mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
3f34fa8b32
Five fixes Junie surfaced while running the kdc-trust-reset-repeatable
Junie brief end-to-end (companion to commit 6f99f95). All hit during
the unattended `install.sh --mode k3s --reset` pipeline.
- knoe/core/milestones.py (KerberosMilestone):
For k3s and k3d modes, deploy the KDC pod via `init_kdc.sh start`
before running init_kerberos.sh. init_kerberos.sh only chains into
init_kdc.sh when PROLE_KDC_STANDALONE=1; without this hook the
cluster came up with no KDC pod and the cross-realm trust principals
had nowhere to land.
- knoe/milestone.py (Milestone._get_script_env):
Clear KUBECTL_CONTEXT in addition to KUBECONTEXT so stale entries
from a different machine's cfg don't override the kubeconfig's
own current-context.
- etc/knoe_cfg.sh (_knoe_read_cfg):
Skip KUBECTL_CONTEXT / KUBE_CONTEXT_NAME / KUBECONTEXT entries when
reading cfg in k3s mode. Same theme: kubeconfig current-context is
authoritative.
- etc/init_1password.sh + knoe/core/onepassword.py:
When running non-interactively (no TTY on stdin) and no `op`
session exists, skip rather than hang on `op signin`. Lets the
unattended pipeline proceed for k3s/k3d where in-cluster secrets
are managed separately from 1Password.
Co-authored-by: Junie <junie@jetbrains.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
316 lines
12 KiB
Python
316 lines
12 KiB
Python
"""Milestone abstraction for the UI-agnostic installer core."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from abc import ABC, abstractmethod
|
|
from typing import Callable, Sequence
|
|
|
|
from . import config as inst_config
|
|
from .state import InstallerState
|
|
|
|
ProgressCallback = Callable[[str, float | None], None]
|
|
ValidationResult = str | Sequence[str] | None
|
|
|
|
|
|
class Milestone(ABC):
|
|
"""Base class for installer milestones.
|
|
|
|
Milestones encapsulate business logic, validation, and flow control.
|
|
They must not import or depend on UI toolkits.
|
|
"""
|
|
|
|
id: str
|
|
title: str
|
|
|
|
def __init__(self, milestone_id: str, title: str):
|
|
self.id = milestone_id
|
|
self.title = title
|
|
|
|
def validate(self, state: InstallerState) -> ValidationResult:
|
|
"""Return a validation error or None when valid."""
|
|
return None
|
|
|
|
@abstractmethod
|
|
def execute(
|
|
self, state: InstallerState, progress: ProgressCallback | None = None
|
|
) -> None:
|
|
"""Execute milestone logic. Use the progress callback to emit updates."""
|
|
raise NotImplementedError
|
|
|
|
def next(self, state: InstallerState) -> str | None:
|
|
"""Return the next milestone id or None to finish."""
|
|
return None
|
|
|
|
def _parse_bool(self, val: any, default: bool | None = False) -> bool | None:
|
|
return inst_config._parse_bool(val, default)
|
|
|
|
def _run_cmd(
|
|
self,
|
|
cmd: str | list[str],
|
|
cwd: str | None = None,
|
|
env: dict | None = None,
|
|
on_stdout: callable | None = None,
|
|
) -> int:
|
|
if isinstance(cmd, str):
|
|
cmd = ["bash", "-c", cmd]
|
|
|
|
import os
|
|
import subprocess
|
|
|
|
try:
|
|
proc_env = os.environ.copy()
|
|
if env:
|
|
proc_env.update(env)
|
|
proc_env = inst_config._augment_env_for_dependency_backend(proc_env)
|
|
proc = subprocess.Popen(
|
|
cmd,
|
|
stdout=subprocess.PIPE,
|
|
stderr=subprocess.STDOUT,
|
|
text=True,
|
|
bufsize=1,
|
|
cwd=cwd,
|
|
env=proc_env,
|
|
)
|
|
for line in iter(proc.stdout.readline, ""):
|
|
if on_stdout:
|
|
on_stdout(line)
|
|
return proc.wait()
|
|
except Exception:
|
|
return 1
|
|
|
|
def _get_script_env(self, state: InstallerState) -> dict:
|
|
import os
|
|
from pathlib import Path
|
|
|
|
env = os.environ.copy()
|
|
project_root = inst_config.PROJECT_ROOT
|
|
env["KNOE_HOME"] = str(project_root)
|
|
env["KNOE_SERVICE"] = str(project_root)
|
|
namespace = (state.inputs.get("init_password.db_namespace", "") or "").strip()
|
|
env["NAMESPACE"] = namespace or "default"
|
|
env["PROLE_NAMESPACE"] = env["NAMESPACE"]
|
|
env["DATABASE_NAMESPACE"] = env["NAMESPACE"]
