Tiltfile

# -*- mode: Python -*-

def secret_yaml_generic(name, namespace="", from_file=None, secret_type=None, from_env_file=None):
  """Returns YAML for a generic secret

  Args:
    name: The secret name.
    namespace: The namespace.
    from_file: Use the from-file secret generator. May be a string or a list of strings.
       Example: ["ssh--privatekey=path/to/id_rsa", "ssh-publickey=path/to/id_rsa.pub"]
    from_env_file: Specify the path to a file to read lines of key=val pairs to create a secret
      (i.e. a Docker .env file)
    secret_type (optional): Specify the type of the secret
      Example: 'kubernetes.io/dockerconfigjson'

  Returns:
    The secret YAML as a blob
  """

  args = [
    "kubectl",
    "create",
    "secret",
    "generic",
    name,
  ]

  if namespace:
    args.extend(["-n", namespace])

  generator = False
  if from_file:
    if type(from_file) == "string":
      args.extend(["--from-file", from_file])
      generator = True
    elif type(from_file) == "list":
      for f in from_file:
        args.extend(["--from-file", f])
      generator = True
    else:
      fail("Bad from_file argument: %s" % from_file)

  if from_env_file:
    if type(from_env_file) != "string":
      fail("from_env_file only accepts strings")

    args.extend(["--from-env-file", from_env_file])
    generator = True

  if not generator:
    fail("No secret generator specified")

  if secret_type:
    if type(secret_type) == "string":
      args.extend(["--type", secret_type])
    else:
      fail("Bad secret_type argument: %s" % secret_type)

  args.extend(["-o=yaml", "--dry-run=client"])
  return local(args, quiet=True, echo_off=True)

def secret_from_dict(name, namespace="", inputs={}):
    """Returns YAML for a generic secret
    Args:
        name: The configmap name.
        namespace: The namespace.
        inputs: A dict of keys and values to use. Nesting is not supported
    Returns:
        The secret YAML as a blob
    """

    args = [
        "kubectl",
        "create",
        "secret",
        "generic",
        name,
    ]

    if namespace:
        args.extend(["-n", namespace])

    if type(inputs) != "dict":
        fail("Bad argument to secret_from_dict, inputs was not dict typed")

    for k,v in inputs.items():
        args.extend(["--from-literal", "%s=%s" % (k,v)])

    args.extend(["-o=yaml", "--dry-run=client"])
    return local(args, quiet=True, echo_off=True)

def secret_yaml_registry(name, namespace="", flags_dict={}):
    """Returns YAML for a docker-registry secret
    Args:
        name: The configmap name.
        namespace: The namespace.
        flags_dict (optional): the flags used by docker-registry secret command
          Example: '{"docker-server": "host", "docker-username": "username", "docker-password": "password", "docker-email": "email@email.com"}'
    Returns:
        The secret YAML as a blob
    """

    args = [
        "kubectl",
        "create",
        "secret",
        "docker-registry",
        name,
    ]

    if namespace:
        args.extend(["-n", namespace])

    if type(flags_dict) != "dict":
        fail("Bad argument to secret_from_dict, inputs was not dict typed")

    for k,v in flags_dict.items():
        args.extend(["--%s=%s" % (k,v)])

    args.extend(["-o=yaml", "--dry-run=client"])
    return local(args, quiet=True, echo_off=True)

def secret_create_generic(name, namespace="", from_file=None, secret_type=None, from_env_file=None):
  """Creates a secret in the current Kubernetes cluster.

  Args:
    name: The secret name.
    namespace: The namespace.
    from_file: Use the from-file secret generator. May be a string or a list of strings.
      Example: ["ssh--privatekey=path/to/id_rsa", "ssh-publickey=path/to/id_rsa.pub"]
    from_env_file: Specify the path to a file to read lines of key=val pairs to create a secret
      (i.e. a Docker .env file)
    secret_type (optional): Specify the type of the secret
      Example: 'kubernetes.io/dockerconfigjson'
  """
  k8s_yaml(secret_yaml_generic(name, namespace, from_file, secret_type, from_env_file))

def secret_yaml_tls(name, cert, key, namespace=""):
  """Returns YAML for a TLS secret

  Args:
    name: The secret name.
    cert: A path to the cert PEM file on disk.
    key: A path to the key PEM file on disk.
    namespace: The namespace.

  Returns:
    The secret YAML as a blob
  """

  args = [
    "kubectl",
    "create",
    "secret",
    "tls",
    name,
    "--cert=%s" % cert,
    "--key=%s" % key,
  ]

  if namespace:
    args.extend(["-n", namespace])

  args.extend(["-o=yaml", "--dry-run=client"])
  return local(args, quiet=True, echo_off=True)


def secret_create_tls(name, cert, key, namespace=""):
  """Creates a TLS secret in the current Kubernetes cluster.

  Args:
    name: The secret name.
    cert: A path to the cert PEM file on disk.
    key: A path to the key PEM file on disk.
    namespace: The namespace.
  """
  k8s_yaml(secret_yaml_tls(name, cert, key, namespace))

def secret_yaml_docker_registry(name, username, password, server="", namespace=""):
  """Returns YAML for a Docker Registry secret.

  Args:
    name: The secret name.
    username: The username for the registry.
    password: The password for the registry.
    server: The server for the registry. Defaults to Docker Hub.
    namespace: The namespace.

  Returns:
    The secret YAML as a blob
  """

  args = [
    "kubectl",
    "create",
    "secret",
    "docker-registry",
    name,
    "--docker-username", username,
    "--docker-password", password,
  ]

  if server:
    args.extend(["--docker-server", server])

  if namespace:
    args.extend(["-n", namespace])

  args.extend(["-o=yaml", "--dry-run=client"])
  return local(args, quiet=True, echo_off=True)


def secret_create_docker_registry(name, username, password, server="", namespace=""):
  """Creates a Docker Registry secret in the cluster.

  Args:
    name: The secret name.
    username: The username for the registry.
    password: The password for the registry.
    server: The server for the registry. Defaults to Docker Hub.
    namespace: The namespace.
  """
  k8s_yaml(secret_yaml_docker_registry(
      name, username, password,
      server=server, namespace=namespace))

def secret_yaml_docker_registry_ecr(name, account_id="", region="", namespace=""):
  """Returns YAML for an ECR Docker Registry secret.

  Auto-detects the current AWS account and region.

  Args:
    name: The secret name.
    account_id: The AWS account ID. Defaults to current identity.
    region: The AWS region. Defaults to current region.
    namespace: The namespace.

  Returns:
    The secret YAML as a blob
  """

  account_id = account_id or str(local(
      "aws sts get-caller-identity --query Account --output text",
      echo_off=True, quiet=True)).strip()
  region = region or str(local(
      "aws configure get region",
      echo_off=True, quiet=True)).strip()
  password = str(local(
      "aws ecr get-login-password",
      echo_off=True, quiet=True)).strip()

  return secret_yaml_docker_registry(
      name,
      username="AWS", password=password,
      server='%s.dkr.ecr.%s.amazonaws.com' % (account_id, region),
      namespace=namespace)

def secret_create_docker_registry_ecr(name, account_id="", region="", namespace=""):
  """Creates an ECR Docker Registry secret in the cluster.

  Auto-detects the current AWS account and region.

  Args:
    name: The secret name.
    account_id: The AWS account ID. Defaults to current identity.
    region: The AWS region. Defaults to current region.
    namespace: The namespace.
  """
  k8s_yaml(secret_yaml_docker_registry_ecr(
      name, account_id=account_id, region=region, namespace=namespace))