forked from sjenning/kube-nginx-letsencrypt
-
Notifications
You must be signed in to change notification settings - Fork 0
/
entrypoint.sh
executable file
·50 lines (36 loc) · 1.91 KB
/
entrypoint.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#!/bin/bash
if [[ -z $EMAIL || -z $DOMAINS || -z $SECRET ]]; then
echo "EMAIL, DOMAINS, and SECRET env vars required"
env
exit 1
fi
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
cd $HOME
python3 -m http.server 80 &
PID=$!
certbot certonly --webroot -w $HOME -n --agree-tos --email ${EMAIL} --no-self-upgrade -d ${DOMAINS} ${CERTBOT_ARGS}
kill $PID
CERTPATH=/etc/letsencrypt/live/$(echo $DOMAINS | cut -f1 -d',')
ls $CERTPATH || exit 1
cat /secret-patch-template.json | \
sed "s/NAMESPACE/${NAMESPACE}/" | \
sed "s/NAME/${SECRET}/" | \
sed "s/TLSCERT/$(cat ${CERTPATH}/fullchain.pem | base64 | tr -d '\n')/" | \
sed "s/TLSKEY/$(cat ${CERTPATH}/privkey.pem | base64 | tr -d '\n')/" \
> /secret-patch.json
ls /secret-patch.json || exit 1
KUBERNETES='kubernetes.default.svc'
# update secret
curl -v --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" -k -v -XPATCH -H "Accept: application/json, */*" -H "Content-Type: application/strategic-merge-patch+json" -d @/secret-patch.json https://${KUBERNETES}/api/v1/namespaces/${NAMESPACE}/secrets/${SECRET}
if [[ -z $DEPLOYMENT ]]; then
echo "No deployment set, exting without updating deployment.";
exit 0;
fi
cat /deployment-patch-template.json | \
sed "s/TLSUPDATED/$(date)/" | \
sed "s/NAMESPACE/${NAMESPACE}/" | \
sed "s/NAME/${DEPLOYMENT}/" \
> /deployment-patch.json
ls /deployment-patch.json || exit 1
# update pod spec on ingress deployment to trigger redeploy
curl -v --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" -k -v -XPATCH -H "Accept: application/json, */*" -H "Content-Type: application/strategic-merge-patch+json" -d @/deployment-patch.json https://${KUBERNETES}/apis/extensions/v1beta1/namespaces/${NAMESPACE}/deployments/${DEPLOYMENT}