3a5432270e
install.sh now renders the checksum-verified upstream assets through kustomize overlays: CRDs first and verbatim, then serving-core and kourier with the six CPU requests lowered live on 2026-09-21, the Kourier Service as ClusterIP and the Envoy image pinned. verify.sh checks the requests read-only, and tests/test_knative_render.py proves the render offline against upstream and rail-knative's declaration. Not run against the cluster. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
42 lines
2 KiB
Bash
Executable file
42 lines
2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Render exactly what install.sh applies, without touching any cluster.
|
|
# render.sh <stage-dir>
|
|
# Downloads the upstream v1.22.0 assets (reusing files already in <stage-dir>
|
|
# only when their pinned SHA-256 matches), verifies every checksum, and writes:
|
|
# <stage-dir>/crds.yaml upstream CRDs, verbatim (applied first)
|
|
# <stage-dir>/serving-core.rendered.yaml serving-core + declared CPU requests
|
|
# <stage-dir>/kourier.rendered.yaml kourier + CPU requests, ClusterIP, Envoy pin
|
|
# Needs curl, sha256sum and a local kubectl with built-in kustomize.
|
|
set -euo pipefail
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$root/release-lock.env"
|
|
stage="${1:?usage: render.sh <stage-dir>}"
|
|
mkdir -p "$stage"
|
|
|
|
fetch() {
|
|
local url="$1" out="$2" sum="$3"
|
|
if ! printf '%s %s\n' "$sum" "$out" | sha256sum --check --status 2>/dev/null; then
|
|
curl -fsSL --retry 3 "$url" -o "$out"
|
|
printf '%s %s\n' "$sum" "$out" | sha256sum --check --status \
|
|
|| { echo "checksum mismatch: $url" >&2; rm -f "$out"; exit 1; }
|
|
fi
|
|
}
|
|
serving="https://github.com/knative/serving/releases/download/knative-v${KNATIVE_VERSION}"
|
|
kourier="https://github.com/knative-extensions/net-kourier/releases/download/knative-v${KNATIVE_VERSION}"
|
|
fetch "$serving/serving-crds.yaml" "$stage/crds.yaml" "$SERVING_CRDS_SHA256"
|
|
fetch "$serving/serving-core.yaml" "$stage/core.yaml" "$SERVING_CORE_SHA256"
|
|
fetch "$kourier/kourier.yaml" "$stage/kourier.yaml" "$KOURIER_SHA256"
|
|
|
|
build() {
|
|
local overlay="$1" asset="$2" out="$3" dir="$stage/overlay-$1"
|
|
rm -rf "$dir"
|
|
cp -r "$root/overlays/$overlay" "$dir"
|
|
cp "$stage/$asset" "$dir/upstream.yaml"
|
|
if [ "$overlay" = kourier ]; then
|
|
printf 'images:\n - name: docker.io/envoyproxy/envoy\n newName: %s\n digest: %s\n' \
|
|
"${ENVOY_IMAGE%@*}" "${ENVOY_IMAGE#*@}" >> "$dir/kustomization.yaml"
|
|
fi
|
|
kubectl kustomize "$dir" > "$stage/$out"
|
|
}
|
|
build serving-core core.yaml serving-core.rendered.yaml
|
|
build kourier kourier.yaml kourier.rendered.yaml
|