mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
12d00c468a
- Updated tests/silent_install_test.sh to support unique logging via SILENT_INSTALL_LOG=true - Created shared IntelliJ Run Configuration '.idea/runConfigurations/Silent_Install_Test.xml' - Updated various init scripts, port mappings, and installer logic - Added supabase.sh and init_monitoring.sh
422 lines
14 KiB
Bash
Executable File
422 lines
14 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
|
||
set -euo pipefail
|
||
|
||
# init_cloudnative_pg.sh
|
||
# Purpose:
|
||
# - Distribute administrator ed25519 key pair to CloudNative‑PG as a Kubernetes Secret for cert auth
|
||
# - Configure Kerberos (GSSAPI) using external Kerberos KDC
|
||
# - Patch CNPG cluster to enable TLS and GSSAPI where possible
|
||
#
|
||
# Usage:
|
||
# ./init_cloudnative_pg.sh start|stop|status|restart
|
||
# ./init_cloudnative_pg.sh initialize # install CNPG, create cluster, configure secrets + Kerberos
|
||
# ./init_cloudnative_pg.sh update|reload # re-apply/patch
|
||
#
|
||
# Requirements:
|
||
# - init_openbao.sh has been run (OpenBao running as a local container)
|
||
# - $PROLE_HOME/env.sh or $HOME/.prole/env.sh defining PROLE_SERVICE
|
||
# - Optional: CNPG_MANIFEST_OVERRIDE to apply a recovery manifest instead of kustomize
|
||
|
||
# Initialize SCRIPT_DIR
|
||
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
||
|
||
# Load environment and config via prole_cfg.sh
|
||
# shellcheck disable=SC1090
|
||
source "$SCRIPT_DIR/prole_cfg.sh"
|
||
|
||
if [[ -z "${PROLE_SERVICE:-}" ]]; then
|
||
echo "ERROR: PROLE_SERVICE is not defined. Provide PROLE_HOME/env.sh or ~/.prole/env.sh" >&2
|
||
exit 1
|
||
fi
|
||
|
||
ACTION=${1:-}
|
||
CNPG_CLUSTER_NAME=${2:-${CNPG_CLUSTER_NAME:-prole-db}}
|
||
OPENBAO_NAME=${OPENBAO_NAME:-openbao}
|
||
REALM=${REALM:-PROLE.ORG}
|
||
DOMAIN=${DOMAIN:-prole.org}
|
||
KRB5_KDC=${KRB5_KDC:-}
|
||
KRB5_ADMIN=${KRB5_ADMIN:-}
|
||
CNPG_MANIFEST_OVERRIDE=${CNPG_MANIFEST_OVERRIDE:-}
|
||
|
||
# Support both PROLE_HOME/k8s and sibling k8s directory
|
||
if [[ -d "$SCRIPT_DIR/../k8s/prole" ]]; then
|
||
CNPG_MANIFEST="$SCRIPT_DIR/../k8s/prole/prole-db.yaml"
|
||
elif [[ -n "${PROLE_HOME:-}" && -d "$PROLE_HOME/k8s/prole" ]]; then
|
||
CNPG_MANIFEST="$PROLE_HOME/k8s/prole/prole-db.yaml"
|
||
else
|
||
CNPG_MANIFEST="$SCRIPT_DIR/../k8s/prole/prole-db.yaml"
|
||
fi
|
||
|
||
SECRETS_DIR="$PROLE_SERVICE/secrets"
|
||
# Resolving CNPG admin keys.
|
||
# We prefer names without algorithm suffixes to be more generic, matching install.py fallback strategy.
|
||
ADMIN_PRIV_ED25519="$SECRETS_DIR/admin_ed25519.key"
|
||
ADMIN_PUB_ED25519="$SECRETS_DIR/admin_ed25519.pub"
|
||
ADMIN_PRIV_GENERIC="$SECRETS_DIR/admin.key"
|
||
ADMIN_PUB_GENERIC="$SECRETS_DIR/admin.pub"
|
||
OPENBAO_TOKEN_FILE="$SECRETS_DIR/openbao-root-token"
|
||
|
||
ensure_tools() {
|
||
for t in kubectl curl openssl base64 jq; do
|
||
command -v "$t" >/dev/null || { echo "Missing required tool: $t" >&2; exit 1; }
|
||
done
|
||
}
|
||
|
||
ensure_namespace() {
|
||
if [[ -z "${NAMESPACE:-}" ]]; then
|
||
echo "ERROR: NAMESPACE is empty. Check env.sh or conf/prole.cfg." >&2
|
||
exit 1
|
||
fi
|
||
if ! kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
|
||
echo "Creating namespace '$NAMESPACE' ..."
