Modified gencerts.sh so that the same script can be used both inside a pod container and called manually

Author: yuchaoran2011

Dockerfile

@@ -26,7 +26,6 @@ RUN dep ensure -vendor-only
 COPY . ./
 RUN go generate && CGO_ENABLED=0 GOOS=linux go build -o /usr/bin/spark-operator
 
-
 FROM gcr.io/spark-operator/spark:v2.3.1
 COPY --from=builder /usr/bin/spark-operator /usr/bin/
 RUN apk add --update openssl && rm -rf /var/cache/apk/*

hack/gencerts.sh

@@ -17,11 +17,61 @@
 # Generates a CA certificate, a server key, and a server certificate signed by the CA.
 
 set -e
+SCRIPT=`basename ${BASH_SOURCE[0]}`
+
+function usage {
+  cat<< EOF
+  Usage: $SCRIPT
+  Options:
+  -h | --help               	 This help info.
+  -n | --namespace <namespace>   The namespace where the Spark operator is installed.			
+  -p | --pod-container           whether the script is running inside a pod container or manually invoked
+EOF
+}
+
+function parse_arguments {
+  while [ $# -gt 0 ]
+  do
+    case "$1" in
+      -n|--namespace)
+      if [ -n "$2" ]; then
+        NAMESPACE="$2"
+      else
+        echo "-n or --namespace requires a value."
+        exit 1
+      fi
+      shift 2
+      continue
+      ;;
+      -p|--pod-container) # Whether the script is running inside a pod container or invoked manually
+      export IN_POD=true
+      shift 1
+      continue
+      ;;
+      -h|--help)
+      usage
+      exit 0
+      ;;
+      --)              # End of all options.
+        shift
+        break
+      ;;
+      '')              # End of all options.
+        break
+      ;;
+      *)
+        echo "Unrecognized option: $1"
+        exit 1
+      ;;
+    esac
+  done
+}
+
+# Set the namespace to "sparkoperator" by default if not provided
+IN_POD=false
+NAMESPACE="sparkoperator"
+parse_arguments "$@"
 
-NAMESPACE=$1
-if [ -z $NAMESPACE ]; then
-	NAMESPACE="sparkoperator"
-fi
 
 CN_BASE="spark-webhook"
 TMP_DIR="/tmp/spark-pod-webhook-certs"
@@ -49,34 +99,38 @@ openssl genrsa -out ${TMP_DIR}/server-key.pem 2048
 openssl req -new -key ${TMP_DIR}/server-key.pem -out ${TMP_DIR}/server.csr -subj "/CN=spark-webhook.sparkoperator.svc" -config ${TMP_DIR}/server.conf
 openssl x509 -req -in ${TMP_DIR}/server.csr -CA ${TMP_DIR}/ca-cert.pem -CAkey ${TMP_DIR}/ca-key.pem -CAcreateserial -out ${TMP_DIR}/server-cert.pem -days 100000 -extensions v3_req -extfile ${TMP_DIR}/server.conf
 
-# Base64 encode secrets and then remove the trailing newline to avoid issues in the curl command
-ca_cert=$(cat ${TMP_DIR}/ca-cert.pem | base64 | tr -d '\n')
-ca_key=$(cat ${TMP_DIR}/ca-key.pem | base64 | tr -d '\n')
-server_cert=$(cat ${TMP_DIR}/server-cert.pem | base64 | tr -d '\n')
-server_key=$(cat ${TMP_DIR}/server-key.pem | base64 | tr -d '\n')
+if [ "$IN_POD" == "true" ];  then
+	# Base64 encode secrets and then remove the trailing newline to avoid issues in the curl command
+	ca_cert=$(cat ${TMP_DIR}/ca-cert.pem | base64 | tr -d '\n')
+	ca_key=$(cat ${TMP_DIR}/ca-key.pem | base64 | tr -d '\n')
+	server_cert=$(cat ${TMP_DIR}/server-cert.pem | base64 | tr -d '\n')
+	server_key=$(cat ${TMP_DIR}/server-key.pem | base64 | tr -d '\n')
 
-# Create the secret resource
-echo "Creating a secret for the certificate and keys"
-curl -ik \
-  -X POST \
-  -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
-  -H 'Accept: application/json' \
-  -H 'Content-Type: application/json' \
-  -d '{
-  "kind": "Secret",
-  "apiVersion": "v1",
-  "metadata": {
-    "name": "spark-webhook-certs",
-    "namespace": "'"$NAMESPACE"'"
-  },
-  "data": {
-    "ca-cert.pem": "'"$ca_cert"'",
-    "ca-key.pem": "'"$ca_key"'",
-    "server-cert.pem": "'"$server_cert"'",
-    "server-key.pem": "'"$server_key"'"
-  }
-}' \
-https://kubernetes.default.svc/api/v1/namespaces/${NAMESPACE}/secrets
+	# Create the secret resource
+	echo "Creating a secret for the certificate and keys"
+	curl -ik \
+	  -X POST \
+	  -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
+	  -H 'Accept: application/json' \
+	  -H 'Content-Type: application/json' \
+	  -d '{
+	  "kind": "Secret",
+	  "apiVersion": "v1",
+	  "metadata": {
+	    "name": "spark-webhook-certs",
+	    "namespace": "'"$NAMESPACE"'"
+	  },
+	  "data": {
+	    "ca-cert.pem": "'"$ca_cert"'",
+	    "ca-key.pem": "'"$ca_key"'",
+	    "server-cert.pem": "'"$server_cert"'",
+	    "server-key.pem": "'"$server_key"'"
+	  }
+	}' \
+	https://kubernetes.default.svc/api/v1/namespaces/${NAMESPACE}/secrets
+else
+	kubectl create secret --namespace=${NAMESPACE} generic spark-webhook-certs --from-file=${TMP_DIR}/ca-key.pem --from-file=${TMP_DIR}/ca-cert.pem --from-file=${TMP_DIR}/server-key.pem --from-file=${TMP_DIR}/server-cert.pem
+fi
 
 # Clean up after we're done.
 printf "\nDeleting ${TMP_DIR}.\n"