mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
383 lines
11 KiB
Bash
Executable File
383 lines
11 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
|
||
set -euo pipefail
|
||
|
||
# init_service_layer.sh
|
||
# Purpose:
|
||
# - Deploy the service layer (Garage, OpenBao, Kong; OpenTofu in non-k8s modes)
|
||
# - Keep service-layer resources grouped in SERVICE_NAMESPACE
|
||
# - Migrate service layer to a new namespace
|
||
|
||
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
||
# Shared option parsing for common core scripts
|
||
# shellcheck disable=SC1090
|
||
source "$SCRIPT_DIR/common_core_lib.sh"
|
||
|
||
# Inject default config if not provided
|
||
_has_config=0
|
||
for _arg in "$@"; do
|
||
[[ "$_arg" == "-c" || "$_arg" == "--config" || "$_arg" == -c=* || "$_arg" == --config=* ]] && _has_config=1
|
||
done
|
||
if [[ $_has_config -eq 0 ]]; then
|
||
_default_cfg="$(common_core_default_config_path "$SCRIPT_DIR" || true)"
|
||
if [[ -n "$_default_cfg" ]]; then
|
||
set -- "-c" "$_default_cfg" "$@"
|
||
fi
|
||
fi
|
||
unset _has_config _arg _default_cfg
|
||
|
||
common_core_preparse_config "$@"
|
||
|
||
# shellcheck disable=SC1090
|
||
source "$SCRIPT_DIR/knoe_cfg.sh"
|
||
|
||
knoe_ensure_kubeconfig >/dev/null 2>&1 || true
|
||
ensure_kube_context || exit 1
|
||
|
||
ACTION=""
|
||
SERVICE_NAMESPACE_OVERRIDE=""
|
||
FROM_NAMESPACE=""
|
||
TO_NAMESPACE=""
|
||
ENABLE_KERBEROS=0
|
||
ENABLE_ARGOCD=0
|
||
|
||
usage() {
|
||
cat <<EOF
|
||
Usage: init_service_layer.sh [-n|--namespace NS] [-k|--kerberos] [-a|--argocd] [--from OLD_NS] [--to NEW_NS] <start|update|restart|status|stop|migrate>
|
||
EOF
|
||
}
|
||
|
||
while [[ $# -gt 0 ]]; do
|
||
case "$1" in
|
||
-c|--config)
|
||
shift
|
||
shift
|
||
;;
|
||
-m|--mode)
|
||
shift
|
||
knoe_set_mode "${1:-}"
|
||
shift
|
||
;;
|
||
-m=*|--mode=*)
|
||
knoe_set_mode "${1#*=}"
|
||
shift
|
||
;;
|
||
-n|--namespace)
|
||
shift
|
||
SERVICE_NAMESPACE_OVERRIDE="${1:-}"
|
||
shift
|
||
;;
|
||
-n=*|--namespace=*)
|
||
SERVICE_NAMESPACE_OVERRIDE="${1#*=}"
|
||
shift
|
||
;;
|
||
-k|--kerberos)
|
||
ENABLE_KERBEROS=1
|
||
shift
|
||
;;
|
||
-a|--argocd)
|
||
ENABLE_ARGOCD=1
|
||
shift
|
||
;;
|
||
--from)
|
||
shift
|
||
FROM_NAMESPACE="${1:-}"
|
||
shift
|
||
;;
|
||
--from=*)
|
||
FROM_NAMESPACE="${1#*=}"
|
||
shift
|
||
;;
|
||
--to)
|
||
shift
|
||
TO_NAMESPACE="${1:-}"
|
||
shift
|
||
;;
|
||
--to=*)
|
||
TO_NAMESPACE="${1#*=}"
|
||
shift
|
||
;;
|
||
start|update|restart|status|stop|migrate|initialize|reload|repair)
|
||
ACTION="$1"
|
||
[[ "$ACTION" == "repair" ]] && ACTION="update"
|
||
shift
|
||
;;
|
||
-h|--help)
|
||
usage
|
||
exit 0
|
||
;;
|
||
*)
|
||
usage
|
||
exit 2
|
||
;;
|
||
esac
|
||
done
|
||
|
||
if [[ -n "$SERVICE_NAMESPACE_OVERRIDE" ]]; then
|
||
SERVICE_NAMESPACE="$SERVICE_NAMESPACE_OVERRIDE"
|
||
fi
|
||
SERVICE_NAMESPACE="${SERVICE_NAMESPACE:-${NAMESPACE:-default}}"
|
||
|
||
if [[ -n "$TO_NAMESPACE" ]]; then
|
||
SERVICE_NAMESPACE="$TO_NAMESPACE"
|
||
fi
|
||
|
||
SERVICE_LAYER_NAMESPACE="$SERVICE_NAMESPACE"
|
||
ARGOCD_NS="${ARGOCD_NAMESPACE:-argocd}"