|
|
|
|
# Paths — prefer the env-specific conf subdir (e.g. conf/service/) so that
|
|
# init scripts source the correct knoe.cfg and don't fall back to the
|
|
# conf/knoe.cfg symlink which may point to a different cluster env.
|
|
# Priority: (1) inherited KNOE_CONF from parent shell when it points to a
|
|
# valid env-specific subdir, (2) cluster_env-derived subdir, (3) stored value.
|
|
_inherited_conf = os.environ.get("KNOE_CONF", "")
|
|
_cluster_env_for_conf = state.inputs.get("init_cluster.cluster_env", "")
|
|
_env_conf_dir = (
|
|
Path(project_root) / "conf" / _cluster_env_for_conf
|
|
if _cluster_env_for_conf
|
|
else None
|
|
)
|
|
if _inherited_conf and (Path(_inherited_conf) / "knoe.cfg").exists():
|
|
env["KNOE_CONF"] = _inherited_conf
|
|
elif _env_conf_dir and _env_conf_dir.is_dir():
|
|
env["KNOE_CONF"] = str(_env_conf_dir)
|
|
else:
|
|
env["KNOE_CONF"] = state.inputs.get(
|
|
"env_setup.KNOE_CONF", str(project_root / "conf")
|
|
)
|
|
env["PROLE_DATA"] = state.inputs.get(
|
|
"env_setup.PROLE_DATA", str(project_root / "knoe-db" / "data")
|
|
)
|
|
env["PROLE_LOGS"] = state.inputs.get(
|
|
"env_setup.PROLE_LOGS", str(project_root / "logs")
|
|
)
|
|
env["KNOE_SERVICE"] = state.inputs.get(
|
|
"env_setup.KNOE_SERVICE", str(project_root / "etc")
|
|
)
|
|
|
|
service_ns = (
|
|
(state.config_data.get("Global", {}) or {})
|
|
.get("SERVICE_NAMESPACE", "")
|
|
.strip()
|
|
)
|
|
if not service_ns:
|
|
service_ns = (os.environ.get("SERVICE_NAMESPACE") or "").strip()
|
|
if not service_ns:
|
|
service_ns = "knoe-system"
|
|
env["SERVICE_NAMESPACE"] = service_ns
|
|
|
|
from knoe.core.env import _deployment_mode_from_env
|
|
|
|
cluster_env = state.inputs.get("init_cluster.cluster_env", "dev")
|
|
mode = _deployment_mode_from_env(cluster_env) or "k3d"
