Setting up trusted profiles for the Block Storage for VPC cluster add-on

Automatically creating a secret by using a Shell script

1. Save the following script to a file called generate-secret.sh.

   #!/bin/bash
   
   IBMCLOUD_AUTHTYPE=
   SECRET=
   
   
   error() {
       if [[ $? != 0 ]]; then
           echo $1; exit 1
       fi
   }
   
   #validate_options validates the options provided to the script
   validate_options() {
       if [[ "$#" -eq 1 ]]; then
          if [[ "$1" == "-h" ]] || [[ "$1" == "--help" ]]; then
             usage; exit 1
          fi
       fi
   
       #number of options provided to the script must be 2
       if [[ "$#" -ne 2 ]]; then
           echo "Invalid number of options provided"
           usage; exit 1
       fi
   
       #1st option must be 'iam' or 'pod-identity'
       if [[ "$1" != "iam" ]] && [[ "$1" != "pod-identity" ]]; then
           echo "Provide a valid auth-type"
           usage; exit 1
       fi
   
       IBMCLOUD_AUTHTYPE=$1
       SECRET=$2
   }
   
   #usage - prints the usage for execution of script
   usage() {
       echo "USAGE:
   	bash generate-secret.sh <auth-type> <apikey/profile-id>
   	auth-type: auth-type should be either iam or pod-identity. Provide iam to use api key, pod-identity to use trusted profile"
   }
   
   #main
   main() {
   
       validate_options "$@"
   
       auth_type="IBMCLOUD_AUTHTYPE=$IBMCLOUD_AUTHTYPE"
   
       secret=
   
       if [[ "$IBMCLOUD_AUTHTYPE" == "iam" ]]; then
           secret="IBMCLOUD_APIKEY=$SECRET"
       else
           secret="IBMCLOUD_PROFILEID=$SECRET"
       fi
   
       encodedValue=$(echo -e "$auth_type\n$secret" | base64)
       #on certain os, base64 encoding introduces newline, removing the same here.
       encodedValue=${encodedValue//$'\n'/}
   
       #fetch the controller pod name
       controllerPodName=$(kubectl get pods -n kube-system | grep ibm-vpc-block-csi-controller | awk '{print $1}')
       error "$(date +"%b %d %G %H:%M:%S"):  Unable to fetch controller pod."
       if [[ "$controllerPodName" == "" ]]; then
           echo "$(date +"%b %d %G %H:%M:%S"):  VPC Block CSI Driver addon is not enabled"
           exit 1
       fi
   
       echo "apiVersion: v1
   data:
     ibm-credentials.env: $encodedValue
   kind: Secret
   metadata:
     name: ibm-cloud-credentials
     namespace: kube-system
   type: Opaque" > ibm-cloud-credentials.yaml
   
       #create the k8s secret
       kubectl apply -f ibm-cloud-credentials.yaml &> /dev/null
       error "$(date +"%b %d %G %H:%M:%S"):  Error creating ibm-cloud-credentials secret."
       echo "$(date +"%b %d %G %H:%M:%S"):  Created ibm-cloud-credentials secret"
   
       #restart the controller pod
       echo "$(date +"%b %d %G %H:%M:%S"):  Restarting $controllerPodName pod"
       kubectl delete pod $controllerPodName -n kube-system &> /dev/null
       error "$(date +"%b %d %G %H:%M:%S"):  Error restarting $controllerPodName pod in kube-system namespace."
   
       controllerPodStatus=
       for i in {1..12}
       do
           sleep 5
           controllerPodStatus=$(kubectl get pods -n kube-system | grep ibm-vpc-block-csi-controller | awk '{print $3}')
           if [[ "$controllerPodStatus" == "Running" ]]; then
               echo "$(date +"%b %d %G %H:%M:%S"):  VPC Block CSI Driver is now using ibm-cloud-credentials secret"
               rm ibm-cloud-credentials.yaml
               error "Error deleting ibm-cloud-credentials.yaml."
               exit 0
           fi
       done
   
       error "$(date +"%b %d %G %H:%M:%S"):  Error - ibm-vpc-block-csi-controller is in $controllerPodStatus state"
   }
   
   main "$@"
   

2. Run the generate-secret.sh script and specify iam or pod-identity as the IBMCLOUD_AUTHTYPE and your PROFILE-ID or API-KEY.

   Example command to run generate-secret.sh by using pod-identity with your trusted profiled ID.

   sh ./generate-secret.sh pod-identity PROFILE-ID
   

   Example command to run generate-secret.sh by using iam with an API key.

   sh ./generate-secret.sh iam API-KEY
   

3. After the secret is created in your your cluster, disable and re-enable the add-on.

   ibmcloud ks cluster addon disable vpc-block-csi-driver  --cluster CLUSTER-ID
   

   ibmcloud ks cluster addon enable vpc-block-csi-driver --version 4.4 --cluster CLUSTER-ID
   

4. Get the logs of the driver pod to verify the driver is using the correct credentials by looking for the secret type in the output. For example,"secret-used":"ibm-cloud-credentials","type":"pod-identity"}.

   kubectl logs ibm-vpc-block-csi-controller-0 -c storage-secret-sidecar -n kube-system