mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
35299fdd52
- Introduced jemalloc hostPath optimizations with configurable modes (`auto`, `off`, `force`). - Integrated jemalloc setup with best-effort and forced validation flows for ensuring cluster compatibility. - Enhanced monitoring storage class logic with mode-specific handling (`k3s`, `k3d`, `gke`) and improved validation of required classes. - Added safeguards and detailed logging for unsupported configurations and failure scenarios.
909 lines
34 KiB
Python
Executable File
909 lines
34 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""
|
|
Render a personalized Supabase Helm values file and pre-template manifests
|
|
using the local prole.cfg. Defaults are tailored for knoe's CNPG cluster
|
|
(knoe-db-rw Service) and unattended k8s ingress.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import base64
|
|
import configparser
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
import os
|
|
import secrets
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
import urllib.parse
|
|
from pathlib import Path
|
|
from typing import Any, Dict
|
|
|
|
# Allow imports from the repo root
|
|
REPO_ROOT = Path(__file__).resolve().parents[2]
|
|
sys.path.insert(0, str(REPO_ROOT))
|
|
|
|
try:
|
|
from knoe.config import _resolve_secret_value # type: ignore
|
|
except Exception: # pragma: no cover - fallback for minimal environments
|
|
def _resolve_secret_value(value: str | None) -> str:
|
|
return value or ""
|
|
|
|
|
|
def _read_cfg(path: Path) -> configparser.ConfigParser:
|
|
parser = configparser.ConfigParser(interpolation=None)
|
|
try:
|
|
from knoe import prole_conf as prole_conf_mgr # type: ignore
|
|
|
|
files = [p for p in prole_conf_mgr.layered_cfg_files(path) if p.exists()]
|
|
if files:
|
|
parser.read([str(p) for p in files])
|
|
else:
|
|
parser.read(path)
|
|
except Exception:
|
|
parser.read(path)
|
|
return parser
|
|
|
|
|
|
def _cfg_get(cfg: configparser.ConfigParser, section: str, key: str, default: str = "") -> str:
|
|
try:
|
|
raw = cfg.get(section, key, fallback=default)
|
|
except Exception:
|
|
return default
|
|
return _resolve_secret_value((raw or "").strip())
|
|
|
|
|
|
def _first(*values: str, default: str = "") -> str:
|
|
for v in values:
|
|
if v:
|
|
return v
|
|
return default
|
|
|
|
|
|
def _is_placeholder(value: str) -> bool:
|
|
v = (value or "").strip()
|
|
return v.startswith("${") and v.endswith("}")
|
|
|
|
|
|
def _as_bool(value: str | bool | None, default: bool = False) -> bool:
|
|
if isinstance(value, bool):
|
|
return value
|
|
if value is None:
|
|
return default
|
|
normalized = str(value).strip().lower()
|
|
if not normalized:
|
|
return default
|
|
if normalized in {"1", "true", "yes", "on", "y"}:
|
|
return True
|
|
if normalized in {"0", "false", "no", "off", "n"}:
|
|
return False
|
|
return default
|
|
|
|
|
|
def _parse_hosts(raw_hosts: str, fallback: str = "db.0.knoe.dev") -> list[str]:
|
|
entries: list[str] = []
|
|
seen: set[str] = set()
|
|
for entry in (raw_hosts or "").split(","):
|
|
token = (entry or "").strip()
|
|
if not token or _is_placeholder(token):
|
|
continue
|
|
|
|
if "://" in token:
|
|
parsed = urllib.parse.urlparse(token)
|
|
host = (parsed.hostname or "").strip()
|
|
else:
|
|
host = token
|
|
|
|
if not host or host in seen:
|
|
continue
|
|
seen.add(host)
|
|
entries.append(host)
|
|
|
|
if entries:
|
|
return entries
|
|
return [fallback]
|
|
|
|
|
|
def _normalize_public_hosts(raw_hosts: str, fallback_host: str) -> tuple[list[str], str]:
|
|
raw_entries: list[str] = []
|
|
for entry in (raw_hosts or "").split(","):
|
|
token = (entry or "").strip()
|
|
if token and not _is_placeholder(token):
|
|
raw_entries.append(token)
|
|
if not raw_entries:
|
|
raw_entries = [fallback_host]
|
|
|
|
host_entries = _parse_hosts(",".join(raw_entries), fallback=fallback_host)
|
|
primary_host = host_entries[0]
|
|
|
|
primary_raw = (raw_entries[0] or "").strip()
|
|
if "://" in primary_raw:
|
|
parsed = urllib.parse.urlparse(primary_raw)
|
|
primary_host = (parsed.hostname or "").strip() or primary_host
|
|
scheme = (parsed.scheme or "https").strip()
|
|
netloc = (parsed.netloc or primary_host).strip()
|
|
public_url = f"{scheme}://{netloc}"
|
|
else:
|
|
public_url = f"https://{primary_host}"
|
|
|
|
return host_entries, public_url
|