|
|
env["KNOE_MODE"] = mode
|
|
|
|
# Propagate [Global] config keys into env so Python-owned operations
|
|
# (CNPG, monitoring, etc.) can access values declared in knoe.cfg.
|
|
# This mirrors what knoe_cfg.sh does for shell subprocesses.
|
|
# We only set keys that are not already in env (env vars win over config).
|
|
# Machine-specific / runtime-detected values are excluded — they must
|
|
# never be sourced from a potentially stale config written on a different host.
|
|
_GLOBAL_CFG_PROPAGATION_BLOCK = frozenset({
|
|
"KUBECONTEXT", # runtime-detected: k3s="default", k8s=explicit context
|
|
"HOME", # OS-provided; never a config value
|
|
"USER", # OS-provided; never a config value
|
|
})
|
|
_global_cfg = (state.config_data.get("Global") or {})
|
|
for _cfg_key, _cfg_val in _global_cfg.items():
|
|
if _cfg_key in _GLOBAL_CFG_PROPAGATION_BLOCK:
|
|
continue
|
|
if _cfg_val is not None and str(_cfg_key) and _cfg_key not in env:
|
|
env[_cfg_key] = str(_cfg_val)
|
|
|
|
# Kubeconfig
|
|
if mode == "k3s":
|
|
_k3s_kc_candidates = [
|
|
Path(env["KNOE_SERVICE"]) / "secrets" / "k3s.kubeconfig",
|
|
project_root / "knoe-k3s.kubeconfig",
|
|
project_root / "etc" / "secrets" / "k3s.kubeconfig",
|
|
project_root / "secrets" / "k3s.kubeconfig",
|
|
]
|
|
for _kc in _k3s_kc_candidates:
|
|
if _kc.exists():
|
|
env["KUBECONFIG"] = str(_kc)
|
|
break
|
|
# k3s kubeconfig's current-context is authoritative (typically "default").
|
|
# Clear any stale KUBECONTEXT/KUBECTL_CONTEXT written from a different
|
|
# machine's config so kubectl uses KUBECONFIG without a --context override.
|
|
env.pop("KUBECONTEXT", None)
|
|
env.pop("KUBECTL_CONTEXT", None)
|
|
env.pop("KUBE_CONTEXT_NAME", None)
|
|
elif mode == "k3d":
|
|
# Ensure k3d dev clusters have a resolvable KUBECONFIG.
|
|
# The cluster may already be running from a previous session;
|
|
# merge the kubeconfig so downstream scripts can reach it.
|
|
if not (env.get("KUBECONFIG") or "").strip():
|
|
import subprocess as _sp
|
|
|
|
cluster_name = "knoe-dev-cluster"
|
|
try:
|
|
_sp.run(
|
|
[
|
|
"k3d",
|
|
"kubeconfig",
|
|
"merge",
|
|
cluster_name,
|
|
"--kubeconfig-switch-context",
|
|
],
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=10,
|
|
)
|
|
except Exception:
|
|
pass
|
|
default_kube = str(Path.home() / ".kube" / "config")
|
|
if Path(default_kube).exists():
|
|
env["KUBECONFIG"] = default_kube
|
|
elif mode == "k8s":
|
|
# GKE / standard k8s — use ~/.kube/config and set explicit cluster contexts.
|
|
# APP cluster = common services (garage, openbao, registry, monitoring, kong).
|
|
# DB cluster = CNPG/PostgreSQL (knoe-cnpg-0).
|
|
default_kube = str(Path.home() / ".kube" / "config")
|
|
if not (env.get("KUBECONFIG") or "").strip():
|
|
if Path(default_kube).exists():
|
|
env["KUBECONFIG"] = default_kube
|
|
|
|
app_ctx = (
|
|
state.inputs.get("init_cluster.app_cluster_kubecontext", "")
|
|
or state.inputs.get("env_setup.APP_CLUSTER_KUBECONTEXT", "")
|
|
or (state.config_data.get("Global", {}) or {}).get("APP_CLUSTER_KUBECONTEXT", "")
|
|
).strip()
|
|
db_ctx = (
|
|
state.inputs.get("init_cluster.db_cluster_kubecontext", "")
|
|
or state.inputs.get("env_setup.DB_CLUSTER_KUBECONTEXT", "")
|
|
or (state.config_data.get("Global", {}) or {}).get("DB_CLUSTER_KUBECONTEXT", "")
|
|
).strip()
|
|
|
|
if app_ctx:
