chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 13:54:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Refactor admin key handling in init_cloudnative_pg.sh to support generic naming and simplify key management. Introduce dynamic CNPG version resolution and fetch the latest release automatically.

Browse Source
This commit is contained in:
chrisfu 2026-01-31 00:58:07 -08:00
parent 0e1b588637
commit 7fcf419c01
1 changed files with 46 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
etc/init_cloudnative_pg.sh
View File

@ -65,8 +65,12 @@ else
fi
SECRETS_DIR="$PROLE_SERVICE/secrets"
ADMIN_PRIV="$SECRETS_DIR/admin_ed25519.key"
ADMIN_PUB="$SECRETS_DIR/admin_ed25519.pub"
# Resolving CNPG admin keys.
# We prefer names without algorithm suffixes to be more generic, matching install.py fallback strategy.
ADMIN_PRIV_ED25519="$SECRETS_DIR/admin_ed25519.key"
ADMIN_PUB_ED25519="$SECRETS_DIR/admin_ed25519.pub"
ADMIN_PRIV_GENERIC="$SECRETS_DIR/admin.key"
ADMIN_PUB_GENERIC="$SECRETS_DIR/admin.pub"
OPENBAO_TOKEN_FILE="$SECRETS_DIR/openbao-root-token"
ensure_tools() {
@ -110,9 +114,18 @@ fetch_admin_keys_and_db_pass_from_bao_or_local() {
local priv_b64 pub_b64
priv_b64=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -r '.data.data.admin_private_key_b64')
pub_b64=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -r '.data.data.admin_public_key_b64')
printf "%s" "$priv_b64" | base64 -d >"$ADMIN_PRIV"
printf "%s" "$pub_b64" | base64 -d >"$ADMIN_PUB"
chmod 0600 "$ADMIN_PRIV"
# Use a temporary file to determine where to save based on existing legacy or generic preference
local target_priv="$ADMIN_PRIV_GENERIC"
local target_pub="$ADMIN_PUB_GENERIC"
# If legacy keys exist, we might want to overwrite them too for compatibility
printf "%s" "$priv_b64" | base64 -d >"$target_priv"
printf "%s" "$pub_b64" | base64 -d >"$target_pub"
chmod 0600 "$target_priv"
# Mirror to legacy path if it was expected by other scripts
cp "$target_priv" "$ADMIN_PRIV_ED25519" 2>/dev/null || true
cp "$target_pub" "$ADMIN_PUB_ED25519" 2>/dev/null || true
fi
echo "Attempting to read database password from OpenBao kv/prole/db ..."
@ -135,10 +148,17 @@ fetch_admin_keys_and_db_pass_from_bao_or_local() {
fi
fi
if [[ -f "$ADMIN_PRIV" && -f "$ADMIN_PUB" ]]; then
if [[ -f "$ADMIN_PRIV_GENERIC" && -f "$ADMIN_PUB_GENERIC" ]]; then
echo "Using local admin key pair at $SECRETS_DIR"
return 0
fi
if [[ -f "$ADMIN_PRIV_ED25519" && -f "$ADMIN_PUB_ED25519" ]]; then
echo "Using local legacy admin key pair at $SECRETS_DIR"
# Link or copy to generic for consistent use below
cp "$ADMIN_PRIV_ED25519" "$ADMIN_PRIV_GENERIC"
cp "$ADMIN_PUB_ED25519" "$ADMIN_PUB_GENERIC"
return 0
fi
echo "ERROR: Could not obtain admin key pair from OpenBao and no local files found." >&2
exit 1
}
@ -146,8 +166,8 @@ fetch_admin_keys_and_db_pass_from_bao_or_local() {
apply_cnpg_admin_secret() {
echo "Creating/updating Secret cnpg-admin-key ..."
kubectl create secret generic cnpg-admin-key -n "$NAMESPACE" \
--from-file=admin.key="$ADMIN_PRIV" \
--from-file=admin.pub="$ADMIN_PUB" \
--from-file=admin.key="$ADMIN_PRIV_GENERIC" \
--from-file=admin.pub="$ADMIN_PUB_GENERIC" \
--dry-run=client -o yaml | kubectl apply -f -
}
@ -227,6 +247,17 @@ patch_cnpg_cluster_for_auth() {
}" >/dev/null || echo "Note: patch may need adjustment for your CNPG version."
}
# Resolve latest CNPG version from GitHub if possible, fallback to a sensible default.
get_latest_cnpg_version() {
local version
version=$(curl -s "https://api.github.com/repos/cloudnative-pg/cloudnative-pg/releases/latest" | jq -r '.tag_name' | sed 's/^v//' || echo "")
if [[ -z "$version" || "$version" == "null" ]]; then
echo "1.27.0"
else
echo "$version"
fi
}
initialize() {
ensure_tools
ensure_namespace
@ -263,8 +294,13 @@ case "$ACTION" in
create)
ensure_tools
ensure_namespace
echo "Installing CloudNative-PG operator ..."
kubectl apply --server-side -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.27/releases/cnpg-1.27.0.yaml
LATEST_VERSION=$(get_latest_cnpg_version)
MINOR_VERSION=$(echo "$LATEST_VERSION" | cut -d. -f1,2)
YAML_URL="https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${MINOR_VERSION}/releases/cnpg-${LATEST_VERSION}.yaml"
echo "Installing CloudNative-PG operator version ${LATEST_VERSION} ..."
kubectl apply --server-side -f "$YAML_URL"
echo "Creating CloudNative-PG cluster and resources for '$CNPG_CLUSTER_NAME' ..."