|
|
|
|
|
def _extract_k8s_docs(rendered_manifest: str) -> list[dict[str, Any]]:
|
|
docs: list[dict[str, Any]] = []
|
|
for chunk in rendered_manifest.split("\n---"):
|
|
text = chunk.strip()
|
|
if not text:
|
|
continue
|
|
try:
|
|
parsed = json.loads(text)
|
|
except Exception:
|
|
lines = text.splitlines()
|
|
api_version = ""
|
|
kind = ""
|
|
name = ""
|
|
namespace = ""
|
|
for idx, raw_line in enumerate(lines):
|
|
stripped = raw_line.strip()
|
|
if stripped.startswith("apiVersion:"):
|
|
api_version = stripped.split(":", 1)[1].strip()
|
|
elif stripped.startswith("kind:"):
|
|
kind = stripped.split(":", 1)[1].strip()
|
|
elif stripped == "metadata:":
|
|
j = idx + 1
|
|
while j < len(lines):
|
|
meta_line = lines[j]
|
|
if meta_line and not meta_line.startswith(" "):
|
|
break
|
|
meta_stripped = meta_line.strip()
|
|
if meta_stripped.startswith("name:"):
|
|
name = meta_stripped.split(":", 1)[1].strip()
|
|
elif meta_stripped.startswith("namespace:"):
|
|
namespace = meta_stripped.split(":", 1)[1].strip()
|
|
j += 1
|
|
if kind:
|
|
docs.append(
|
|
{
|
|
"apiVersion": api_version,
|
|
"kind": kind,
|
|
"metadata": {"name": name, "namespace": namespace},
|
|
}
|
|
)
|
|
continue
|
|
if isinstance(parsed, dict) and parsed.get("kind"):
|
|
docs.append(parsed)
|
|
return docs
|
|
|
|
|
|
def _doc_key(doc: dict[str, Any]) -> tuple[str, str, str, str]:
|
|
api_version = str(doc.get("apiVersion") or "")
|
|
kind = str(doc.get("kind") or "")
|
|
meta = doc.get("metadata") or {}
|
|
if not isinstance(meta, dict):
|
|
meta = {}
|
|
namespace = str(meta.get("namespace") or "")
|
|
name = str(meta.get("name") or "")
|
|
return api_version, kind, namespace, name
|
|
|
|
|
|
def _dump_manifest_docs(path: Path, docs: list[dict[str, Any]]) -> None:
|
|
if not docs:
|
|
path.write_text("")
|
|
return
|
|
|
|
payload = "\n---\n".join(json.dumps(doc) for doc in docs)
|
|
path.write_text(f"{payload}\n")
|
|
|
|
|
|
def _split_frontdoor_docs(rendered_manifest: str) -> tuple[list[dict[str, Any]], list[dict[str, Any]]]:
|
|
docs = _extract_k8s_docs(rendered_manifest)
|
|
studio_kinds = {"Deployment", "Service", "Ingress"}
|
|
kong_kinds = {"Deployment", "Service", "Ingress"}
|
|
studio_names = {"supabase-studio", "supabase-studio-config"}
|
|
kong_names = {
|
|
"supabase-kong",
|
|
"supabase-kong-declarative-config",
|
|
"supabase-kong-declarative-config-jwt",
|
|
}
|
|
|
|
frontdoor_docs: list[dict[str, Any]] = []
|
|
frontdoor_keys: set[tuple[str, str, str, str]] = set()
|
|
|
|
for doc in docs:
|
|
kind = str(doc.get("kind") or "")
|
|
meta = doc.get("metadata") or {}
|
|
name = ""
|
|
if isinstance(meta, dict):
|
|
name = str(meta.get("name") or "")
|
|
|
|
is_studio = name in studio_names and kind in studio_kinds
|
|
is_kong = name in kong_names and kind in kong_kinds
|
|
if is_studio or is_kong:
|
|
frontdoor_docs.append(doc)
|
|
frontdoor_keys.add(_doc_key(doc))
|
|
|
|
app_docs = [doc for doc in docs if _doc_key(doc) not in frontdoor_keys]
|
|
return app_docs, frontdoor_docs
|
|
|
|
|
|
def _normalize_hostname(raw_value: str, fallback: str) -> str:
|
|
token = (raw_value or "").strip()
|
|
if not token or _is_placeholder(token):
|
|
return fallback
|
|
if "://" in token:
|
|
parsed = urllib.parse.urlparse(token)
|
|
return (parsed.hostname or "").strip() or fallback
|
|
return token.split("/", 1)[0].strip() or fallback
|
|
|
|
|
|
def _derive_api_hostname_from_studio(studio_hostname_raw: str, auth_hostname: str, mode: str) -> str:
|
|
if mode != "k8s":
|
|
return studio_hostname_raw
|
|
|
|
normalized_studio = _normalize_hostname(studio_hostname_raw, fallback="db.0.knoe.dev")
|
|
if mode == "k8s":
|
|
if normalized_studio.startswith("db."):
|
|
return f"api.{normalized_studio[3:]}"
|
|
return auth_hostname
|
|
return studio_hostname_raw
|
|
|
|
|
|
def _validate_unique_ingress_claims(claims: dict[str, list[str]]) -> None:
|
|
claimed: dict[tuple[str, str], str] = {}
|
|
for owner, hosts in claims.items():
|
|
for host in hosts:
|
|
normalized_host = (host or "").strip().lower()
|
|
if not normalized_host:
|
|
continue
|
|
key = (normalized_host, "/")
|
|
previous_owner = claimed.get(key)
|
|
if previous_owner and previous_owner != owner:
|
|
raise SystemExit(
|
|
f"Duplicate ingress host/path claim detected for '{normalized_host}/': "
|
|
f"{previous_owner} and {owner}."
