projectriff-archive / cnab-riff Goto Github PK

Currently the bundle references dependencies that themselves are floating snapshots. This means that there is no consistency or reproducibility when installing the bundle.

The published bundle should be locked down by default. This means:

• remote URLs are resolved
• images with tags are resolved to digests

We can keep the free floating bundle as a 'latest' bundle which isn't QAed, but makes testing the latest components easier.

run tests which will ensure that functions can be built and run before publishing snapshots.

revert this commit to re-introduce the node port parameter: 8f1c7bd when duffle fixes the ability to export parameters with default values. see: cnabio/duffle#753

In addition to testing on linux, test installing the bundle on mac and windows.

The non-invocation images are not declared in the bundle and need to be so that duffle can relocate them.

If it's not too much work it would be nice to have a cnab-riff bundle for riff v0.4.0.

E.g. Istio v1.1.13 to match riff charts.

riff system install no longer exists. This is the preferred way to install riff. We need to remove references to the cnab bundle being experimental and treat it like a regular projectriff repo.

It feels very awkward to ask users to craft yet another credentials config file to target their k8s.

kubectl seems like enough of a "standard" now, that duffle should know how to use the current kubectl context without another step.

see also the discussion in projectriff-archive/cnab-k8s-installer-base#39 (comment)

Following the instructions adapted to Windows fails in the install:

PS C:\Users\trisberg> $SERVICE_ACCOUNT='duffle-runtime'
PS C:\Users\trisberg> $KUBE_NAMESPACE='duffle'
PS C:\Users\trisberg> kubectl create namespace $KUBE_NAMESPACE
namespace/duffle created
PS C:\Users\trisberg> kubectl create serviceaccount "${SERVICE_ACCOUNT}" -n "${KUBE_NAMESPACE}"
serviceaccount/duffle-runtime created
PS C:\Users\trisberg> kubectl create clusterrolebinding "${SERVICE_ACCOUNT}-cluster-admin" --clusterrole cluster-admin --serviceaccount "${KUBE_NAMESPACE}:${SERVICE_ACCOUNT}"
clusterrolebinding.rbac.authorization.k8s.io/duffle-runtime-cluster-admin created
PS C:\Users\trisberg> duffle install myriff https://storage.googleapis.com/projectriff/riff-cnab/snapshots/riff-bundle-latest.json --bundle-is-file -s node_port=true -d k8s
Executing install action...
Error: Install step failed: KUBE_NAMESPACE is required
PS C:\Users\trisberg> echo $KUBE_NAMESPACE
duffle

The pinning images PR #35 was validating if the duffle.json and cnab/app/kab/manifest.yaml files were checked in when the bundle was build. Since the images change too frequently, this check should be removed.

using Docker edge 2.0.4.1

$  duffle install myriff riff-bundle-latest.json --bundle-is-file --credentials myk8s --insecure
Executing install action...
...
...
Status: Downloaded newer image for projectriff/riff-cnab:f36ae7173dbbbbfad15f301733319fe24821d491
time="2019-05-31T11:07:48Z" level=fatal msg="Get https://localhost:6443/api/v1/nodes/minikube: dial tcp 127.0.0.1:6443: connect: connection refused"
Error: Install step failed: container exit code: 1

The localhost:6443 endpoint appears correct for docker-desktop, but it appears that the node-port detection code is assuming a node name docker-for-desktop instead of docker-desktop.

see https://github.com/projectriff/cnab-k8s-installer-base/blob/c263a4c721b62a1f5944347fcb758dbca670e365/pkg/kab/patch_manifest.go#L33

$ kubectl get node
NAME             STATUS   ROLES    AGE   VERSION
docker-desktop   Ready    master   37m   v1.14.1

due to a bug in duffle the images were not pinned in the exported/published bundle file. duffle 0.2.0-beta.4 has fixed this issue.