Commit Graph

19 Commits

Author SHA1 Message Date
chrisfu
40ea30e4c3 feat(auth): init scripts and k3s/k8s auth manifests for knoe-auth
init_knoe_auth.sh: provisions KDC secrets via 1Password, applies GKE manifests
init_knoe_users.sh: creates Kerberos principals for initial contributors
kerberos-configmap.yaml: krb5.conf for OpenBao Kerberos auth (KNOE.DEV realm)
prole-auth-deployment.yaml: k3s auth + kdc sidecar deployment for homelab
prole-kdc-configmap.yaml: k3s KDC config for homelab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-27 14:47:27 -07:00
chrisfu
55b6a6aff3 Complete rebranding from prole to knoe and fix macOS application identity. Bulk renamed 'prole' to 'knoe' across code, scripts, and manifests. Updated Makefile with 'knoe', 'build', and 'start' targets. Implemented macOS Application Bundle (.app) support for correct identity. Fixed macOS 'Python' process name to 'Knoe.DB Installer' via Objective-C bridge. Standardized application name to 'Knoe.DB Installer' across all interfaces.
Co-authored-by: Junie <junie@jetbrains.com>
2026-04-22 15:08:35 -07:00
chrisfu
15890187a3 Stabilize CNPG reset/update flow and finalize 3-node recovery
- add idempotent CNPG operator reconciliation to prevent duplicate active controller ReplicaSets
- restore and validate CNPG 3-instance convergence with PV claimRef recovery and storage path readiness
- wire canonical launcher aliases/reset behavior and improve namespace cleanup semantics
- harden backup/objectstore readiness handling and retry behavior
- enforce service namespace usage for common services and remove default-namespace drift
- enable Kerberos milestone auto-activation when realm/kdc are configured and apply CNPG GSS pg_hba rules
- keep final runtime healthy: knoe-db 3/3, operator stable, perfsnap captured

Co-authored-by: Junie <junie@jetbrains.com>
2026-03-27 21:54:53 -07:00
chrisfu
46f31843c2 Fix Kerberos test flow and improve multi-namespace support in k3s
- Resolve namespace drift in Kerberos test flow and OpenBao deployment.
- Fix OpenAPI credential-validation failures in etc scripts by using --validate=false with kubectl.
- Introduce preferred_service_namespace() to accurately target namespaces for KDC policy/test paths.
- Default Kerberos test user to 'administrator' and prefill from Ansible vault secrets.
- Generalized OpenBao deployment logic to correctly handle multi-namespace environments.
- Added regression test 'tests/etc/test_init_kerberos_k3s_real_kdc.sh'.
- Synchronized SERVICE_NAMESPACE extraction in prole_cfg.sh.

Co-authored-by: Junie <junie@jetbrains.com>
2026-03-01 00:57:10 -08:00
chrisfu
765aa0b926 Checkpoint: cluster env UI layout + k3s common services
- Tighten Cluster Environment screen layout; switch Service/Prod to kubectx context selection; keep namespace and key controls on one line; ensure Repair button remains reachable.

- Add UI layout regression test to render with large mock data and assert key widgets remain visible and console is scrollable.

- Make kubeconfig generation deterministic under tests by avoiding overwriting cert-based kubeconfigs; write token sidecar kubeconfig when needed.

- Update common-services init scripts and add k3s/Helm deployment bits (svc-check, Kong/CertMgr tasks).
2026-02-27 14:35:14 -08:00
chrisfu
ec8a4e98af k3s: Fix installation hangs, CA mismatches, and arm64 networking
- Implement proactive CA hash verification and automated repair for mismatches

- Ensure agents prioritize discovered server tokens over stale vault values

- Fix K3s service hangs with explicit stop and killall before reinstall

- Add Retropie/Pi networking fixes (WiFi power save, wlan0 priority)

- Pin pre-staged images to stable, architecture-aware versions (arm64)

- Remove obsolete init-port-forwards and prole.cfg sync tasks

- Update k8s manifests and installer core logic with new tests
2026-02-16 23:30:27 -08:00
chrisfu
6b89ea23d7 Stabilize deliverable k3d pipeline and refactor installer components
- Finalized stable, repeatable reset logic for the k3d pipeline.

- Refactored installer into modular components: core, milestone, runner, and state.

- Introduced new UI abstractions with support for ncurses and Tkinter.

- Updated initialization scripts and configurations for CloudNativePG, Kerberos, OpenBao, and Monitoring.