|
|
)
|
|
claimed[key] = owner
|
|
|
|
|
|
def _validate_k8s_ingress_class(
|
|
*, mode: str, ingress_class: str, ingress_owner: str, allow_traefik_public_ingress: bool
|
|
) -> None:
|
|
if mode != "k8s":
|
|
return
|
|
normalized = (ingress_class or "").strip().lower()
|
|
if not normalized:
|
|
raise SystemExit(f"Ingress class for {ingress_owner} cannot be empty in k8s mode.")
|
|
if normalized in {"traefik", "traefik-external", "traefik-internal"} and not allow_traefik_public_ingress:
|
|
raise SystemExit(
|
|
f"Ingress class '{ingress_class}' for {ingress_owner} is incompatible with k8s mode "
|
|
"unless explicit Traefik public ingress provisioning is enabled."
|
|
)
|
|
|
|
|
|
def _discover_k8s_service_namespace(service_name: str) -> str:
|
|
try:
|
|
raw = subprocess.check_output(["kubectl", "get", "svc", "-A", "-o", "json"], text=True)
|
|
data = json.loads(raw)
|
|
for item in data.get("items", []) or []:
|
|
md = item.get("metadata", {}) or {}
|
|
if md.get("name") == service_name and md.get("namespace"):
|
|
return str(md.get("namespace"))
|
|
except Exception:
|
|
return ""
|
|
return ""
|
|
|
|
|
|
def _ensure_dir(path: Path) -> Path:
|
|
path.mkdir(parents=True, exist_ok=True)
|
|
return path
|
|
|
|
|
|
def _load_or_create_secret(path: Path, length: int = 32) -> str:
|
|
if path.exists():
|
|
return path.read_text().strip()
|
|
val = secrets.token_hex(length)
|
|
path.write_text(val)
|
|
return val
|
|
|
|
|
|
def _b64url(data: bytes) -> str:
|
|
return base64.urlsafe_b64encode(data).rstrip(b"=").decode("utf-8")
|
|
|
|
|
|
def _jwt(payload: Dict[str, Any], secret: str) -> str:
|
|
header = {"alg": "HS256", "typ": "JWT"}
|
|
head = _b64url(json.dumps(header, separators=(",", ":")).encode())
|
|
body = _b64url(json.dumps(payload, separators=(",", ":")).encode())
|
|
signing_input = f"{head}.{body}".encode()
|
|
sig = hmac.new(secret.encode(), signing_input, hashlib.sha256).digest()
|
|
return f"{head}.{body}.{_b64url(sig)}"
|
|
|
|
|
|
def _build_overlay(cfg: configparser.ConfigParser, args: argparse.Namespace) -> tuple[dict, dict]:
|
|
db_service = os.environ.get("KNOE_DB_SERVICE", "knoe-db-rw")
|
|
|
|
db_ns = _first(
|
|
os.environ.get("KNOE_DB_NAMESPACE", ""),
|
|
os.environ.get("DATABASE_NAMESPACE", ""),
|
|
_cfg_get(cfg, "Global", "DATABASE_NAMESPACE"),
|
|
_cfg_get(cfg, "Global", "NAMESPACE"),
|
|
os.environ.get("NAMESPACE", ""),
|
|
default="",
|
|
)
|
|
if _is_placeholder(db_ns):
|
|
db_ns = ""
|
|
if not db_ns:
|
|
db_ns = _discover_k8s_service_namespace(db_service) or ""
|
|
if not db_ns:
|
|
db_ns = "default"
|
|
|
|
supabase_ns = _first(
|
|
_cfg_get(cfg, "Supabase", "NAMESPACE"),
|
|
os.environ.get("SUPABASE_NAMESPACE", ""),
|
|
"supabase",
|
|
)
|
|
db_host = _first(
|
|
os.environ.get("SUPABASE_DB_HOST", ""),
|
|
os.environ.get("DB_HOST", ""),
|
|
_cfg_get(cfg, "Supabase", "DB_HOST"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_DB_HOST"),
|
|
default=f"{db_service}.{db_ns}.svc.cluster.local",
|
|
).strip()
|
|
if _is_placeholder(db_host):
|
|
db_host = f"{db_service}.{db_ns}.svc.cluster.local"
|
|
db_port = _first(
|
|
_cfg_get(cfg, "Global", "DB_HOST_PORT"),
|
|
_cfg_get(cfg, "Inputs", "init_password.db_host_port"),
|
|
"5432",
|
|
)
|
|
db_name = _first(
|
|
_cfg_get(cfg, "Database Creation", "DB_NAME"),
|
|
_cfg_get(cfg, "Global", "DB_NAME"),
|
|
"postgres",
|
|
)
|
|
db_password = _first(
|
|
os.environ.get("DB_PASSWORD", ""), # live secret override takes highest priority
|
|
_cfg_get(cfg, "Inputs", "init_password.db_password"),
|
|
_cfg_get(cfg, "Global", "DB_PASSWORD"),
|
|
)
|
|
if not db_password:
|
|
raise SystemExit("Database password is required (init_password.db_password or DB_PASSWORD).")
