chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-24 15:54:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Reorder service initialization and cleanup flows to enforce dependency sequencing, ensuring OpenTofu deploys after OpenBao, Garage, and Kong.

Browse Source
This commit is contained in:
chrisfu 2026-03-22 23:26:02 -07:00
parent 6c8dc9ed06
commit ad812cc504
4 changed files with 32 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
etc/init_service_layer.sh
View File

@ -225,8 +225,13 @@ deploy_service_layer() {
"$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" "$argocd_action" || rc=$? "$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" "$argocd_action" || rc=$?
fi fi
OPENTOFU_NAMESPACE="$ns" OPENTOFU_SECRET_NAMESPACE="${NAMESPACE:-$ns}" OPENTOFU_OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ # -------------------------------------------------------------------------
"$SCRIPT_DIR/init_opentofu.sh" -n "$ns" "$opentofu_action" || rc=$? # Deploy services in dependency order:
# 1. OpenBao – secrets vault; needed by downstream services
# 2. Garage – object storage
# 3. Kong – API gateway
# 4. OpenTofu – IaC engine; depends on registry + secrets (last)
# -------------------------------------------------------------------------
OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_openbao.sh" -n "$ns" "$openbao_action" || rc=$? "$SCRIPT_DIR/init_openbao.sh" -n "$ns" "$openbao_action" || rc=$?
@ -240,6 +245,9 @@ deploy_service_layer() {
KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kong.sh" -n "$ns" "$kong_action" || rc=$? "$SCRIPT_DIR/init_kong.sh" -n "$ns" "$kong_action" || rc=$?
OPENTOFU_NAMESPACE="$ns" OPENTOFU_SECRET_NAMESPACE="${NAMESPACE:-$ns}" OPENTOFU_OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_opentofu.sh" -n "$ns" "$opentofu_action" || rc=$?
if [[ "$ENABLE_KERBEROS" == "1" ]]; then if [[ "$ENABLE_KERBEROS" == "1" ]]; then
# KDC is embedded in `knoe-auth` by default. Only deploy standalone KDC when requested. # KDC is embedded in `knoe-auth` by default. Only deploy standalone KDC when requested.
if [[ "${PROLE_KDC_STANDALONE:-0}" == "1" ]]; then if [[ "${PROLE_KDC_STANDALONE:-0}" == "1" ]]; then
@ -260,16 +268,17 @@ cleanup_old_namespace() {
ARGOCD_NAMESPACE="$ARGOCD_NS" SERVICE_NAMESPACE="$ns" \ ARGOCD_NAMESPACE="$ARGOCD_NS" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" stop || true "$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" stop || true
fi fi
# Cleanup in reverse dependency order (OpenTofu first, then downstream deps)
OPENTOFU_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ OPENTOFU_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_opentofu.sh" -n "$ns" stop || true "$SCRIPT_DIR/init_opentofu.sh" -n "$ns" stop || true
KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kong.sh" -n "$ns" stop || true
NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_garage_store.sh" stop || true
OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_openbao.sh" -n "$ns" stop || true "$SCRIPT_DIR/init_openbao.sh" -n "$ns" stop || true
CERTMGR_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ CERTMGR_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_certmgr.sh" -n "$ns" stop || true "$SCRIPT_DIR/init_certmgr.sh" -n "$ns" stop || true
NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_garage_store.sh" stop || true
KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kong.sh" -n "$ns" stop || true
if [[ "$ENABLE_KERBEROS" == "1" && "${PROLE_KDC_STANDALONE:-0}" == "1" ]]; then if [[ "$ENABLE_KERBEROS" == "1" && "${PROLE_KDC_STANDALONE:-0}" == "1" ]]; then
SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \ SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kdc.sh" cleanup || true "$SCRIPT_DIR/init_kdc.sh" cleanup || true

2
etc/status_common_services.sh
View File

@ -420,7 +420,7 @@ _recheck_pods() {
# Print the name of each component that currently has blocked pods. # Print the name of each component that currently has blocked pods.
_blocked_comps() { _blocked_comps() {
for _bc in registry openbao opentofu garage auth kong certmgr; do for _bc in registry openbao garage opentofu auth kong certmgr; do
[[ "$_bc" == "auth" && "$ENABLE_KERBEROS" != "1" ]] && continue [[ "$_bc" == "auth" && "$ENABLE_KERBEROS" != "1" ]] && continue
[[ "$_bc" == "registry" && ( "$REGISTRY_CHECK" -ne 1 || "$MODE" == "k3d" ) ]] && continue [[ "$_bc" == "registry" && ( "$REGISTRY_CHECK" -ne 1 || "$MODE" == "k3d" ) ]] && continue
[[ ${BLOCKED_COUNT["$_bc"]:-0} -gt 0 ]] && echo "$_bc" [[ ${BLOCKED_COUNT["$_bc"]:-0} -gt 0 ]] && echo "$_bc"

