mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
3f34fa8b32
Five fixes Junie surfaced while running the kdc-trust-reset-repeatable
Junie brief end-to-end (companion to commit 6f99f95). All hit during
the unattended `install.sh --mode k3s --reset` pipeline.
- knoe/core/milestones.py (KerberosMilestone):
For k3s and k3d modes, deploy the KDC pod via `init_kdc.sh start`
before running init_kerberos.sh. init_kerberos.sh only chains into
init_kdc.sh when PROLE_KDC_STANDALONE=1; without this hook the
cluster came up with no KDC pod and the cross-realm trust principals
had nowhere to land.
- knoe/milestone.py (Milestone._get_script_env):
Clear KUBECTL_CONTEXT in addition to KUBECONTEXT so stale entries
from a different machine's cfg don't override the kubeconfig's
own current-context.
- etc/knoe_cfg.sh (_knoe_read_cfg):
Skip KUBECTL_CONTEXT / KUBE_CONTEXT_NAME / KUBECONTEXT entries when
reading cfg in k3s mode. Same theme: kubeconfig current-context is
authoritative.
- etc/init_1password.sh + knoe/core/onepassword.py:
When running non-interactively (no TTY on stdin) and no `op`
session exists, skip rather than hang on `op signin`. Lets the
unattended pipeline proceed for k3s/k3d where in-cluster secrets
are managed separately from 1Password.
Co-authored-by: Junie <junie@jetbrains.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
80 lines
3.1 KiB
Bash
Executable File
80 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# init_1password.sh
|
|
# Preflight: sign in to 1Password, create the 'knoey' vault if absent,
|
|
# and ensure the 'administrator' item (DB master password) exists.
|
|
#
|
|
# Called by install.sh before the Python installer. Skipped in --min mode.
|
|
|
|
set -euo pipefail
|
|
|
|
# ── helpers ────────────────────────────────────────────────────────────────
|
|
|
|
_info() { echo "==> [1Password] $*"; }
|
|
_warn() { echo " [WARN] $*" >&2; }
|
|
_fatal() { echo " [ERROR] $*" >&2; exit 1; }
|
|
|
|
VAULT="knoey"
|
|
ADMIN_ITEM="administrator"
|
|
|
|
# ── skip in --min mode ─────────────────────────────────────────────────────
|
|
|
|
for arg in "$@"; do
|
|
if [[ "$arg" == "--min" ]]; then
|
|
_warn "Skipping 1Password preflight in --min mode."
|
|
exit 0
|
|
fi
|
|
done
|
|
|
|
# ── require op CLI ─────────────────────────────────────────────────────────
|
|
|
|
if ! command -v op >/dev/null 2>&1; then
|
|
_fatal "1Password CLI (op) not found.
|
|
Install: brew install 1password-cli
|
|
Docs: https://developer.1password.com/docs/cli"
|
|
fi
|
|
|
|
_info "op CLI found: $(op --version)"
|
|
|
|
# ── sign in ────────────────────────────────────────────────────────────────
|
|
|
|
if ! op whoami >/dev/null 2>&1; then
|
|
# If running non-interactively (no TTY), skip rather than hang.
|
|
if [[ ! -t 0 ]]; then
|
|
_warn "No active 1Password session and no TTY — skipping 1Password preflight."
|
|
exit 0
|
|
fi
|
|
_info "No active 1Password session. Signing in..."
|
|
op signin
|
|
fi
|
|
|
|
_info "Signed in as: $(op whoami --format json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('email','unknown'))" 2>/dev/null || op whoami)"
|
|
|
|
# ── create knoey vault if absent ───────────────────────────────────────────
|
|
|
|
if op vault get "$VAULT" >/dev/null 2>&1; then
|
|
_info "Vault '$VAULT' already exists."
|
|
else
|
|
_info "Creating vault '$VAULT'..."
|
|
op vault create "$VAULT"
|
|
_info "Vault '$VAULT' created."
|
|
fi
|
|
|
|
# ── ensure administrator item exists ───────────────────────────────────────
|
|
|
|
if op item get "$ADMIN_ITEM" --vault "$VAULT" >/dev/null 2>&1; then
|
|
_info "Item '$ADMIN_ITEM' already exists in vault '$VAULT'."
|
|
else
|
|
_info "Creating item '$ADMIN_ITEM' in vault '$VAULT' with a generated password..."
|
|
op item create \
|
|
--category login \
|
|
--title "$ADMIN_ITEM" \
|
|
--vault "$VAULT" \
|
|
--generate-password="32,letters,digits"
|
|
_info "Item '$ADMIN_ITEM' created."
|
|
fi
|
|
|
|
# ── export for child processes ─────────────────────────────────────────────
|
|
|
|
export OP_VAULT="$VAULT"
|
|
_info "OP_VAULT=$OP_VAULT"
|