|
|
|
|
gen_dir = _ensure_dir(Path(args.output_dir))
|
|
secrets_dir = _ensure_dir(gen_dir / "secrets")
|
|
|
|
jwt_secret = _first(os.environ.get("SUPABASE_JWT_SECRET", "")) or _load_or_create_secret(
|
|
secrets_dir / "jwt.secret", length=32
|
|
)
|
|
now = int(time.time())
|
|
exp = now + 10 * 365 * 24 * 3600
|
|
anon_payload = {"role": "anon", "iss": "knoe-supabase", "iat": now, "exp": exp}
|
|
service_payload = {"role": "service_role", "iss": "knoe-supabase", "iat": now, "exp": exp}
|
|
anon_key = _jwt(anon_payload, jwt_secret)
|
|
service_key = _jwt(service_payload, jwt_secret)
|
|
|
|
legacy_supabase_hostname_raw = _first(
|
|
_cfg_get(cfg, "User", "supabase_hostname"),
|
|
_cfg_get(cfg, "Global", "supabase_hostname"),
|
|
_cfg_get(cfg, "User", "SUPABASE_HOSTNAME"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_HOSTNAME"),
|
|
os.environ.get("SUPABASE_HOSTNAME", ""),
|
|
os.environ.get("SUPABASE_HOST", ""),
|
|
default="db.0.knoe.dev",
|
|
).strip()
|
|
|
|
if _is_placeholder(legacy_supabase_hostname_raw):
|
|
legacy_supabase_hostname_raw = ""
|
|
if not legacy_supabase_hostname_raw:
|
|
legacy_supabase_hostname_raw = "db.0.knoe.dev"
|
|
|
|
mode = _first(
|
|
os.environ.get("PROLE_MODE", ""),
|
|
_cfg_get(cfg, "Global", "DEPLOYMENT_MODE"),
|
|
_cfg_get(cfg, "globals", "prole.mode"),
|
|
default="",
|
|
).strip().lower()
|
|
|
|
default_auth_hostname = "api.knoe.dev" if mode == "k8s" else "api.prole.org"
|
|
auth_hostname = _normalize_hostname(
|
|
_first(
|
|
os.environ.get("AUTH_HOSTNAME", ""),
|
|
os.environ.get("FRONTDOOR_HOST", ""),
|
|
_cfg_get(cfg, "Global", "AUTH_HOSTNAME"),
|
|
_cfg_get(cfg, "Global", "FRONTDOOR_HOST"),
|
|
default=default_auth_hostname,
|
|
),
|
|
fallback=default_auth_hostname,
|
|
)
|
|
|
|
studio_hostname_raw = _first(
|
|
os.environ.get("SUPABASE_STUDIO_URL", ""),
|
|
os.environ.get("SUPABASE_STUDIO_HOSTNAME", ""),
|
|
_cfg_get(cfg, "User", "SUPABASE_STUDIO_HOSTNAME"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_STUDIO_HOSTNAME"),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_studio_url"),
|
|
legacy_supabase_hostname_raw,
|
|
default="db.0.knoe.dev",
|
|
).strip()
|
|
if _is_placeholder(studio_hostname_raw):
|
|
studio_hostname_raw = ""
|
|
if not studio_hostname_raw:
|
|
studio_hostname_raw = legacy_supabase_hostname_raw
|
|
|
|
api_host_fallback = _derive_api_hostname_from_studio(studio_hostname_raw, auth_hostname, mode)
|
|
|
|
api_hostname_raw = _first(
|
|
os.environ.get("SUPABASE_API_URL", ""),
|
|
os.environ.get("SUPABASE_API_HOSTNAME", ""),
|
|
_cfg_get(cfg, "User", "SUPABASE_API_HOSTNAME"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_API_HOSTNAME"),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_api_url"),
|
|
api_host_fallback,
|
|
default="api.knoe.dev",
|
|
).strip()
|
|
if _is_placeholder(api_hostname_raw):
|
|
api_hostname_raw = ""
|
|
if not api_hostname_raw:
|
|
api_hostname_raw = api_host_fallback
|
|
|
|
studio_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_STUDIO_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_studio_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_STUDIO_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
auth_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_AUTH_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_auth_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_AUTH_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
realtime_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_REALTIME_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_realtime_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_REALTIME_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
meta_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_META_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_meta_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_META_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
analytics_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_ANALYTICS_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_analytics_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_ANALYTICS_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
|
|
studio_host_entries, studio_public_url = _normalize_public_hosts(
|
|
studio_hostname_raw,
|
|
fallback_host="db.0.knoe.dev",
|
|
)
|
|
api_host_entries, api_public_url = _normalize_public_hosts(
|
|
api_hostname_raw,
|
|
fallback_host=studio_host_entries[0],
|
|
)
|
|
|
|
default_ingress_class = "gce" if mode == "k8s" else "traefik"
