chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 12:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(init_kdc): prevent stale k3d LOCAL_REGISTRY_INTERNAL from leaking into init_kdc.sh

Browse Source 
In k3s mode, LOCAL_REGISTRY_INTERNAL set to a k3d value in the shell environment
leaked into init_kdc.sh subprocesses, causing pods to use the wrong image address
while the push went to myrddin.prole.org:5000.

Add _resolve_kdc_registry() helper that derives correct registry values from
KNOE_IMAGE_REGISTRY and PROLE_K3S_SERVER. Both init_kdc.sh call sites now pass
explicit overrides to prevent any inherited k3d value from leaking through.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
chrisfu 2026-05-09 12:53:57 -07:00
parent 385f74b4f7
commit 57cd93ae00
1 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
etc/init_knoe_users.sh
View File

@ -194,6 +194,30 @@ get_kdc_pod() {
return 0
}
# _resolve_kdc_registry — sets _kdc_reg_internal and _kdc_reg_host in the
# caller's scope for use as env-var prefixes on init_kdc.sh invocations.
# In k3s mode derives correct values from KNOE_IMAGE_REGISTRY / PROLE_K3S_SERVER
# so stale k3d LOCAL_REGISTRY_INTERNAL values cannot leak into subprocesses.
_resolve_kdc_registry() {
_kdc_reg_internal=""
_kdc_reg_host=""
if [[ "$(resolve_knoe_mode)" == "k3s" ]]; then
if [[ -n "${KNOE_IMAGE_REGISTRY:-}" ]]; then
_kdc_reg_internal="${KNOE_IMAGE_REGISTRY}"
else
local _rns="${REGISTRY_NAMESPACE:-${SERVICE_NAMESPACE:-${KNOE_KDC_NAMESPACE}}}"
_kdc_reg_internal="registry.${_rns}.svc.cluster.local:5000"
fi
local _k3s_url="${PROLE_K3S_SERVER:-${K3S_SERVER:-${K3S_SERVER_URL:-}}}"
if [[ -n "${_k3s_url:-}" ]]; then
_kdc_reg_host="${_k3s_url#https://}"
_kdc_reg_host="${_kdc_reg_host#http://}"
_kdc_reg_host="${_kdc_reg_host%%:*}"
_kdc_reg_host="${_kdc_reg_host}:5000"
fi
fi
}
ensure_kdc_pod() {
local kdc_pod init_kdc_script
kdc_pod=$(get_kdc_pod)
@ -207,6 +231,10 @@ ensure_kdc_pod() {
log "No authority pod found in namespace ${KNOE_KDC_NAMESPACE}; bootstrapping ${KNOE_AUTH_DEPLOYMENT} via init_kdc.sh ..." >&2
_resolve_kdc_registry
LOCAL_REGISTRY_INTERNAL="${_kdc_reg_internal}" \
PROLE_KDC_REGISTRY_INTERNAL="${_kdc_reg_internal}" \
PROLE_KDC_REGISTRY_HOST="${_kdc_reg_host}" \
PROLE_KDC_NAMESPACE="$KNOE_KDC_NAMESPACE" \
PROLE_KDC_MASTER_PASSWORD="$PROLE_KDC_MASTER_PASSWORD" \
PROLE_KDC_NAME="$KNOE_AUTH_DEPLOYMENT" \
@ -346,6 +374,10 @@ initialize() {
log "Re-initialising KDC database via init_kdc.sh ..."
local init_kdc_script="$SCRIPT_DIR/init_kdc.sh"
[[ -f "$init_kdc_script" ]] || die "Required script not found: $init_kdc_script"
_resolve_kdc_registry
LOCAL_REGISTRY_INTERNAL="${_kdc_reg_internal}" \
PROLE_KDC_REGISTRY_INTERNAL="${_kdc_reg_internal}" \
PROLE_KDC_REGISTRY_HOST="${_kdc_reg_host}" \
PROLE_KDC_NAMESPACE="$KNOE_KDC_NAMESPACE" \
PROLE_KDC_MASTER_PASSWORD="$PROLE_KDC_MASTER_PASSWORD" \
PROLE_KDC_NAME="$KNOE_AUTH_DEPLOYMENT" \