
||
|
|
if [ -f "/etc/kubernetes/admin.conf" ]; then
|
||
|
|
KUBECONFIG=/etc/kubernetes/admin.conf command kubectl "$@"
|
||
|
|
elif command -v kubectl &>/dev/null; then
|
||
|
|
command kubectl "$@"
|
||
|
|
else
|
||
|
|
echo "ERROR: no kubectl found" >&2
|
||
|
|
exit 127
|
||
|
|
fi
|
||
|
|
}
|
||
|
|
|
||
|
|
CMD="${1:-install}"
|
||
|
|
|
||
|
|
if [ "${CMD}" = "delete" ]; then
|
||
|
|
echo "[cert-manager] bundle removal skipped — run helm/kubectl uninstall manually if needed"
|
||
|
|
echo "[cert-manager] ClusterIssuers are managed per-component; remove them via component delete"
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "[cert-manager] install version=${CERT_MANAGER_VERSION} namespace=${CERT_MANAGER_NAMESPACE}"
|
||
|
|
|
||
|
|
if [ ! -f "${BUNDLE_FILE}" ]; then
|
||
|
|
echo "[cert-manager] downloading bundle from ${BUNDLE_URL}"
|
||
|
|
curl -fsSL "${BUNDLE_URL}" -o "${BUNDLE_FILE}"
|
||
|
|
else
|
||
|
|
echo "[cert-manager] bundle already present, skipping download"
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "[cert-manager] applying bundle (--server-side)"
|
||
|
|
_kubectl apply --server-side -f "${BUNDLE_FILE}"
|
||
|
|
|
||
|
|
echo "[cert-manager] waiting for cert-manager-webhook Available (up to 180s)"
|
||
|
|
_kubectl wait --for=condition=Available \
|
||
|
|
deployment/cert-manager-webhook \
|
||
|
|
--namespace "${CERT_MANAGER_NAMESPACE}" \
|
||
|
|
--timeout=180s
|
||
|
|
|
||
|
|
echo "[cert-manager] waiting for ClusterIssuer CRD to be established (up to 60s)"
|
||
|
|
_kubectl wait --for=condition=established \
|
||
|
|
crd/clusterissuers.cert-manager.io \
|
||
|
|
--timeout=60s
|
||
|
|
|
||
|
|
if ! command -v kubectl-cert_manager >/dev/null 2>&1; then
|
||
|
|
echo "[cert-manager] installing kubectl cert-manager plugin ${CERT_MANAGER_VERSION}"
|
||
|
|
_ARCH="$(uname -m)"
|
||
|
|
case "${_ARCH}" in
|
||
|
|
x86_64) _ARCH="amd64" ;;
|
||
|
|
aarch64) _ARCH="arm64" ;;
|
||
|
|
*)
|
||
|
|
echo "[cert-manager] unsupported arch ${_ARCH} — skipping plugin install" >&2
|
||
|
|
_ARCH=""
|
||
|
|
;;
|
||
|
|
esac
|
||
|
|
if [ -n "${_ARCH}" ]; then
|
||
|
|
_PLUGIN_URL="https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/kubectl-cert_manager-linux-${_ARCH}.tar.gz"
|
||
|
|
_TMP="$(mktemp -d)"
|
||
|
|
curl -fsSL "${_PLUGIN_URL}" | tar -xz -C "${_TMP}"
|
||
|
|
install -m 0755 "${_TMP}/kubectl-cert_manager" /usr/local/bin/kubectl-cert_manager
|
||
|
|
rm -rf "${_TMP}"
|
||
|
|
echo "[cert-manager] plugin installed → /usr/local/bin/kubectl-cert_manager"
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
echo "[cert-manager] kubectl cert-manager plugin already present — skipping"
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "[cert-manager] done — $(date -Iseconds)"
|