|
|
api_ingress_class = _first(
|
|
os.environ.get("SUPABASE_API_INGRESS_CLASS", ""),
|
|
os.environ.get("SUPABASE_INGRESS_CLASS", ""),
|
|
_cfg_get(cfg, "User", "SUPABASE_API_INGRESS_CLASS"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_API_INGRESS_CLASS"),
|
|
_cfg_get(cfg, "User", "SUPABASE_INGRESS_CLASS"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_INGRESS_CLASS"),
|
|
default=default_ingress_class,
|
|
).strip()
|
|
if not api_ingress_class or _is_placeholder(api_ingress_class):
|
|
api_ingress_class = default_ingress_class
|
|
studio_ingress_class = _first(
|
|
os.environ.get("SUPABASE_STUDIO_INGRESS_CLASS", ""),
|
|
_cfg_get(cfg, "User", "SUPABASE_STUDIO_INGRESS_CLASS"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_STUDIO_INGRESS_CLASS"),
|
|
api_ingress_class,
|
|
).strip()
|
|
if not studio_ingress_class or _is_placeholder(studio_ingress_class):
|
|
studio_ingress_class = api_ingress_class
|
|
|
|
allow_traefik_public_ingress = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_ALLOW_TRAEFIK_INGRESS", ""),
|
|
os.environ.get("ALLOW_TRAEFIK_PUBLIC_INGRESS", ""),
|
|
_cfg_get(cfg, "Global", "SUPABASE_ALLOW_TRAEFIK_INGRESS"),
|
|
_cfg_get(cfg, "Global", "ALLOW_TRAEFIK_PUBLIC_INGRESS"),
|
|
default="false",
|
|
),
|
|
default=False,
|
|
)
|
|
_validate_k8s_ingress_class(
|
|
mode=mode,
|
|
ingress_class=api_ingress_class,
|
|
ingress_owner="supabase-kong",
|
|
allow_traefik_public_ingress=allow_traefik_public_ingress,
|
|
)
|
|
_validate_k8s_ingress_class(
|
|
mode=mode,
|
|
ingress_class=studio_ingress_class,
|
|
ingress_owner="supabase-studio",
|
|
allow_traefik_public_ingress=allow_traefik_public_ingress,
|
|
)
|
|
if mode == "k8s":
|
|
_validate_unique_ingress_claims(
|
|
{
|
|
"supabase-kong": api_host_entries,
|
|
"supabase-studio": studio_host_entries,
|
|
}
|
|
)
|
|
|
|
app_cluster_kubecontext = _first(
|
|
os.environ.get("APP_CLUSTER_KUBECONTEXT", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.app_cluster_kubecontext"),
|
|
_cfg_get(cfg, "Global", "APP_CLUSTER_KUBECONTEXT"),
|
|
default="",
|
|
).strip()
|
|
db_cluster_kubecontext = _first(
|
|
os.environ.get("DB_CLUSTER_KUBECONTEXT", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.db_cluster_kubecontext"),
|
|
_cfg_get(cfg, "Global", "DB_CLUSTER_KUBECONTEXT"),
|
|
default="",
|
|
).strip()
|
|
active_kubecontext = _first(
|
|
os.environ.get("KUBECONTEXT", ""),
|
|
os.environ.get("KUBE_CONTEXT_NAME", ""),
|
|
os.environ.get("KUBECTL_CONTEXT", ""),
|
|
default="",
|
|
).strip()
|
|
public_hosts = sorted(set(api_host_entries + studio_host_entries))
|
|
if mode == "k8s" and app_cluster_kubecontext and active_kubecontext:
|
|
allowed_contexts = {app_cluster_kubecontext}
|
|
if db_cluster_kubecontext:
|
|
allowed_contexts.add(db_cluster_kubecontext)
|
|
if active_kubecontext not in allowed_contexts:
|
|
raise SystemExit(
|
|
"Refusing to render Supabase public ingress outside allowed split-cluster contexts "
|
|
f"{sorted(allowed_contexts)}. Active context: '{active_kubecontext}'."
|
|
)
|
|
|
|
frontdoor_auth_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("FRONTDOOR_AUTH_ENABLED", ""),
|
|
os.environ.get("AUTHORITY_ENABLED", ""),
|
|
_cfg_get(cfg, "Global", "FRONTDOOR_AUTH_ENABLED"),
|
|
_cfg_get(cfg, "Global", "AUTHORITY_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
auth_verify_path = _first(
|
|
os.environ.get("AUTH_VERIFY_PATH", ""),
|
|
_cfg_get(cfg, "Global", "AUTH_VERIFY_PATH"),
|
|
default="/auth/verify",
|
|
).strip()
|
|
if not auth_verify_path.startswith("/"):
|
|
auth_verify_path = f"/{auth_verify_path}"
|
|
auth_login_path = _first(
|
|
os.environ.get("AUTH_LOGIN_PATH", ""),
|
|
_cfg_get(cfg, "Global", "AUTH_LOGIN_PATH"),
|
|
default="/auth/login",
|
|
).strip()
|
|
if not auth_login_path.startswith("/"):
|
|
auth_login_path = f"/{auth_login_path}"
|
|
auth_response_headers = _first(
|
|
os.environ.get("AUTH_RESPONSE_HEADERS", ""),
|
|
_cfg_get(cfg, "Global", "AUTH_RESPONSE_HEADERS"),
|
|
default="X-Prole-User,X-Prole-Email,X-Prole-Groups",
|
|
).strip()
|
|
auth_verify_url = _first(
|
|
os.environ.get("AUTH_VERIFY_URL", ""),
|
|
_cfg_get(cfg, "Global", "AUTH_VERIFY_URL"),
|
|
default=f"https://{auth_hostname}{auth_verify_path}",
|
|
).strip()
|
|
auth_signin_url = _first(
|
|
os.environ.get("AUTH_SIGNIN_URL", ""),
|
|
_cfg_get(cfg, "Global", "AUTH_SIGNIN_URL"),
|
|
default=f"https://{auth_hostname}{auth_login_path}?next=$scheme://$host$escaped_request_uri",
|
|
).strip()