|
||
# Registry should live in the service-layer namespace unless explicitly overridden.
|
||
REGISTRY_NS="${REGISTRY_NAMESPACE:-${SERVICE_NAMESPACE}}"
|
||
|
||
STATE_DIR=""
|
||
if [[ -n "${KNOE_SERVICE:-}" && -f "$KNOE_SERVICE/knoe_cfg.sh" ]]; then
|
||
STATE_DIR="${KNOE_SERVICE}/secrets"
|
||
else
|
||
STATE_DIR="${SCRIPT_DIR}/secrets"
|
||
fi
|
||
STATE_FILE="${STATE_DIR}/service-layer.namespace"
|
||
|
||
log() { printf '%s\n' "$*"; }
|
||
err() { printf '%s\n' "$*" >&2; }
|
||
|
||
ensure_tools() {
|
||
command -v kubectl >/dev/null || { err "Missing required tool: kubectl"; exit 1; }
|
||
}
|
||
|
||
ensure_namespace() {
|
||
local ns="$1"
|
||
if ! kubectl get namespace "$ns" >/dev/null 2>&1; then
|
||
log "Creating namespace '$ns' ..."
|
||
kubectl create namespace "$ns" >/dev/null 2>&1 || true
|
||
fi
|
||
}
|
||
|
||
label_namespace() {
|
||
local ns="$1"
|
||
kubectl label namespace "$ns" knoe.layer=service --overwrite >/dev/null 2>&1 || true
|
||
}
|
||
|
||
read_last_namespace() {
|
||
if [[ -f "$STATE_FILE" ]]; then
|
||
cat "$STATE_FILE"
|
||
fi
|
||
}
|
||
|
||
write_last_namespace() {
|
||
mkdir -p "$STATE_DIR"
|
||
printf '%s' "$1" >"$STATE_FILE"
|
||
}
|
||
|
||
|
||
|
||
deploy_service_layer() {
|
||
local action="$1"
|
||
local ns="$2"
|
||
local rc=0
|
||
local manage_opentofu=1
|
||
|
||
if [[ "${KNOE_MODE:-}" == "k8s" ]]; then
|
||
manage_opentofu=0
|
||
fi
|
||
|
||
ensure_namespace "$ns"
|
||
label_namespace "$ns"
|
||
|
||
local argocd_action opentofu_action garage_action kdc_action openbao_action redis_action kong_action registry_action
|
||
case "$action" in
|
||
start|initialize|update|reload) argocd_action="update" ;;
|
||
restart) argocd_action="restart" ;;
|
||
stop) argocd_action="stop" ;;
|
||
status) argocd_action="status" ;;
|
||
*) argocd_action="update" ;;
|
||
esac
|
||
|
||
if [[ "$manage_opentofu" == "1" ]]; then
|
||
case "$action" in
|
||
start|initialize|update|reload) opentofu_action="update" ;;
|
||
restart) opentofu_action="restart" ;;
|
||
stop) opentofu_action="stop" ;;
|
||
status) opentofu_action="status" ;;
|
||
*) opentofu_action="update" ;;
|
||
esac
|
||
fi
|
||
|
||
case "$action" in
|
||
start|initialize|update|reload) openbao_action="update" ;;
|
||
restart) openbao_action="restart" ;;
|
||
stop) openbao_action="stop" ;;
|
||
status) openbao_action="status" ;;
|
||
*) openbao_action="update" ;;
|
||
esac
|
||
|
||
case "$action" in
|
||
start|initialize|update|reload) redis_action="update" ;;
|
||
restart) redis_action="restart" ;;
|
||
stop) redis_action="stop" ;;
|
||
status) redis_action="status" ;;
|
||
*) redis_action="update" ;;
|
||
esac
|
||
|
||
case "$action" in
|
||
start|initialize|update|reload) garage_action="start" ;;
|
||