|
||
kubectl create namespace "$NAMESPACE" >/dev/null 2>&1 || true
|
||
fi
|
||
}
|
||
|
||
ensure_cnpg_operator() {
|
||
if kubectl get deployment -n cnpg-system cnpg-controller-manager >/dev/null 2>&1; then
|
||
return 0
|
||
fi
|
||
|
||
local latest_version minor_version yaml_url
|
||
latest_version=$(get_latest_cnpg_version)
|
||
minor_version=$(echo "$latest_version" | cut -d. -f1,2)
|
||
yaml_url="https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${minor_version}/releases/cnpg-${latest_version}.yaml"
|
||
|
||
echo "Installing CloudNative-PG operator version ${latest_version} ..."
|
||
kubectl apply --server-side -f "$yaml_url"
|
||
|
||
if kubectl get deployment -n cnpg-system cnpg-controller-manager >/dev/null 2>&1; then
|
||
kubectl -n cnpg-system rollout status deploy/cnpg-controller-manager --timeout=120s || true
|
||
fi
|
||
}
|
||
|
||
ensure_prole_stack_resources() {
|
||
echo "Applying CloudNative-PG cluster and related resources ..."
|
||
if [[ -n "$CNPG_MANIFEST_OVERRIDE" ]]; then
|
||
if [[ ! -f "$CNPG_MANIFEST_OVERRIDE" ]]; then
|
||
echo "ERROR: CNPG_MANIFEST_OVERRIDE not found: $CNPG_MANIFEST_OVERRIDE" >&2
|
||
return 1
|
||
fi
|
||
local dir file
|
||
dir="$SCRIPT_DIR/../k8s/prole"
|
||
for file in "$dir"/*.yaml; do
|
||
case "$(basename "$file")" in
|
||
prole-db.yaml|kustomization.yaml|supabase-*.yaml)
|
||
continue
|
||
;;
|
||
esac
|
||
kubectl apply -n "$NAMESPACE" -f "$file"
|
||
done
|
||
kubectl apply -n "$NAMESPACE" -f "$CNPG_MANIFEST_OVERRIDE"
|
||
else
|
||
local dir file
|
||
dir="$SCRIPT_DIR/../k8s/prole"
|
||
for file in "$dir"/*.yaml; do
|
||
case "$(basename "$file")" in
|
||
kustomization.yaml|supabase-*.yaml)
|
||
continue
|
||
;;
|
||
esac
|
||
kubectl apply -n "$NAMESPACE" -f "$file"
|
||
done
|
||
fi
|
||
|
||
# Ensure prole-index-html exists for prole deployment readiness probe
|
||
if ! kubectl get configmap prole-index-html -n "$NAMESPACE" >/dev/null 2>&1; then
|
||
echo "Creating prole-index-html configmap..."
|
||
printf "<html><body><h1>Prole</h1></body></html>" > /tmp/index.html
|
||
kubectl create configmap prole-index-html --from-file=/tmp/index.html -n "$NAMESPACE"
|
||
rm /tmp/index.html
|
||
fi
|
||
|
||
# Ensure prole-nginx-tls exists (self-signed for dev)
|
||
if ! kubectl get secret prole-nginx-tls -n "$NAMESPACE" >/dev/null 2>&1; then
|
||
echo "Generating self-signed prole-nginx-tls for development..."
|
||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||
-keyout /tmp/nginx-tls.key -out /tmp/nginx-tls.crt \
|
||
-subj "/CN=prole.org" >/dev/null 2>&1
|
||
kubectl create secret tls prole-nginx-tls --key /tmp/nginx-tls.key --cert /tmp/nginx-tls.crt -n "$NAMESPACE"
|
||
rm /tmp/nginx-tls.key /tmp/nginx-tls.crt
|
||
fi
|
||
}
|
||
|
||
wait_for_cnpg_pods() {
|
||
local timeout=${1:-300}
|
||
local start_time
|
||
start_time=$(date +%s)
|
||
|
||
local target_pods="${CNPG_TARGET_PODS:-}"
|
||
if [[ -z "$target_pods" ]]; then
|
||
target_pods=$(kubectl -n "$NAMESPACE" get cluster "$CNPG_CLUSTER_NAME" -o jsonpath='{.spec.instances}' 2>/dev/null || true)
|
||
fi
|
||
if [[ -z "$target_pods" ]]; then
|
||
target_pods=3
|
||
fi
|
||
|
||
echo "Waiting for $target_pods CNPG pods for cluster '$CNPG_CLUSTER_NAME' in namespace '$NAMESPACE' to be Running..."