|
|
|
|
# Additional origins/redirect URLs allowed by GoTrue (comma-separated hostnames or URLs).
|
|
# Needed when a service at a different hostname (e.g. svc.knoe.dev) uses Supabase auth.
|
|
_extra_redirect_raw = _first(
|
|
os.environ.get("SUPABASE_ADDITIONAL_REDIRECT_URLS", ""),
|
|
_cfg_get(cfg, "Global", "SUPABASE_ADDITIONAL_REDIRECT_URLS"),
|
|
_cfg_get(cfg, "Supabase", "ADDITIONAL_REDIRECT_URLS"),
|
|
default="",
|
|
).strip()
|
|
_allow_list_entries: list[str] = []
|
|
for _base_url in (studio_public_url, api_public_url):
|
|
if not _base_url:
|
|
continue
|
|
_candidate = _base_url.rstrip("/") + "/**"
|
|
if _candidate not in _allow_list_entries:
|
|
_allow_list_entries.append(_candidate)
|
|
for _entry in _extra_redirect_raw.split(","):
|
|
_entry = _entry.strip()
|
|
if not _entry or _is_placeholder(_entry):
|
|
continue
|
|
if "://" not in _entry:
|
|
_entry = f"https://{_entry}"
|
|
if not _entry.endswith("/**"):
|
|
_entry = _entry.rstrip("/") + "/**"
|
|
if _entry not in _allow_list_entries:
|
|
_allow_list_entries.append(_entry)
|
|
_gotrue_uri_allow_list = ",".join(_allow_list_entries)
|
|
|
|
# Placement: pin Supabase pods to the configured primary node (default: pi.knoe.dev)
|
|
supabase_primary_node = _first(
|
|
os.environ.get("SUPABASE_PRIMARY_NODE", ""),
|
|
os.environ.get("SUPABASE_NODE_SELECTOR", ""),
|
|
os.environ.get("SUPABASE_PV_NODE", ""),
|
|
_cfg_get(cfg, "Global", "SUPABASE_PRIMARY_NODE"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_NODE_SELECTOR"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_PV_NODE"),
|
|
_cfg_get(cfg, "Supabase", "PRIMARY_NODE"),
|
|
default="gandalf.knoe.dev",
|
|
).strip()
|
|
if _is_placeholder(supabase_primary_node):
|
|
supabase_primary_node = ""
|
|
supabase_node_selector = (
|
|
{"kubernetes.io/hostname": supabase_primary_node} if supabase_primary_node else {}
|
|
)
|
|
supabase_storage_class = _first(
|
|
os.environ.get("SUPABASE_STORAGE_CLASS", ""),
|
|
_cfg_get(cfg, "Global", "SUPABASE_STORAGE_CLASS"),
|
|
_cfg_get(cfg, "Supabase", "STORAGE_CLASS"),
|
|
default="synology-iscsi",
|
|
).strip()
|
|
if _is_placeholder(supabase_storage_class):
|
|
supabase_storage_class = "merlin-local-iscsi-d002"
|
|
|
|
storage_backend = _first(
|
|
os.environ.get("SUPABASE_STORAGE_BACKEND", ""),
|
|
os.environ.get("STORAGE_BACKEND", ""),
|
|
_cfg_get(cfg, "Supabase", "STORAGE_BACKEND"),
|
|
_cfg_get(cfg, "Global", "STORAGE_BACKEND"),
|
|
default="s3",
|
|
).strip().lower()
|
|
if _is_placeholder(storage_backend):
|
|
storage_backend = ""
|
|
|
|
global_s3_endpoint = _first(
|
|
os.environ.get("SUPABASE_GLOBAL_S3_ENDPOINT", ""),
|
|
os.environ.get("GLOBAL_S3_ENDPOINT", ""),
|
|
_cfg_get(cfg, "Supabase", "GLOBAL_S3_ENDPOINT"),
|
|
_cfg_get(cfg, "Global", "GLOBAL_S3_ENDPOINT"),
|
|
default="http://garage.knoe-system.svc.cluster.local:3900",
|
|
).strip()
|
|
if _is_placeholder(global_s3_endpoint):
|
|
global_s3_endpoint = ""
|
|
|
|
garage_s3_key_id = _first(
|
|
os.environ.get("GARAGE_S3_KEY_ID", ""),
|
|
_cfg_get(cfg, "Supabase", "GARAGE_S3_KEY_ID"),
|
|
_cfg_get(cfg, "Global", "GARAGE_S3_KEY_ID"),
|
|
default="",
|
|
).strip()
|
|
garage_s3_access_key = _first(
|
|
os.environ.get("GARAGE_S3_ACCESS_KEY", ""),
|
|
_cfg_get(cfg, "Supabase", "GARAGE_S3_ACCESS_KEY"),
|
|
_cfg_get(cfg, "Global", "GARAGE_S3_ACCESS_KEY"),
|
|
default="",
|
|
).strip()
|
|
if _is_placeholder(garage_s3_key_id):
|
|
garage_s3_key_id = ""
|
|
if _is_placeholder(garage_s3_access_key):
|
|
garage_s3_access_key = ""
|
|
|
|
use_garage_s3 = storage_backend == "s3" and "garage" in global_s3_endpoint.lower()
|
|
if use_garage_s3 and (not garage_s3_key_id or not garage_s3_access_key):
|
|
raise SystemExit(
|
|
"Garage S3 credentials are required for Supabase storage. "
|
|
"Set GARAGE_S3_KEY_ID and GARAGE_S3_ACCESS_KEY in [Supabase] or [Global], "
|
|
"or via environment variables."