restart) garage_action="restart" ;;
|
||
stop) garage_action="stop" ;;
|
||
status) garage_action="status" ;;
|
||
*) garage_action="start" ;;
|
||
esac
|
||
|
||
case "$action" in
|
||
start|initialize|update|reload) kong_action="update" ;;
|
||
restart) kong_action="restart" ;;
|
||
stop) kong_action="stop" ;;
|
||
status) kong_action="status" ;;
|
||
*) kong_action="update" ;;
|
||
esac
|
||
|
||
case "$action" in
|
||
start|initialize|update|reload) registry_action="update" ;;
|
||
restart) registry_action="restart" ;;
|
||
stop) registry_action="stop" ;;
|
||
status) registry_action="status" ;;
|
||
*) registry_action="update" ;;
|
||
esac
|
||
|
||
case "$action" in
|
||
stop) kdc_action="cleanup" ;;
|
||
status) kdc_action="status" ;;
|
||
*) kdc_action="update" ;;
|
||
esac
|
||
|
||
if [[ "$ENABLE_ARGOCD" == "1" ]]; then
|
||
ARGOCD_NAMESPACE="$ARGOCD_NS" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" "$argocd_action" || rc=$?
|
||
fi
|
||
|
||
# -------------------------------------------------------------------------
|
||
# Deploy services in dependency order:
|
||
# 1. Registry – no dependencies; other services pull images from it
|
||
# 2. OpenBao – secrets vault; needed by downstream services
|
||
# 3. Garage – object storage
|
||
# 4. Kong – API gateway
|
||
# 5. OpenTofu – IaC engine; depends on registry + secrets (non-k8s, last)
|
||
# -------------------------------------------------------------------------
|
||
|
||
if [[ -x "$SCRIPT_DIR/init_registry.sh" ]]; then
|
||
REGISTRY_NAMESPACE="$REGISTRY_NS" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_registry.sh" -n "$REGISTRY_NS" "$registry_action" || rc=$?
|
||
fi
|
||
|
||
OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_openbao.sh" -n "$ns" "$openbao_action" || rc=$?
|
||
|
||
# Redis — shared pub/sub broker; deploy before Kong so GitLab and knoe services can reach it
|
||
if [[ -x "$SCRIPT_DIR/init_redis.sh" ]]; then
|
||
REDIS_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_redis.sh" -n "$ns" "$redis_action" || rc=$?
|
||
else
|
||
log "[WARN] init_redis.sh not found; Redis deploy skipped."
|
||
fi
|
||
|
||
# cert-manager is cluster-scoped and managed independently via init_certmgr.sh
|
||
# in its own dedicated 'cert-manager' namespace; it is not part of the service layer.
|
||
|
||
NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_garage_store.sh" "$garage_action" || rc=$?
|
||
|
||
KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_kong.sh" -n "$ns" "$kong_action" || rc=$?
|
||
|
||
if [[ "$manage_opentofu" == "1" ]]; then
|
||
OPENTOFU_NAMESPACE="$ns" OPENTOFU_SECRET_NAMESPACE="${NAMESPACE:-$ns}" OPENTOFU_OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_opentofu.sh" -n "$ns" "$opentofu_action" || rc=$?
