cyberark/secretless-broker

#!/bin/bash
set -euo pipefail

CURRENT_DIR="$(dirname "${BASH_SOURCE[0]}")"

function main() {
  retrieve_cyberark_ca_cert
  oc_login
  build_docker_images
}

function retrieve_cyberark_ca_cert() {
  pushd "$CURRENT_DIR/.."
    # On CyberArk dev laptops, golang module dependencies are downloaded with
    # a corporate proxy in the middle. For these connections to succeed we
    # need to configure the proxy CA certificate in build containers.
    #
    # To allow this script to also work on non-CyberArk laptops where the CA
    # certificate is not available, we update container certificates based on
    # a (potentially empty) certificate directory, rather than relying on the
    # CA file itself.
    mkdir -p build_ca_certificate

    # Only attempt to extract the certificate if the security
    # command is available.
    #
    # The certificate file must have the .crt extension to be imported
    # by `update-ca-certificates`.
    if command -v security &> /dev/null
    then
      security find-certificate \
        -a -c "CyberArk Enterprise Root CA" \
        -p > build_ca_certificate/cyberark_root.crt
    fi
  popd
}

function oc_login() {
  if ! oc whoami &> /dev/null; then
    oc login
  fi
  docker login -u _ -p "$(oc whoami -t)" "$DOCKER_REGISTRY_PATH"
}

function build_docker_images() {
  test_app_image="$DOCKER_REGISTRY_PATH/$TEST_APP_NAMESPACE_NAME/$APP_NAME:$TEST_APP_NAMESPACE_NAME"

  echo "Building and pushing image..."

  echo "Building $APP_NAME image"
  pushd "$CURRENT_DIR/.."
    docker build -t "$APP_NAME:$TEST_APP_NAMESPACE_NAME" .
  popd

  docker tag "$APP_NAME:$TEST_APP_NAMESPACE_NAME" "$test_app_image"

  echo "Pushing $test_app_image to OpenShift..."
  docker push "$test_app_image"
}

main