|
|
)
|
|
|
|
overlay: dict[str, Any] = {
|
|
"nameOverride": "supabase",
|
|
"fullnameOverride": "supabase",
|
|
"deployment": {
|
|
"db": {"enabled": False},
|
|
"functions": {"enabled": True, "fullnameOverride": "supabase-functions"},
|
|
"vector": {"enabled": True, "fullnameOverride": "supabase-vector"},
|
|
"kong": {"enabled": True, "fullnameOverride": "supabase-kong"},
|
|
"storage": {"enabled": True, "fullnameOverride": "supabase-storage"},
|
|
"minio": {"enabled": not use_garage_s3, "fullnameOverride": "supabase-minio"},
|
|
"imgproxy": {"enabled": True, "fullnameOverride": "supabase-imgproxy"},
|
|
# Explicit fullnameOverride per component strips the chart name
|
|
# from pod names (avoids 'supabase-knoe-supabase-<component>').
|
|
"analytics": {"enabled": analytics_enabled, "fullnameOverride": "supabase-analytics"},
|
|
"auth": {"enabled": auth_enabled, "fullnameOverride": "supabase-auth"},
|
|
"meta": {"enabled": meta_enabled, "fullnameOverride": "supabase-meta"},
|
|
"realtime": {"enabled": realtime_enabled, "fullnameOverride": "supabase-realtime"},
|
|
"rest": {"enabled": True, "fullnameOverride": "supabase-rest"},
|
|
"studio": {"enabled": studio_enabled, "fullnameOverride": "supabase-studio"},
|
|
},
|
|
"externalDatabase": {
|
|
"enabled": True,
|
|
"host": db_host,
|
|
"port": int(str(db_port)),
|
|
"database": db_name,
|
|
"ssl": "disable",
|
|
"createAliasService": True,
|
|
"aliasServiceName": "db",
|
|
},
|
|
"environment": {
|
|
"auth": {
|
|
"DB_HOST": db_host,
|
|
"DB_PORT": str(db_port),
|
|
"DB_SSL": "disable",
|
|
"API_EXTERNAL_URL": api_public_url,
|
|
"GOTRUE_SITE_URL": studio_public_url,
|
|
**( {"GOTRUE_URI_ALLOW_LIST": _gotrue_uri_allow_list} if _gotrue_uri_allow_list else {} ),
|
|
},
|
|
"analytics": {"DB_HOST": db_host, "DB_PORT": str(db_port)},
|
|
"meta": {"DB_HOST": db_host, "DB_PORT": str(db_port)},
|
|
"studio": {"SUPABASE_PUBLIC_URL": studio_public_url},
|
|
},
|
|
"secret": {
|
|
"db": {"password": db_password, "database": db_name},
|
|
"jwt": {"secret": jwt_secret, "anonKey": anon_key, "serviceKey": service_key},
|
|
"s3": {"keyId": garage_s3_key_id, "accessKey": garage_s3_access_key},
|
|
},
|
|
"ingress": {
|
|
"enabled": True,
|
|
"className": api_ingress_class,
|
|
"hosts": [{"host": host, "paths": [{"path": "/", "pathType": "Prefix"}]} for host in api_host_entries],
|
|
},
|
|
"studioIngress": {
|
|
"enabled": True,
|
|
"className": studio_ingress_class,
|
|
"hosts": [{"host": host, "paths": [{"path": "/", "pathType": "Prefix"}]} for host in studio_host_entries],
|
|
**({
|
|
"annotations": {
|
|
"nginx.ingress.kubernetes.io/auth-url": auth_verify_url,
|
|
"nginx.ingress.kubernetes.io/auth-signin": auth_signin_url,
|
|
"nginx.ingress.kubernetes.io/auth-response-headers": auth_response_headers,
|
|
}
|
|
} if frontdoor_auth_enabled else {}),
|
|
},
|
|
}
|
|
|
|
if supabase_storage_class:
|
|
# Validate: must be a synology/merlin mount — refuse pi/local SD card classes
|
|
if not any(supabase_storage_class.startswith(p) for p in
|
|
("synology", "merlin-local-iscsi", "myrddin-local-iscsi")):
|
|
raise SystemExit(
|
|
f"SUPABASE_STORAGE_CLASS '{supabase_storage_class}' is not a synology mount. "
|
|
"Supabase must run on iSCSI/NFS storage (merlin-local-iscsi-d002 or synology-iscsi). "
|
|
"Refusing deploy to prevent SD-card crash."