|
||
while true; do
|
||
local pods
|
||
pods=$(kubectl -n "$NAMESPACE" get pods -l "cnpg.io/cluster=$CNPG_CLUSTER_NAME" --no-headers 2>/dev/null || true)
|
||
|
||
if [[ -n "$pods" ]]; then
|
||
# Check for Error or CrashLoopBackOff
|
||
if echo "$pods" | grep -E "Error|CrashLoopBackOff" >/dev/null; then
|
||
echo "ERROR: Some CNPG pods are in Error or CrashLoopBackOff state:" >&2
|
||
echo "$pods" | grep -E "Error|CrashLoopBackOff" >&2
|
||
return 1
|
||
fi
|
||
|
||
# Count Running pods by name (exclude initdb)
|
||
local running_pods
|
||
running_pods=$(kubectl -n "$NAMESPACE" get pods --no-headers 2>/dev/null \
|
||
| grep "^${CNPG_CLUSTER_NAME}-" \
|
||
| grep -v "initdb" \
|
||
| grep "Running" \
|
||
| wc -l | xargs)
|
||
|
||
if [[ "$running_pods" -ge "$target_pods" ]]; then
|
||
echo "All $running_pods/$target_pods pods are Running."
|
||
return 0
|
||
fi
|
||
fi
|
||
|
||
if (( $(date +%s) - start_time > timeout )); then
|
||
echo "ERROR: Timed out waiting for $target_pods CNPG pods for cluster '$CNPG_CLUSTER_NAME' in namespace '$NAMESPACE'." >&2
|
||
return 1
|
||
fi
|
||
sleep 5
|
||
done
|
||
}
|
||
|
||
# Resolve OpenBao URL: prefer explicit env, then localhost port-forward, then cluster DNS
|
||
bao_service_url() {
|
||
if [[ -n "${PROLE_OPENBAO_URL:-}" ]]; then
|
||
echo "$PROLE_OPENBAO_URL"
|
||
return 0
|
||
fi
|
||
# Prefer standard local port-forward managed by etc/init_port_forwards.sh
|
||
if curl -sS "http://127.0.0.1:18200/v1/sys/health" >/dev/null 2>&1; then
|
||
echo "http://127.0.0.1:18200"
|
||
return 0
|
||
fi
|
||
echo "http://$OPENBAO_NAME.$NAMESPACE.svc.cluster.local:8200"
|
||
}
|
||
|
||
fetch_admin_keys_and_db_pass_from_bao_or_local() {
|
||
local token url
|
||
if [[ -f "$OPENBAO_TOKEN_FILE" ]]; then
|
||
token=$(cat "$OPENBAO_TOKEN_FILE")
|
||
else
|
||
token=""
|
||
fi
|
||
url=$(bao_service_url)
|
||
if [[ -n "$token" ]]; then
|
||
echo "Attempting to read admin key pair from OpenBao kv/prole/admin ..."
|
||
if curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -e '.data.data' >/dev/null 2>&1; then
|
||
local priv_b64 pub_b64
|
||
priv_b64=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -r '.data.data.admin_private_key_b64')
|
||
pub_b64=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/admin" | jq -r '.data.data.admin_public_key_b64')
|
||
# Use a temporary file to determine where to save based on existing legacy or generic preference
|
||
local target_priv="$ADMIN_PRIV_GENERIC"
|
||
local target_pub="$ADMIN_PUB_GENERIC"
|
||
|
||
# If legacy keys exist, we might want to overwrite them too for compatibility
|
||
printf "%s" "$priv_b64" | base64 -d >"$target_priv"
|
||
printf "%s" "$pub_b64" | base64 -d >"$target_pub"
|
||
chmod 0600 "$target_priv"
|
||
|
||
# Mirror to legacy path if it was expected by other scripts
|
||
cp "$target_priv" "$ADMIN_PRIV_ED25519" 2>/dev/null || true
|
||
cp "$target_pub" "$ADMIN_PUB_ED25519" 2>/dev/null || true
|
||
fi
|
||
|
||
echo "Attempting to read database password from OpenBao kv/prole/db ..."
|
||
if curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/db" | jq -e '.data.data' >/dev/null 2>&1; then
|
||
local db_pass
|
||
db_pass=$(curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/prole/db" | jq -r '.data.data.password')
|
||
if [[ -n "$db_pass" ]]; then
|
||
echo "Updating database user secret 'prole-db-user' from OpenBao ..."
