diff --git a/etc/init_cloudnative_pg.sh b/etc/init_cloudnative_pg.sh index f262c89..6f5b948 100755 --- a/etc/init_cloudnative_pg.sh +++ b/etc/init_cloudnative_pg.sh @@ -65,8 +65,12 @@ else fi SECRETS_DIR="$PROLE_SERVICE/secrets" -ADMIN_PRIV="$SECRETS_DIR/admin_ed25519.key" -ADMIN_PUB="$SECRETS_DIR/admin_ed25519.pub" +# Resolving CNPG admin keys. +# We prefer names without algorithm suffixes to be more generic, matching install.py fallback strategy. +ADMIN_PRIV_ED25519="$SECRETS_DIR/admin_ed25519.key" +ADMIN_PUB_ED25519="$SECRETS_DIR/admin_ed25519.pub" +ADMIN_PRIV_GENERIC="$SECRETS_DIR/admin.key" +ADMIN_PUB_GENERIC="$SECRETS_DIR/admin.pub" OPENBAO_TOKEN_FILE="$SECRETS_DIR/openbao-root-token" ensure_tools() { @@ -110,9 +114,18 @@ fetch_admin_keys_and_db_pass_from_bao_or_local() { local priv_b64 pub_b64 priv_b64=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -r '.data.data.admin_private_key_b64') pub_b64=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -r '.data.data.admin_public_key_b64') - printf "%s" "$priv_b64" | base64 -d >"$ADMIN_PRIV" - printf "%s" "$pub_b64" | base64 -d >"$ADMIN_PUB" - chmod 0600 "$ADMIN_PRIV" + # Use a temporary file to determine where to save based on existing legacy or generic preference + local target_priv="$ADMIN_PRIV_GENERIC" + local target_pub="$ADMIN_PUB_GENERIC" + + # If legacy keys exist, we might want to overwrite them too for compatibility + printf "%s" "$priv_b64" | base64 -d >"$target_priv" + printf "%s" "$pub_b64" | base64 -d >"$target_pub" + chmod 0600 "$target_priv" + + # Mirror to legacy path if it was expected by other scripts + cp "$target_priv" "$ADMIN_PRIV_ED25519" 2>/dev/null || true + cp "$target_pub" "$ADMIN_PUB_ED25519" 2>/dev/null || true fi echo "Attempting to read database password from OpenBao kv/prole/db ..." @@ -135,10 +148,17 @@ fetch_admin_keys_and_db_pass_from_bao_or_local() { fi fi - if [[ -f "$ADMIN_PRIV" && -f "$ADMIN_PUB" ]]; then + if [[ -f "$ADMIN_PRIV_GENERIC" && -f "$ADMIN_PUB_GENERIC" ]]; then echo "Using local admin key pair at $SECRETS_DIR" return 0 fi + if [[ -f "$ADMIN_PRIV_ED25519" && -f "$ADMIN_PUB_ED25519" ]]; then + echo "Using local legacy admin key pair at $SECRETS_DIR" + # Link or copy to generic for consistent use below + cp "$ADMIN_PRIV_ED25519" "$ADMIN_PRIV_GENERIC" + cp "$ADMIN_PUB_ED25519" "$ADMIN_PUB_GENERIC" + return 0 + fi echo "ERROR: Could not obtain admin key pair from OpenBao and no local files found." >&2 exit 1 } @@ -146,8 +166,8 @@ fetch_admin_keys_and_db_pass_from_bao_or_local() { apply_cnpg_admin_secret() { echo "Creating/updating Secret cnpg-admin-key ..." kubectl create secret generic cnpg-admin-key -n "$NAMESPACE" \ - --from-file=admin.key="$ADMIN_PRIV" \ - --from-file=admin.pub="$ADMIN_PUB" \ + --from-file=admin.key="$ADMIN_PRIV_GENERIC" \ + --from-file=admin.pub="$ADMIN_PUB_GENERIC" \ --dry-run=client -o yaml | kubectl apply -f - } @@ -227,6 +247,17 @@ patch_cnpg_cluster_for_auth() { }" >/dev/null || echo "Note: patch may need adjustment for your CNPG version." } +# Resolve latest CNPG version from GitHub if possible, fallback to a sensible default. +get_latest_cnpg_version() { + local version + version=$(curl -s "https://api.github.com/repos/cloudnative-pg/cloudnative-pg/releases/latest" | jq -r '.tag_name' | sed 's/^v//' || echo "") + if [[ -z "$version" || "$version" == "null" ]]; then + echo "1.27.0" + else + echo "$version" + fi +} + initialize() { ensure_tools ensure_namespace @@ -263,8 +294,13 @@ case "$ACTION" in create) ensure_tools ensure_namespace - echo "Installing CloudNative-PG operator ..." - kubectl apply --server-side -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.27/releases/cnpg-1.27.0.yaml + + LATEST_VERSION=$(get_latest_cnpg_version) + MINOR_VERSION=$(echo "$LATEST_VERSION" | cut -d. -f1,2) + YAML_URL="https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${MINOR_VERSION}/releases/cnpg-${LATEST_VERSION}.yaml" + + echo "Installing CloudNative-PG operator version ${LATEST_VERSION} ..." + kubectl apply --server-side -f "$YAML_URL" echo "Creating CloudNative-PG cluster and resources for '$CNPG_CLUSTER_NAME' ..."