21
mock_val/init_service_layer.sh
View File

@ -225,8 +225,13 @@ deploy_service_layer() {
"$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" "$argocd_action" || rc=$? "$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" "$argocd_action" || rc=$?
fi fi
OPENTOFU_NAMESPACE="$ns" OPENTOFU_SECRET_NAMESPACE="${NAMESPACE:-$ns}" OPENTOFU_OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ # -------------------------------------------------------------------------
"$SCRIPT_DIR/init_opentofu.sh" -n "$ns" "$opentofu_action" || rc=$? # Deploy services in dependency order:
# 1. OpenBao – secrets vault; needed by downstream services
# 2. Garage – object storage
# 3. Kong – API gateway
# 4. OpenTofu – IaC engine; depends on registry + secrets (last)
# -------------------------------------------------------------------------
OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_openbao.sh" -n "$ns" "$openbao_action" || rc=$? "$SCRIPT_DIR/init_openbao.sh" -n "$ns" "$openbao_action" || rc=$?
@ -240,6 +245,9 @@ deploy_service_layer() {
KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kong.sh" -n "$ns" "$kong_action" || rc=$? "$SCRIPT_DIR/init_kong.sh" -n "$ns" "$kong_action" || rc=$?
OPENTOFU_NAMESPACE="$ns" OPENTOFU_SECRET_NAMESPACE="${NAMESPACE:-$ns}" OPENTOFU_OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_opentofu.sh" -n "$ns" "$opentofu_action" || rc=$?
if [[ "$ENABLE_KERBEROS" == "1" ]]; then if [[ "$ENABLE_KERBEROS" == "1" ]]; then
SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \ SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kdc.sh" "$kdc_action" || rc=$? "$SCRIPT_DIR/init_kdc.sh" "$kdc_action" || rc=$?
@ -255,16 +263,17 @@ cleanup_old_namespace() {
ARGOCD_NAMESPACE="$ARGOCD_NS" SERVICE_NAMESPACE="$ns" \ ARGOCD_NAMESPACE="$ARGOCD_NS" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" stop || true "$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" stop || true
fi fi
# Cleanup in reverse dependency order (OpenTofu first, then downstream deps)
OPENTOFU_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ OPENTOFU_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_opentofu.sh" -n "$ns" stop || true "$SCRIPT_DIR/init_opentofu.sh" -n "$ns" stop || true
KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kong.sh" -n "$ns" stop || true
NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_garage_store.sh" stop || true
OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_openbao.sh" -n "$ns" stop || true "$SCRIPT_DIR/init_openbao.sh" -n "$ns" stop || true
CERTMGR_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \ CERTMGR_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_certmgr.sh" -n "$ns" stop || true "$SCRIPT_DIR/init_certmgr.sh" -n "$ns" stop || true
NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_garage_store.sh" stop || true
KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kong.sh" -n "$ns" stop || true
if [[ "$ENABLE_KERBEROS" == "1" ]]; then if [[ "$ENABLE_KERBEROS" == "1" ]]; then
SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \ SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
"$SCRIPT_DIR/init_kdc.sh" cleanup || true "$SCRIPT_DIR/init_kdc.sh" cleanup || true

2
mock_val/status_common_services.sh
View File

@ -420,7 +420,7 @@ _recheck_pods() {
# Print the name of each component that currently has blocked pods. # Print the name of each component that currently has blocked pods.
_blocked_comps() { _blocked_comps() {
for _bc in registry openbao opentofu garage auth kong certmgr; do for _bc in registry openbao garage opentofu auth kong certmgr; do
[[ "$_bc" == "auth" && "$ENABLE_KERBEROS" != "1" ]] && continue [[ "$_bc" == "auth" && "$ENABLE_KERBEROS" != "1" ]] && continue
[[ "$_bc" == "registry" && ( "$REGISTRY_CHECK" -ne 1 || "$MODE" == "k3d" ) ]] && continue [[ "$_bc" == "registry" && ( "$REGISTRY_CHECK" -ne 1 || "$MODE" == "k3d" ) ]] && continue
[[ ${BLOCKED_COUNT["$_bc"]:-0} -gt 0 ]] && echo "$_bc" [[ ${BLOCKED_COUNT["$_bc"]:-0} -gt 0 ]] && echo "$_bc"