| commit | 568c38c74f95612fc3c236539b037ebe490302ee | [log] [tgz] |
|---|---|---|
| author | Serge Bazanski <serge@monogon.tech> | Mon Feb 05 14:40:39 2024 +0100 |
| committer | Serge Bazanski <serge@monogon.tech> | Thu Feb 08 11:10:07 2024 +0000 |
| tree | 8380bdc8956c3843cce7fae9cf4c700576d22d87 | |
| parent | 7eeef0f448a4ec1737e2e63961f24f51eec5deae [diff] |
m/c/metroctl: use TOFU CA for Kubernetes with node pinning hack Now that we have a persisted CA certificate in metroctl, we can use it when generating a kubeconfig to verify the cluster. There's a catch though: the presented node certificates do not have any 'global' name (just per-node names), and we can't easily tell Kubernetes to trust any name from a given CA. Thus, we introduce a hack to pin the name of the node we're connecting to within the generated kubeconfig. Change-Id: Iea6aa5c0012c793fcb42a94c3c9bf35ea5787ab1 Reviewed-on: https://review.monogon.dev/c/monogon/+/2744 Reviewed-by: Lorenz Brun <lorenz@monogon.tech> Tested-by: Jenkins CI
This is the main repository containing the source code for the Monogon Platform.
This is pre-release software - take a look, and check back later!
Our build environment is self-contained and requires only minimal host dependencies:
/dev/kvm (if you want to run tests).Our docs assume that Bazelisk is available as bazel on your PATH.
Refer to SETUP.md for detailed instructions.
Build CLI and node image:
bazel build //metropolis/cli/dbg //:launch --config dbg
Launch an ephemeral test node:
bazel test //:launch --config dbg --test_output=streamed
Run a kubectl command while the test is running:
bazel-bin/metropolis/cli/dbg/dbg_/dbg kubectl describe node
Run full test suite:
bazel test --config dbg //...