|
||
kubectl create secret generic prole-db-user -n "$NAMESPACE" \
|
||
--from-literal=username=prole \
|
||
--from-literal=password="$db_pass" \
|
||
--dry-run=client -o yaml | kubectl apply -f -
|
||
|
||
echo "Updating database superuser secret 'prole-db-superuser' from OpenBao ..."
|
||
kubectl create secret generic prole-db-superuser -n "$NAMESPACE" \
|
||
--from-literal=username=postgres \
|
||
--from-literal=password="$db_pass" \
|
||
--dry-run=client -o yaml | kubectl apply -f -
|
||
fi
|
||
fi
|
||
fi
|
||
|
||
if [[ -f "$ADMIN_PRIV_GENERIC" && -f "$ADMIN_PUB_GENERIC" ]]; then
|
||
echo "Using local admin key pair at $SECRETS_DIR"
|
||
return 0
|
||
fi
|
||
if [[ -f "$ADMIN_PRIV_ED25519" && -f "$ADMIN_PUB_ED25519" ]]; then
|
||
echo "Using local legacy admin key pair at $SECRETS_DIR"
|
||
# Link or copy to generic for consistent use below
|
||
cp "$ADMIN_PRIV_ED25519" "$ADMIN_PRIV_GENERIC"
|
||
cp "$ADMIN_PUB_ED25519" "$ADMIN_PUB_GENERIC"
|
||
return 0
|
||
fi
|
||
echo "ERROR: Could not obtain admin key pair from OpenBao and no local files found." >&2
|
||
exit 1
|
||
}
|
||
|
||
apply_cnpg_admin_secret() {
|
||
echo "Creating/updating Secret cnpg-admin-key ..."
|
||
kubectl create secret generic cnpg-admin-key -n "$NAMESPACE" \
|
||
--from-file=admin.key="$ADMIN_PRIV_GENERIC" \
|
||
--from-file=admin.pub="$ADMIN_PUB_GENERIC" \
|
||
--dry-run=client -o yaml | kubectl apply -f -
|
||
}
|
||
|
||
generate_tls_if_missing() {
|
||
local ca_secret_name="${CNPG_CLUSTER_NAME}-ca"
|
||
if kubectl -n "$NAMESPACE" get secret "$ca_secret_name" >/dev/null 2>&1; then
|
||
echo "CA secret $ca_secret_name already exists; skipping generation."
|
||
return 0
|
||
fi
|
||
echo "Generating self-signed CA (RSA 4096) for CNPG ..."
|
||
local TMPD
|
||
TMPD=$(mktemp -d)
|
||
openssl genrsa -out "$TMPD/ca.key" 4096
|
||
openssl req -x509 -new -key "$TMPD/ca.key" -out "$TMPD/ca.crt" -days 3650 -subj "/CN=Prole CNPG CA"
|
||
kubectl -n "$NAMESPACE" create secret generic "$ca_secret_name" \
|
||
--from-file=ca.crt="$TMPD/ca.crt" \
|
||
--from-file=ca.key="$TMPD/ca.key" \
|
||
--dry-run=client -o yaml | kubectl apply -f -
|
||
rm -rf "$TMPD"
|
||
}
|
||
|
||
# Resolve latest CNPG version from GitHub if possible, fallback to a sensible default.
|
||
get_latest_cnpg_version() {
|
||
local version
|
||
version=$(curl -s "https://api.github.com/repos/cloudnative-pg/cloudnative-pg/releases/latest" | jq -r '.tag_name' | sed 's/^v//' || echo "")
|
||
if [[ -z "$version" || "$version" == "null" ]]; then
|
||
echo "1.27.0"
|
||
else
|
||
echo "$version"
|
||
fi
|
||
}
|
||
|
||
initialize() {
|
||
ensure_tools
|
||
ensure_namespace
|
||
ensure_cnpg_operator
|
||
echo "Using namespace: $NAMESPACE"
|
||
|
||
fetch_admin_keys_and_db_pass_from_bao_or_local
|
||
apply_cnpg_admin_secret
|
||
|
||
ensure_prole_stack_resources
|
||
|
||
if ! wait_for_cnpg_pods 300; then
|
||
return 1
|
||
fi
|
||
|
||
# Support both names for the toggle from prole.cfg
|
||
local kerberos_enabled="${KERBEROS_ENABLED:-${ENABLED:-false}}"
|
||
if [[ "$kerberos_enabled" == "true" || "$kerberos_enabled" == "True" || "$kerberos_enabled" == "1" ]]; then
|
||
if [[ -x "$SCRIPT_DIR/init_kerberos.sh" ]]; then
|
||
echo "Configuring Kerberos for CNPG pods ..."
