Skip to content

Reach the e2e GKE cluster through the Connect gateway #850

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wallrj-cyberark wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Reach the e2e GKE cluster through the Connect gateway #850

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 12 additions & 7 deletions hack/e2e/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,11 +76,12 @@ popd

export USE_GKE_GCLOUD_AUTH_PLUGIN=True

# The project's org policy forbids GKE nodes with public IPs and a public
# control-plane IP. The nodes rely on a Cloud NAT in the default network to
# reach the Venafi API and the image registries. The DNS endpoint is reachable
# from the GitHub runner and is authorised with IAM.
# Why?: https://cloud.google.com/kubernetes-engine/docs/concepts/network-isolation#dns-based_endpoint
# The project's org policy forbids GKE nodes with public IPs, a public
# control-plane IP and the DNS-based control-plane endpoint. The nodes rely on a
# Cloud NAT in the default network to reach the Venafi API and the image
# registries. The GitHub runner reaches the API server through the Connect
# gateway, which needs the cluster to be registered to the project's fleet.
# Why?: https://cloud.google.com/kubernetes-engine/enterprise/multicluster-management/gateway
if ! gcloud container clusters describe "${CLUSTER_NAME}" &>/dev/null; then
gcloud container clusters create "${CLUSTER_NAME}" \
--preemptible \
Expand All @@ -89,9 +90,13 @@ if ! gcloud container clusters describe "${CLUSTER_NAME}" &>/dev/null; then
--enable-ip-alias \
--enable-private-nodes \
--enable-private-endpoint \
--enable-dns-access
--enable-fleet
fi
gcloud container clusters get-credentials "${CLUSTER_NAME}" --dns-endpoint
# The membership is named after the cluster, but its location is not the
# cluster's zone, so read it back from the cluster.
membership="$(gcloud container clusters describe "${CLUSTER_NAME}" --format='value(fleet.membership)')"
membership_location="$(sed -E 's|.*/locations/([^/]+)/.*|\1|' <<<"${membership}")"
gcloud container fleet memberships get-credentials "${CLUSTER_NAME}" --location "${membership_location}"
kubectl create ns venafi || true

# Pull secret for Venafi OCI registry
Expand Down
Loading