mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
3943d1b298
Diagnostics:
diag_gitlab_boot.sh, diag_gitlab_webservice_oom.sh, diag_gke_storage.sh
Utilities:
ensure_default_storage_class.sh — set/verify default StorageClass
preflight_kubecontext.sh — validate kubecontext before ops
onboard_engineer.sh — new engineer onboarding script
gen_oidc_signing_key.sh — generate OIDC signing key
fetch_prole_secrets.sh — pull secrets from vault
set-k3s-token-1password.sh — store k3s token in 1Password
sync_cnpg_grafana_dashboard.py — sync CNPG dashboard to Grafana
Config/certs:
krb5.local.conf, knoe-db-ca.crt
Updated: build-a-bao.sh, hostprobe-*.yaml, hosts.txt, knoe-db-passwwd.sh,
repair_pipeline.sh, status.sh, status_common_services.sh
Co-authored-by: Junie <junie@jetbrains.com>
57 lines
1.5 KiB
Bash
57 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
# set-k3s-token-1password.sh
|
|
# Reads the k3s server join token and stores it in the 'knoey' 1Password vault.
|
|
# Replaces etc/set-k3s-token-vault.sh (formerly used ansible-vault).
|
|
#
|
|
# Run on the k3s control-plane node (requires sudo to read the token file).
|
|
|
|
set -euo pipefail
|
|
|
|
TOKEN_FILE="${TOKEN_FILE:-/var/lib/rancher/k3s/server/node-token}"
|
|
VAULT="knoey"
|
|
ITEM="k3s-token"
|
|
FIELD="credential"
|
|
|
|
if [[ ! -r "$TOKEN_FILE" ]]; then
|
|
if command -v sudo >/dev/null 2>&1; then
|
|
TOKEN="$(sudo cat "$TOKEN_FILE" | tr -d '\r\n')"
|
|
else
|
|
echo "ERROR: Cannot read token file: $TOKEN_FILE" >&2
|
|
echo "Are you running this on a k3s server?" >&2
|
|
exit 1
|
|
fi
|
|
else
|
|
TOKEN="$(cat "$TOKEN_FILE" | tr -d '\r\n')"
|
|
fi
|
|
|
|
if [[ -z "$TOKEN" ]]; then
|
|
echo "ERROR: Token read from $TOKEN_FILE is empty" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v op >/dev/null 2>&1; then
|
|
echo "ERROR: 1Password CLI (op) not found. Install: brew install 1password-cli" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! op whoami >/dev/null 2>&1; then
|
|
op signin
|
|
fi
|
|
|
|
if op item get "$ITEM" --vault "$VAULT" >/dev/null 2>&1; then
|
|
echo "Updating existing item '$ITEM' in vault '$VAULT'..."
|
|
op item edit "$ITEM" --vault "$VAULT" "${FIELD}=${TOKEN}"
|
|
else
|
|
echo "Creating item '$ITEM' in vault '$VAULT'..."
|
|
op item create \
|
|
--category login \
|
|
--title "$ITEM" \
|
|
--vault "$VAULT" \
|
|
"${FIELD}=${TOKEN}"
|
|
fi
|
|
|
|
echo "Done. k3s token stored in 1Password vault '$VAULT' as item '$ITEM'."
|
|
echo
|
|
echo "Verify with:"
|
|
echo " op item get $ITEM --vault $VAULT --fields $FIELD --reveal"
|