Push to k8s

Author: rajsinghtech

.github/workflows/docker-build-push.yml

@@ -21,22 +21,23 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login quay.io -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
 
-      - name: Get tag or commit SHA
+      - name: Get tag or branch name
         id: vars
         run: |
           if [[ "${{ github.ref }}" == refs/tags/* ]]; then
             echo "image_tag=${{ github.ref_name }}" >> $GITHUB_ENV
           else
-            echo "image_tag=${{ github.sha }}" >> $GITHUB_ENV
+            # Get branch name and replace / with - for Docker tag compatibility
+            BRANCH_NAME=$(echo ${GITHUB_REF#refs/heads/} | sed 's/\//-/g')
+            echo "image_tag=${BRANCH_NAME}-${{ github.sha }}" >> $GITHUB_ENV
           fi
 
       - name: Build Docker Image
         run: docker build . -t fleet-telemetry-consumer:${{ env.image_tag }}
 
-      - name: Tag Docker Image (only if pushing)
-        if: startsWith(github.ref, 'refs/tags/')
-        run: docker tag fleet-telemetry-consumer:${{ env.image_tag }} quay.io/rajsinghcpre/fleet-telemetry-consumer:${{ env.image_tag }}
-
-      - name: Push Docker Image (only if pushing)
-        if: startsWith(github.ref, 'refs/tags/')
-        run: docker push quay.io/rajsinghcpre/fleet-telemetry-consumer:${{ env.image_tag }}
+      - name: Tag and Push Docker Image
+        run: |
+          docker tag fleet-telemetry-consumer:${{ env.image_tag }} quay.io/rajsinghcpre/fleet-telemetry-consumer:${{ env.image_tag }}
+          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
+            docker push quay.io/rajsinghcpre/fleet-telemetry-consumer:${{ env.image_tag }}
+          fi

Makefile

@@ -24,12 +24,15 @@ pull-secrets:
 	@echo "Creating static directory if it doesn't exist..."
 	@mkdir -p ./secrets
 	@mkdir -p ./secrets/fleet-api
-	@mkdir -p ./secrets/ssl
+	@mkdir -p ./secrets/tesla-ssl
 	@mkdir -p ./secrets/pg
+	@mkdir -p ./secrets/fleet-telemetry-ssl
 	@echo "Pulling secrets from tesla-fleet-api..."
 	kubectl get secret tesla-fleet-api -n tesla -o jsonpath='{.data}' | jq -r 'to_entries[] | "echo \"Extracting \(.key)...\"; echo \(.value) | base64 -d > \"./secrets/fleet-api/\(.key)\""' | sh
 	@echo "Pulling secrets from tesla-raj-tls..."
-	kubectl get secret tesla-raj-tls -n tesla -o jsonpath='{.data}' | jq -r 'to_entries[] | "echo \"Extracting \(.key)...\"; echo \(.value) | base64 -d > \"./secrets/ssl/\(.key)\""' | sh
+	kubectl get secret tesla-raj-tls -n tesla -o jsonpath='{.data}' | jq -r 'to_entries[] | "echo \"Extracting \(.key)...\"; echo \(.value) | base64 -d > \"./secrets/tesla-ssl/\(.key)\""' | sh
+	@echo "Pulling secrets from fleet-telemetry-tesla-raj-tls..."
+	kubectl get secret fleet-telemetry-tesla-raj-tls -n tesla -o jsonpath='{.data}' | jq -r 'to_entries[] | "echo \"Extracting \(.key)...\"; echo \(.value) | base64 -d > \"./secrets/fleet-telemetry-ssl/\(.key)\""' | sh
 	@echo "Pulling secrets from fleet-telemetry-consumer-db-app..."
 	kubectl get secret fleet-telemetry-consumer-db-app -n tesla -o jsonpath='{.data}' | jq -r 'to_entries[] | "echo \"Extracting \(.key)...\"; echo \(.value) | base64 -d | sed \"s/\\.tesla/\\.tesla\\.svc\\.cluster\\.local/g\" > \"./secrets/pg/\(.key)\""' | sh
 	@echo "Done pulling secrets!"

docker-compose.yml

@@ -6,14 +6,22 @@ services:
     ports:
       - "4443:4443"
     environment:
-      - TESLA_HTTP_PROXY_TLS_CERT=/config/tls.crt
-      - TESLA_HTTP_PROXY_TLS_KEY=/config/tls.key
+      - TESLA_HTTP_PROXY_TLS_CERT=/secrets/tesla-ssl/tls.crt
+      - TESLA_HTTP_PROXY_TLS_KEY=/secrets/tesla-ssl/tls.key
       - TESLA_HTTP_PROXY_HOST=0.0.0.0
       - TESLA_HTTP_PROXY_PORT=4443
       - TESLA_HTTP_PROXY_TIMEOUT=10s
       - TESLA_KEY_FILE=/secret/private-key.pem
       - TESLA_VERBOSE=true
     volumes:
-      - ./secrets/ssl/tls.crt:/config/tls.crt:ro
-      - ./secrets/ssl/tls.key:/config/tls.key:ro
-      - ./secrets/fleet-api/private-key.pem:/secret/private-key.pem:ro
+      - ./secrets/tesla-ssl/tls.crt:/secrets/tesla-ssl/tls.crt:ro
+      - ./secrets/tesla-ssl/tls.key:/secrets/tesla-ssl/tls.key:ro
+      - ./secrets/fleet-api/private-key.pem:/secret/private-key.pem:ro
+  # fleet-telemetry-consumer:
+  #   build: 
+  #     context: .
+  #     dockerfile: Dockerfile
+  #   ports:
+  #     - "3000:3000"
+  #   depends_on:
+  #     - tesla-http-proxy

