Cert Manager, Botkube, and Tekton Pipelines with Conditions

> cat cert.yaml 
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: wild-YOUR_DOMAIN
#  namespace: cert-manager
spec:
  secretName: wild-YOUR_DOMAIN
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - "YOUR_DOMAIN"
    - "*.YOUR_DOMAIN"

> cat secret.yaml 
apiVersion: v1
kind: Secret
metadata:
  name: botkube-communication-secret
  namespace: botkube
  labels:
    app: botkube
type: Opaque
stringData:
  comm_config.yaml: |
    # Communication settings
    communications:
      # Settings for Slack
      slack:
        enabled: true
        channel: 'general'
        token: 'YOUR_TOKEN'
        notiftype: short

> cat cm.yaml 
# Configmap
apiVersion: v1
kind: ConfigMap
metadata:
  name: botkube-configmap
  namespace: botkube
  labels:
    app: botkube
data:
  resource_config.yaml: |
    ## Resources you want to watch
    resources:
      - name: secret
        namespaces:
          include:
            - default
        events:
          - all
      - name: deployment
        namespaces:
          include:
            - all
        events:
          - create
          - update
          - delete
          - error
        updateSetting:
          includeDiff: true
          fields:
            - spec.template.spec.containers[*].image
            - status.availableReplicas
    recommendations: true

    # Setting to support multiple clusters
    settings:
      clustername: k8s
      allowkubectl: true
      restrictAccess: false
      #kubectl:
      #  enabled: true
      #  defaultNamespace: default
      #  restrictAccess: false
      configwatcher: true
      upgradeNotifier: true

> cat eventlistener.yaml
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: EventListener
metadata:
  name: bot-listener
spec:
  triggers:
    - name: bot-trigger
      interceptors:
        - cel:
            filter: "body.meta.kind == 'Secret'"
            overlays:
            - key: extensions.secret_name
              expression: "body.meta.name"
      bindings:
        - name: bot-pipeline-binding
      template:
        name: bot-pipeline-template

> cat triggerbinding.yaml 
apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerBinding
metadata:
  name: bot-pipeline-binding
spec:
  params:
  - name: body
    value: $(body)
  - name: secret_name
    value: $(body.extensions.secret_name)

> cat triggertemplate.yaml 
apiVersion: triggers.tekton.dev/v1alpha1
kind: TriggerTemplate
metadata:
  name: botkube-pipeline-template
spec:
  params:
  - name: body
    description: "Body of BotKube Post (For testing)"
    default: "Test body"
  - name: secret_name
    description: "Secret Name Changed"
    default: "Me"
  resourcetemplates:
  - apiVersion: tekton.dev/v1beta1
    kind: PipelineRun
    metadata:
      generateName: cert-pr-
    spec:
      pipelineRef:
        name: cert-pipeline
      params:
        - name: secret_name
          value: $(params.secret_name)
      workspaces:
      - name: shared-workspace
        emptyDir: {}

> cat tasks/cert-task.yaml 
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: cert-task
spec:
  workspaces:
    - name: shared
      description: shared workspace
  params:
  - name: secret_name
    description: "secret name of the tls cert"
    type: string
  steps:
  - name: get-pem-files
    image: gcr.io/cloud-builders/kubectl
    script: |
      #!/bin/bash
      SECRET_NAME="$(params.secret_name)"
      KUBECTL="/builder/google-cloud-sdk/bin/kubectl"
      SHARED_DIR="$(workspaces.shared.path)"
      CERT_BASE="${SHARED_DIR}/${SECRET_NAME}"
      CERT_FILE="${CERT_BASE}.crt"
      KEY_FILE="${CERT_BASE}.key"
      BASE64="/usr/bin/base64"
      echo "Getting Certs from Secrets"
      # run command
      ${KUBECTL} get secret -n default ${SECRET_NAME} -o jsonpath="{.data['tls\.crt']}" | ${BASE64} -d > ${CERT_FILE}
      ${KUBECTL} get secret -n default ${SECRET_NAME} -o jsonpath="{.data['tls\.key']}" | ${BASE64} -d > ${KEY_FILE}