|
||
if ! "$SCRIPT_DIR/init_kerberos.sh" initialize; then
|
||
echo "WARN: Kerberos initialization did not complete successfully."
|
||
fi
|
||
else
|
||
echo "WARN: init_kerberos.sh not found; skipping Kerberos configuration."
|
||
fi
|
||
else
|
||
echo "Kerberos is disabled; skipping Kerberos configuration."
|
||
fi
|
||
|
||
# Ensure port-forward is running for Postgres (local access)
|
||
echo "Ensuring port-forward for Postgres is active ..."
|
||
"$SCRIPT_DIR/init_port_forwards.sh" stop postgres || true
|
||
"$SCRIPT_DIR/init_port_forwards.sh" start postgres &
|
||
sleep 2
|
||
|
||
echo "Initialization complete for CNPG + Kerberos + cert artifacts."
|
||
}
|
||
|
||
update_reload() {
|
||
initialize
|
||
}
|
||
|
||
case "$ACTION" in
|
||
recreate)
|
||
ensure_tools
|
||
"$0" delete "$CNPG_CLUSTER_NAME"
|
||
"$0" create "$CNPG_CLUSTER_NAME"
|
||
;;
|
||
create)
|
||
ensure_tools
|
||
ensure_namespace
|
||
initialize
|
||
;;
|
||
delete)
|
||
ensure_tools
|
||
echo "Deleting all resources for '$CNPG_CLUSTER_NAME' ..."
|
||
kubectl delete -n "$NAMESPACE" -k "$SCRIPT_DIR/../k8s/prole" --ignore-not-found
|
||
;;
|
||
start)
|
||
ensure_tools
|
||
ensure_namespace
|
||
ensure_cnpg_operator
|
||
if [[ ! -f "$CNPG_MANIFEST" ]]; then
|
||
echo "ERROR: CNPG manifest not found at $CNPG_MANIFEST" >&2
|
||
exit 1
|
||
fi
|
||
echo "Starting CloudNative-PG cluster from $CNPG_MANIFEST in namespace $NAMESPACE..."
|
||
kubectl apply -n "$NAMESPACE" -f "$CNPG_MANIFEST"
|
||
;;
|
||
stop)
|
||
ensure_tools
|
||
if [[ ! -f "$CNPG_MANIFEST" ]]; then
|
||
echo "ERROR: CNPG manifest not found at $CNPG_MANIFEST" >&2
|
||
exit 1
|
||
fi
|
||
echo "Stopping CloudNative-PG cluster using $CNPG_MANIFEST ..."
|
||
kubectl delete -f "$CNPG_MANIFEST" --ignore-not-found
|
||
;;
|
||
status)
|
||
ensure_tools
|
||
echo "--- CloudNative-PG Cluster Status ($CNPG_CLUSTER_NAME) ---"
|
||
if kubectl -n "$NAMESPACE" get cluster "$CNPG_CLUSTER_NAME" >/dev/null 2>&1; then
|
||
kubectl -n "$NAMESPACE" get cluster "$CNPG_CLUSTER_NAME"
|
||
echo ""
|
||
echo "CNPG Plugin Status:"
|
||
if kubectl cnpg version >/dev/null 2>&1; then
|
||
kubectl cnpg status "$CNPG_CLUSTER_NAME" -n "$NAMESPACE"
|
||
else
|
||
echo "Note: 'kubectl cnpg' plugin not found; skipping detailed status."
|
||
fi
|
||
else
|
||
echo "Cluster '$CNPG_CLUSTER_NAME' not found in namespace '$NAMESPACE'."
|
||
fi
|
||
;;
|
||
restart)
|
||
ensure_tools
|
||
"$0" stop
|
||
"$0" start
|
||
;;
|
||
initialize)
|
||
if ! initialize; then
|
||
exit 1
|
||
fi
|
||
;;
|
||
update|reload)
|
||
if ! update_reload; then
|
||
exit 1
|
||
fi
|
||
;;
|
||
*)
|
||
echo "Usage: $0 {create|delete|recreate|start|stop|status|restart|initialize|update|reload} [dbname]" >&2
|
||
exit 2
|
||
;;
|
||
esac
|