|
|
)
|
|
# Write to persistence.*.storageClassName — the path the Helm chart actually uses
|
|
persistence = overlay.setdefault("persistence", {})
|
|
for pvc_key in ("functions", "snippets", "deno", "imgproxy", "minio", "storage"):
|
|
persistence.setdefault(pvc_key, {})["storageClassName"] = supabase_storage_class
|
|
|
|
if mode == "k3s" and supabase_node_selector:
|
|
deployment = overlay.setdefault("deployment", {})
|
|
for component in (
|
|
"analytics",
|
|
"auth",
|
|
"functions",
|
|
"imgproxy",
|
|
"kong",
|
|
"meta",
|
|
"minio",
|
|
"realtime",
|
|
"rest",
|
|
"storage",
|
|
"studio",
|
|
"vector",
|
|
):
|
|
component_cfg = deployment.setdefault(component, {})
|
|
component_cfg.setdefault("nodeSelector", {})
|
|
component_cfg["nodeSelector"].update(supabase_node_selector)
|
|
|
|
meta = {
|
|
"supabase_namespace": supabase_ns,
|
|
"db_namespace": db_ns,
|
|
"db_host": db_host,
|
|
}
|
|
return overlay, meta
|
|
|
|
|
|
def render(args: argparse.Namespace) -> None:
|
|
cfg_path = Path(args.config)
|
|
if cfg_path.is_dir():
|
|
cfg_path = cfg_path / "prole.cfg"
|
|
if not cfg_path.exists():
|
|
raise SystemExit(f"Config not found: {cfg_path}")
|
|
|
|
cfg = _read_cfg(cfg_path)
|
|
overlay, meta = _build_overlay(cfg, args)
|
|
|
|
gen_dir = _ensure_dir(Path(args.output_dir))
|
|
values_path = gen_dir / "values.generated.json"
|
|
values_path.write_text(json.dumps(overlay, indent=2))
|
|
|
|
# Write Namespace manifest for Supabase
|
|
k8s_dir = _ensure_dir(Path(args.manifests_dir))
|
|
namespace_manifest = {
|
|
"apiVersion": "v1",
|
|
"kind": "Namespace",
|
|
"metadata": {"name": meta["supabase_namespace"]},
|
|
}
|
|
(k8s_dir / "namespace.yaml").write_text(json.dumps(namespace_manifest))
|
|
|
|
# Render chart to a single manifest file (Helm accepts JSON values)
|
|
rendered_path = k8s_dir / "supabase-helm.yaml"
|
|
cmd = [
|
|
"helm",
|
|
"template",
|
|
"supabase",
|
|
str(REPO_ROOT / "supabase" / "helm" / "knoe-supabase"),
|
|
"-n",
|
|
meta["supabase_namespace"],
|
|
"-f",
|
|
str(values_path),
|
|
]
|
|
proc = subprocess.run(cmd, capture_output=True, text=True)
|
|
if proc.returncode != 0:
|
|
sys.stderr.write(proc.stderr)
|
|
raise SystemExit(f"Helm template failed (code {proc.returncode})")
|
|
rendered_path.write_text(proc.stdout)
|
|
|
|
app_docs, frontdoor_docs = _split_frontdoor_docs(proc.stdout)
|
|
app_rendered_path = gen_dir / "supabase-helm.app.yaml"
|
|
frontdoor_rendered_path = gen_dir / "supabase-helm.frontdoor-db.yaml"
|
|
_dump_manifest_docs(app_rendered_path, app_docs)
|
|
_dump_manifest_docs(frontdoor_rendered_path, frontdoor_docs)
|
|
|
|
summary = {
|
|
"values": str(values_path),
|
|
"manifests": str(rendered_path),
|
|
"manifests_app": str(app_rendered_path),
|
|
"manifests_frontdoor_db": str(frontdoor_rendered_path),
|
|
"db_host": meta["db_host"],
|
|
"supabase_namespace": meta["supabase_namespace"],
|
|
}
|
|
(gen_dir / "manifest-summary.json").write_text(json.dumps(summary, indent=2))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description="Render Supabase Helm chart from prole.cfg")
|
|
parser.add_argument(
|
|
"--config",
|
|
"-c",
|
|
default=os.environ.get("PROLE_CONF", str(REPO_ROOT / "conf")),
|
|
help="Path to prole.cfg or its directory",
|
|
)
|
|
parser.add_argument(
|
|
"--output-dir",
|
|
default=str(REPO_ROOT / "supabase" / "helm" / "generated"),
|
|
help="Directory to write generated values and metadata",
|
|
)
|
|
parser.add_argument(
|
|
"--manifests-dir",
|
|
default=str(REPO_ROOT / "supabase" / "k8s"),
|
|
help="Directory to write rendered Kubernetes manifests",
|
|
)
|
|
args = parser.parse_args()
|
|
render(args)
|