mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
3f96f66a78
Rewrites (updated for knoe namespace, GKE support, and current service configs): init_gitlab.sh, init_kong.sh, init_cnpg_backup.sh, init_monitoring.sh, init_garage_store.sh, init_gitea.sh, init_kdc.sh, init_openbao.sh, init_argocd.sh, init_certmgr.sh, init_common_services.sh, init_db_manager.sh, init_forgejo.sh, init_k3s_registry.sh, init_kerberos.sh, init_nginx_ingress.sh, init_port_forwards.sh, init_registry.sh, init_service_layer.sh Deleted: init_cloudnative_pg.sh (superseded by init_cnpg_gke.sh) New scripts: init_cnpg_gke.sh — CNPG setup for GKE with Workload Identity init_knoe_auth.sh — knoe-auth OIDC service init init_knoe_users.sh — user provisioning init_redis.sh — Redis init init_oauth2_proxy.sh / init_oauth2_proxy_prole.sh — OAuth2 proxy setup init_grafana_oauth.sh / init_grafana_oauth_prole.sh — Grafana OAuth wiring init_1password.sh — 1Password Connect init init_min.sh — minimal bootstrap Co-authored-by: Junie <junie@jetbrains.com>
106 lines
2.7 KiB
Bash
106 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
# init_k3s_registry.sh
|
|
# Purpose:
|
|
# - Configure k3s/containerd to allow access to the Knoe registry
|
|
# - Writes /etc/rancher/k3s/registries.yaml on the k3s node
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck disable=SC1090
|
|
source "$SCRIPT_DIR/knoe_cfg.sh"
|
|
|
|
ACTION=${1:-apply}
|
|
|
|
registry_host_from_url() {
|
|
local value="${1:-}"
|
|
value="${value#http://}"
|
|
value="${value#https://}"
|
|
value="${value%%/*}"
|
|
value="${value%%:*}"
|
|
printf '%s' "$value"
|
|
}
|
|
|
|
K3S_REGISTRY_HOST=${K3S_REGISTRY_HOST:-$(registry_host_from_url "${PROLE_K3S_SERVER:-${K3S_SERVER_URL:-}}")}
|
|
K3S_REGISTRY_PORT=${K3S_REGISTRY_PORT:-5000}
|
|
K3S_REGISTRY_NAMESPACE=${K3S_REGISTRY_NAMESPACE:-${REGISTRY_NAMESPACE:-${SERVICE_NAMESPACE:-${PROLE_NAMESPACE:-default}}}}
|
|
K3S_REGISTRY_FILE=${K3S_REGISTRY_FILE:-/etc/rancher/k3s/registries.yaml}
|
|
K3S_REGISTRY_SCHEME=${K3S_REGISTRY_SCHEME:-}
|
|
|
|
if [[ -z "${K3S_REGISTRY_SCHEME}" ]]; then
|
|
# Internal Knoe registry endpoints are plain HTTP by default.
|
|
# Set K3S_REGISTRY_SCHEME=https explicitly when TLS is configured.
|
|
K3S_REGISTRY_SCHEME="http"
|
|
fi
|
|
|
|
ensure_root() {
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
echo "ERROR: must run as root to write $K3S_REGISTRY_FILE" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
render_registries_yaml() {
|
|
local host="$1"
|
|
local port="$2"
|
|
local ns="$3"
|
|
local scheme="$4"
|
|
|
|
if [[ "$scheme" == "http" ]]; then
|
|
cat <<EOF
|
|
mirrors:
|
|
"${host}:${port}":
|
|
endpoint:
|
|
- "http://${host}:${port}"
|
|
"registry.${ns}.svc.cluster.local:${port}":
|
|
endpoint:
|
|
- "http://${host}:${port}"
|
|
EOF
|
|
return 0
|
|
fi
|
|
cat <<EOF
|
|
mirrors:
|
|
"${host}:${port}":
|
|
endpoint:
|
|
- "${scheme}://${host}:${port}"
|
|
"registry.${ns}.svc.cluster.local:${port}":
|
|
endpoint:
|
|
- "${scheme}://${host}:${port}"
|
|
configs:
|
|
"${host}:${port}":
|
|
tls:
|
|
insecure_skip_verify: true
|
|
"registry.${ns}.svc.cluster.local:${port}":
|
|
tls:
|
|
insecure_skip_verify: true
|
|
EOF
|
|
}
|
|
|
|
case "$ACTION" in
|
|
apply|update)
|
|
if [[ -z "${K3S_REGISTRY_HOST:-}" ]]; then
|
|
echo "ERROR: K3S_REGISTRY_HOST is empty (set PROLE_K3S_SERVER or K3S_REGISTRY_HOST)." >&2
|
|
exit 2
|
|
fi
|
|
ensure_root
|
|
mkdir -p "$(dirname "$K3S_REGISTRY_FILE")"
|
|
render_registries_yaml "$K3S_REGISTRY_HOST" "$K3S_REGISTRY_PORT" "$K3S_REGISTRY_NAMESPACE" "$K3S_REGISTRY_SCHEME" >"$K3S_REGISTRY_FILE"
|
|
echo "Wrote $K3S_REGISTRY_FILE for ${K3S_REGISTRY_SCHEME}://${K3S_REGISTRY_HOST}:${K3S_REGISTRY_PORT}"
|
|
echo "Restart k3s to apply: sudo systemctl restart k3s"
|
|
;;
|
|
status)
|
|
if [[ -f "$K3S_REGISTRY_FILE" ]]; then
|
|
echo "Found $K3S_REGISTRY_FILE"
|
|
cat "$K3S_REGISTRY_FILE"
|
|
else
|
|
echo "No registries.yaml at $K3S_REGISTRY_FILE"
|
|
exit 1
|
|
fi
|
|
;;
|
|
*)
|
|
echo "Usage: $0 {apply|status}" >&2
|
|
exit 2
|
|
;;
|
|
esac
|