- Improved pipeline repair and port-forwarding mechanisms.
2026-02-15 00:03:24 -08:00
chrisfu
87e2f5d385 Checkpoint: Refactor common services and monitoring initialization. Updates: etc/init_monitoring.sh (Grafana naming, legacy cleanup), etc/init_common_services.sh (migration/cleanup logic), added etc/init_registry.sh, updated etc/init_cloudnative_pg.sh (manifest filtering), updated configs, and enhanced tests. Fixed: excluded .ansible logs and added to .gitignore. 2026-02-09 18:50:44 -08:00
chrisfu
d88f5b6424 Add scripts for managing common services and enhance service namespace handling
- Introduced scripts `init_common_services.sh` and `status_common_services.sh` for deploying and checking common services (OpenBao, OpenTofu, registry) within Kubernetes namespaces.
- Improved service namespace configuration in `install.py` and updated initialization logic.
- Updated `prole.cfg` and `kerberos-configmap.yaml` with necessary changes to integrate the new features.
2026-02-07 23:20:08 -08:00
chrisfu
da2f6600ba feat: infrastructure and installer updates for k3s, OpenTofu, and prole-db
- Add k3s start/stop Ansible playbooks and roles.

- Implement OpenTofu initialization scripts and k8s manifests.

- Update ncurses installer with OpenTofu support and improved k3s integration.

- Add mode support (--mode) to etc/ initialization scripts.

- Update prole-db with recovery, barman objectstore, and SSH OpenBao support.

- Refine k8s manifests for OpenBao and prole-db.
2026-02-05 21:27:18 -08:00
chrisfu
5ab6381982 Fix YAML parsing errors in init_authority.sh and improve SSH key management. Resolved 'invalid Yaml document separator' and 'could not find expected :' errors in etc/init_authority.sh by using printf to inject multi-line SSH keys safely. Added 'ansible' user setup. Updated etc/init_openbao.sh to store ansible keys. Created prole/tests/test_init_authority.sh for validation. 2026-02-02 13:15:31 -08:00
chrisfu
96aaf488d6 Bump Prole-DB image version to 17.7-059, enable at-rest encryption, and comment out Kerberos and pg_prolelog configurations. Update kdc and admin_server IPs in Kerberos config.
'Add CNPG build/init test and skip tiger geocoder' -m 'Test script usage: scripts/test-cnpg-prole-db.sh' -m 'Env overrides: CNPG_TEST_NAMESPACE, CNPG_CLUSTER_NAME, CNPG_MANIFEST_URL, CNPG_VERSION, IMAGE_LOAD (kind|minikube|k3d), IMAGE_LOAD_CMD, CNPG_INSTANCES'
2026-02-02 01:18:22 -08:00
chrisfu
fff18fdbe4 Update Prole-DB and improve Supabase integration
- Bumped Prole-DB image version to 17.7-053 in scripts, Dockerfile, and manifests.
- Replaced `prole-scan` with `prole-agent` throughout scripts and tests.
- Refined Kubernetes setup for Supabase to use namespace 'supabase'.
- Introduced conversion of Supabase Docker Compose to Kubernetes manifests with `kompose`.
- Added support for Kerberos toggle via environment variables in `init_kerberos.sh`.
- Improved error handling and logging in scripts for better maintainability.
2026-02-01 23:56:25 -08:00
chrisfu
9c1f58caf4 Checkpoint: namespace management improvements and prole-db updates. Enhanced namespace management with automated namespace detection and configuration in etc/prole_cfg.sh and etc/init_prole-db.sh. Added namespace reset and recovery scripts: scripts/reset-ns.sh, etc/init_prole-db-reset.sh, and k8s/prole/prole-db-recovery.yaml.tpl. Updated prole-db image versioning to use release files and bumped version to 17.7-041. Improved installer UI and configuration handling in install.py and installer/screen.py. Updated Kerberos and CloudNativePG initialization scripts for better namespace support. Added /prole/backup/ to .gitignore. 2026-01-31 19:22:05 -08:00
chrisfu
f0e75f6107 feat: complete end-to-end installation and storage integration. This commit marks a significant milestone where the end-to-end installation process is now fully functional. Key changes: Integrated Garage storage service (S3-compatible); Implemented Prole DB backup; Enhanced Kerberos integration; Updated default namespace to prole-chrisfu-deadbeef; Streamlined dependencies (removed Ollama); Added installation validation and testing scripts; Improved installer UI and deployment logic. 2026-01-29 22:50:05 -08:00
chrisfu
dda938ee95 Integrate namespace setup and management into scripts, Dockerfile, and update installer UI. 2026-01-28 23:02:50 -08:00
chrisfu
a4d0a2e0a3 Update prole-db docker tag to 17.7-037 and update pg_prolelog deb package 2026-01-15 11:58:39 -08:00
chrisfu
906392d462 feat(installer): improve UI and add test coverage for core features
- Refactored installer UI with updated canvas rendering, sidebar navigation, and footer buttons.
- Enhanced styling for macOS compatibility and consistent design across controls.
- Added Pytest-based unit tests for `screen.py` and `config.py`.
- Expanded dependency catalog with new tools like `tshark` and `pyshark`.
- Improved error tolerance for background rendering and added placeholders for Kerberos configuration.
2026-01-08 21:51:30 -08:00
chrisfu
3a1f5ea444 Milestone: Integrated CloudNative-PG initialization and build flow into Prole installer. Added new initialization screens, refactored scripts, and updated k8s manifests. 2025-12-20 20:33:19 -08:00