|
||
else
|
||
log "[INFO] k8s mode: skipping OpenTofu deploy."
|
||
fi
|
||
|
||
if [[ "$ENABLE_KERBEROS" == "1" ]]; then
|
||
# KDC is embedded in `knoe-auth` by default. Only deploy standalone KDC when requested.
|
||
if [[ "${PROLE_KDC_STANDALONE:-0}" == "1" ]]; then
|
||
SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_kdc.sh" "$kdc_action" || rc=$?
|
||
else
|
||
log "[INFO] Kerberos enabled: skipping standalone KDC deploy (KDC runs as sidecar in 'knoe-auth')."
|
||
fi
|
||
fi
|
||
|
||
return "$rc"
|
||
}
|
||
|
||
cleanup_old_namespace() {
|
||
local ns="$1"
|
||
log "Cleaning up service layer in old namespace '$ns' ..."
|
||
if [[ "$ENABLE_ARGOCD" == "1" ]]; then
|
||
ARGOCD_NAMESPACE="$ARGOCD_NS" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_argocd.sh" -n "$ARGOCD_NS" stop || true
|
||
fi
|
||
# Cleanup in reverse dependency order (OpenTofu first, Registry last)
|
||
OPENTOFU_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_opentofu.sh" -n "$ns" stop || true
|
||
KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_kong.sh" -n "$ns" stop || true
|
||
NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_garage_store.sh" stop || true
|
||
OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_openbao.sh" -n "$ns" stop || true
|
||
if [[ -x "$SCRIPT_DIR/init_redis.sh" ]]; then
|
||
REDIS_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_redis.sh" -n "$ns" stop || true
|
||
fi
|
||
CERTMGR_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_certmgr.sh" -n "$ns" stop || true
|
||
if [[ -x "$SCRIPT_DIR/init_registry.sh" ]]; then
|
||
REGISTRY_NAMESPACE="$REGISTRY_NS" SERVICE_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_registry.sh" -n "$REGISTRY_NS" stop || true
|
||
fi
|
||
if [[ "$ENABLE_KERBEROS" == "1" && "${PROLE_KDC_STANDALONE:-0}" == "1" ]]; then
|
||
SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
|
||
"$SCRIPT_DIR/init_kdc.sh" cleanup || true
|
||
fi
|
||
cleanup_openbao "$ns"
|
||
}
|
||
|
||
migrate_service_layer() {
|
||
local from_ns="$FROM_NAMESPACE"
|
||
local to_ns="$SERVICE_LAYER_NAMESPACE"
|
||
|
||
if [[ -z "$from_ns" ]]; then
|
||
from_ns="$(read_last_namespace || true)"
|
||
fi
|
||
if [[ -z "$to_ns" ]]; then
|
||
err "Missing target SERVICE_NAMESPACE"
|
||
exit 2
|
||
fi
|
||
|
||
if [[ -z "$from_ns" || "$from_ns" == "$to_ns" ]]; then
|
||
log "Deploying service layer in '$to_ns' ..."
|
||
deploy_service_layer update "$to_ns"
|
||
write_last_namespace "$to_ns"
|
||
return 0
|
||
fi
|
||
|
||
log "Migrating service layer from '$from_ns' to '$to_ns' ..."
|
||
deploy_service_layer update "$to_ns"
|
||
cleanup_old_namespace "$from_ns"
|
||
write_last_namespace "$to_ns"
|
||
}
|
||
|
||
ensure_tools
|
||
|
||
case "$ACTION" in
|
||
start|update|restart|status|stop|initialize|reload)
|
||
deploy_service_layer "$ACTION" "$SERVICE_LAYER_NAMESPACE"
|
||
if [[ "$ACTION" != "status" && "$ACTION" != "stop" ]]; then
|
||
write_last_namespace "$SERVICE_LAYER_NAMESPACE"
|
||
fi
|
||
;;
|
||
migrate)
|
||
migrate_service_layer
|
||
;;
|
||
*)
|
||
usage
|
||
exit 2
|
||
;;
|
||
esac
|