examples/kustomization/certificate.yaml

@@ -8,13 +8,28 @@ spec:
     size: 256
     rotationPolicy: Always
   dnsNames:
-    - fleet-telemetry.tesla.rajsingh.info
     - tesla.rajsingh.info
   issuerRef:
     group: cert-manager.io
     kind: ClusterIssuer
     name: raj-issuer
   secretName: tesla-raj-tls
+  usages:
+    - digital signature
+    - key encipherment
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fleet-telemetry-tesla-raj-tls
+spec:
+  dnsNames:
+    - fleet-telemetry.tesla.rajsingh.info
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: raj-issuer
+  secretName: fleet-telemetry-tesla-raj-tls
   usages:
     - digital signature
     - key encipherment

examples/kustomization/fleet-telemetry-consumer.yaml

@@ -13,57 +13,54 @@ spec:
       labels:
         app: fleet-telemetry-consumer
     spec:
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       containers:
         - name: tesla-http-proxy
           image: tesla/vehicle-command:latest
+          imagePullPolicy: Always
           ports:
             - containerPort: 4443
           env:
             - name: TESLA_HTTP_PROXY_TLS_CERT
-              value: /config/tls.crt
+              value: /secrets/tesla-ssl/tls.crt
             - name: TESLA_HTTP_PROXY_TLS_KEY
-              value: /config/tls.key
+              value: /secrets/tesla-ssl/tls.key
             - name: TESLA_HTTP_PROXY_HOST
               value: "0.0.0.0"
             - name: TESLA_HTTP_PROXY_PORT
               value: "4443"
             - name: TESLA_HTTP_PROXY_TIMEOUT
               value: "10s"
             - name: TESLA_KEY_FILE
-              value: /secret/private-key.pem
+              value: /secrets/fleet-api/private-key.pem
             - name: TESLA_VERBOSE
               value: "true"
           volumeMounts:
-            - name: certs
-              mountPath: /config
-            - name: fleet-key-secret
-              mountPath: /secret
+            - name: fleet-api
+              mountPath: /secrets/fleet-api
+            - name: tesla-ssl
+              mountPath: /secrets/tesla-ssl
         - name: fleet-telemetry-consumer
           image: quay.io/rajsinghcpre/fleet-telemetry-consumer:v0.0.27
-          command: ["/fleet-telemetry-consumer", "-config=/etc/fleet-telemetry-consumer/config.json"]
+          command: ["main.go"]
           ports:
             - containerPort: 3000
           volumeMounts:
-            - name: config
-              mountPath: /etc/fleet-telemetry-consumer
-            - name: certs
-              mountPath: /etc/ssl/certs
-            - name: pg-secret
+            - name: tesla-ssl
+              mountPath: /secrets/tesla-ssl
+            - name: fleet-api
+              mountPath: /secrets/fleet-api
+            - name: pg
               mountPath: /secrets/pg
       volumes:
-      - name: config
-        configMap:
-          name: fleet-telemetry-consumer-config
-      - name: certs
-        secret:
-          secretName: tesla-raj-tls
-      - name: pg-secret
-        secret:
-          secretName: fleet-telemetry-consumer-db-app
+        - name: tesla-ssl
+          secret:
+            secretName: tesla-raj-tls
+        - name: fleet-api
+          secret:
+            secretName: tesla-fleet-api
+        - name: pg
+          secret:
+            secretName: fleet-telemetry-consumer-db-app
 ---
 apiVersion: v1
 kind: Service
@@ -76,4 +73,28 @@ spec:
     - protocol: TCP
       port: 80
       targetPort: 3000
-  type: ClusterIP
+  type: ClusterIP
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: fleet-telemetry-consumer
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: robbinsdale
+      namespace: envoy-gateway-system
+  hostnames:
+    - "tesla.rajsingh.info"
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: fleet-telemetry-consumer
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

examples/kustomization/fleet-telemetry.yaml

@@ -13,10 +13,6 @@ spec:
       labels:
         app: fleet-telemetry
     spec:
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
       containers:
       - name: fleet-telemetry
         image: tesla/fleet-telemetry:v0.6.0
@@ -38,7 +34,7 @@ spec:
           name: fleet-telemetry-config
       - name: certs
         secret:
-          secretName: tesla-raj-tls
+          secretName: fleet-telemetry-tesla-raj-tls
 ---
 apiVersion: v1
 kind: Service

examples/kustomization/kustomization.yaml

@@ -8,6 +8,7 @@ resources:
   - secrets.yaml
   - public-key-webserver.yaml
   - pg.yaml
+  - fleet-telemetry-consumer.yaml
 configMapGenerator:
   - name: fleet-telemetry-config
     files:

main.go

@@ -398,7 +398,7 @@ func configureTelemetry(vin, accessToken string) error {
 	proxyURL := "https://localhost:4443"
 
 	// Read the CA certificate
-	caCert, err := os.ReadFile("./secrets/ssl/tls.crt")
+	caCert, err := os.ReadFile("./secrets/fleet-telemetry-ssl/tls.crt")
 	if err != nil {
 		return fmt.Errorf("error reading CA certificate: %v", err)
 	}