|
|
env["APP_CLUSTER_KUBECONTEXT"] = app_ctx
|
|
# Default KUBECONTEXT = app cluster; callers needing the DB cluster
|
|
# must override with DB_CLUSTER_KUBECONTEXT before invoking kubectl.
|
|
env["KUBECONTEXT"] = app_ctx
|
|
if db_ctx:
|
|
env["DB_CLUSTER_KUBECONTEXT"] = db_ctx
|
|
|
|
db_pw = state.inputs.get("init_password.db_password", "").strip()
|
|
if db_pw:
|
|
db_pw = inst_config._resolve_secret_value(db_pw)
|
|
env["DB_PASSWORD"] = db_pw
|
|
env["OPENTOFU_ADMIN_PASSWORD"] = db_pw
|
|
|
|
grafana_pw = (
|
|
(state.config_data.get("Monitoring", {}) or {})
|
|
.get("GRAFANA_ADMIN_PASSWORD", "")
|
|
.strip()
|
|
)
|
|
resolved_grafana = (
|
|
inst_config._resolve_secret_value(grafana_pw) if grafana_pw else ""
|
|
)
|
|
if (
|
|
resolved_grafana
|
|
and not inst_config._is_openbao_ref(resolved_grafana)
|
|
and not inst_config._is_knoe_secret(resolved_grafana)
|
|
):
|
|
env["GRAFANA_ADMIN_PASSWORD"] = resolved_grafana
|
|
elif db_pw:
|
|
env["GRAFANA_ADMIN_PASSWORD"] = db_pw
|
|
|
|
db_user = (state.inputs.get("init_password.db_username", "") or "").strip()
|
|
if db_user:
|
|
env["KNOE_DB_USER"] = db_user
|
|
|
|
# Kerberos
|
|
env["KRB5_REALM"] = state.inputs.get("kerberos_config.realm", "")
|
|
realm = (state.inputs.get("kerberos_config.realm", "") or "").strip()
|
|
env["KRB5_KDC"] = state.inputs.get("kerberos_config.kdc", "")
|
|
if realm:
|
|
env["REALM"] = realm
|
|
env["DOMAIN"] = realm.lower()
|
|
env["KRB5_USER"] = state.inputs.get("kerberos_config.user", "")
|
|
krb_pw = state.inputs.get("kerberos_config.password", "")
|
|
if krb_pw:
|
|
env["KRB5_PASSWORD"] = inst_config._resolve_secret_value(krb_pw)
|
|
if state.inputs.get("kerberos_config.kdc", ""):
|
|
env["KRB5_ADMIN"] = state.inputs.get("kerberos_config.kdc", "")
|
|
|
|
kerberos_enabled = self._parse_bool(
|
|
state.inputs.get("kerberos_config.enabled", "False"), default=False
|
|
)
|
|
if kerberos_enabled is None:
|
|
kerberos_enabled = False
|
|
env["KERBEROS_ENABLED"] = "True" if kerberos_enabled else "False"
|
|
env["ENABLED"] = env["KERBEROS_ENABLED"]
|
|
|
|
at_rest = state.inputs.get("init_cluster.at_rest_encryption_enabled", "")
|
|
if at_rest != "":
|
|
env["AT_REST_ENCRYPTION_ENABLED"] = str(at_rest)
|
|
|
|
argocd_ns = (
|
|
(state.config_data.get("Global", {}) or {})
|
|
.get("ARGOCD_NAMESPACE", "")
|
|
.strip()
|
|
)
|
|
if not argocd_ns:
|
|
argocd_ns = (os.environ.get("ARGOCD_NAMESPACE") or "").strip() or "argocd"
|
|
env["ARGOCD_NAMESPACE"] = argocd_ns
|
|
registry_ns = (
|
|
(state.config_data.get("Global", {}) or {})
|
|
.get("REGISTRY_NAMESPACE", "")
|
|
.strip()
|
|
)
|
|
if not registry_ns:
|
|
registry_ns = (
|
|
os.environ.get("REGISTRY_NAMESPACE") or ""
|
|
).strip() or "default"
|
|
env["REGISTRY_NAMESPACE"] = registry_ns
|
|
|
|
if mode == "k3s":
|
|
server = state.inputs.get("init_cluster.k3s_server_url", "").strip()
|
|
token = state.inputs.get("init_cluster.k3s_token", "").strip()
|
|
if token:
|
|
token = inst_config._resolve_secret_value(token)
|
|
if server:
|
|
if not server.startswith("http"):
|
|
server = f"https://{server}"
|
|
env["PROLE_K3S_SERVER"] = server
|
|
if token:
|
|
env["PROLE_K3S_TOKEN"] = token
|
|
|
|
return env
|