  - name: send-mesg
    image: ellerbrock/alpine-bash-curl-ssl
    script: |
      #!/bin/bash
      SECRET_NAME="$(params.secret_name)"
      SHARED_DIR="$(workspaces.shared.path)"
      CERT_BASE="${SHARED_DIR}/${SECRET_NAME}"
      CERT_FILE="${CERT_BASE}.crt"
      KEY_FILE="${CERT_BASE}.key"
      SUBJECT="Let's Encrypt Cert Updated"
      SLACK_MSG="${SHARED_DIR}/msg"
      CURL="/usr/bin/curl"
      OPENSSL="/usr/bin/openssl"
      SED="/bin/sed"
      # Create new slack message
      # Add cert info to the message
      ${OPENSSL} x509 -in ${CERT_FILE} -noout -issuer > ${SLACK_MSG}
      ${OPENSSL} x509 -in ${CERT_FILE} -noout -subject >> ${SLACK_MSG}
      ${OPENSSL} x509 -in ${CERT_FILE} -noout -dates >> ${SLACK_MSG}
      # prepare the mesg for slack
      while IFS= read -r line; do
        body="$body$line\n"
      done < ${SLACK_MSG}
      escapedText=$(echo $body | ${SED} 's/"/\"/g' | ${SED} "s/'/\'/g")
      esSubject=$(echo $SUBJECT | ${SED} 's/"/\"/g' | ${SED} "s/'/\'/g")

      # create JSON payload
      json="{\"blocks\": [{\"type\": \"section\", \"text\": { \"type\": \"mrkdwn\", \"text\": \"*${esSubject}*\n$escapedText\"}}]}"

      # fire off slack message post
      ${CURL} -s -d "payload=$json" "${SLACK_URL}"

    env:
    - name: SLACK_URL
      valueFrom:
        secretKeyRef:
          name: webhook-secret
          key: url

> cat slack-secret.yaml 
kind: Secret
apiVersion: v1
metadata:
  name: webhook-secret
stringData:
  url: YOUR_SLACK_URL

> cat pipeline/condition.yaml 
apiVersion: tekton.dev/v1alpha1
kind: Condition
metadata:
  name: check-cert-secret
spec:
  params:
    - name: secret_name
      type: string
    - name: domain_name
      type: string
  check:
    image: ubuntu
    script: |
      #!/bin/bash
      DOMAIN="$(params.domain_name)"
      SECRET_NAME="wild-${DOMAIN//\./-}"
      # troubleshooting
      if [[ $(params.secret_name) =~ ${SECRET_NAME} ]]; then
        echo "The $(params.secret_name) secret changed, proceeding"
        exit 0
      else
        echo "The $(params.secret_name) secret changed but we are waiting for ${SECRET_NAME} secret, quitting"
        exit 1
      fi

> cat pipeline/cert-pipeline.yaml 
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: cert-pipeline
spec:
  workspaces:
    - name: shared-workspace
      description: shared space between tasks
  params:
    - name: secret_name
      description: "The Secret that changed"
    - name: domain_name
      description: "Domain Name we are monitoring"
      default: "test.domain"
  tasks:
    - name: print-cert-info
      conditions:
      - conditionRef: check-cert-secret
        params:
          - name: secret_name
            value: "$(params.secret_name)"
          - name: domain_name
            value: "$(params.domain_name)"
      taskRef:
        name: cert-task
      workspaces:
        - name: shared
          workspace: shared-workspace
      params:
        - name: secret_name
          value: "$(params.secret_name)"

> cat secret.yaml 
apiVersion: v1
kind: Secret
metadata:
  name: botkube-communication-secret
  namespace: botkube
  labels:
    app: botkube
type: Opaque
stringData:
  comm_config.yaml: |
    # Communication settings
    communications:
      # Settings for Slack
      slack:
        enabled: true
        channel: 'general'
        token: 'YOUR_SLACK_TOKEN'
        notiftype: short
      # Settings for Webhook
      webhook:
        enabled: true
        url: 'http://el-botkube-listener.default.svc.cluster.local:8080'