prole/etc/init_service_layer.sh

#!/usr/bin/env bash

set -euo pipefail

# init_service_layer.sh
# Purpose:
# - Deploy the Prole service layer (ArgoCD, OpenTofu, Garage, OpenBao; Kerberos optional)
# - Keep service-layer resources grouped in SERVICE_NAMESPACE
# - Migrate service layer to a new namespace

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
# shellcheck disable=SC1090
source "$SCRIPT_DIR/prole_cfg.sh"

if [[ "${1:-}" == "--mode" || "${1:-}" == "-m" ]]; then
  prole_set_mode "${2:-}"
  shift 2
elif [[ "${1:-}" == --mode=* || "${1:-}" == -m=* ]]; then
  prole_set_mode "${1#*=}"
  shift
fi

prole_ensure_kubeconfig >/dev/null 2>&1 || true

ACTION=""
SERVICE_NAMESPACE_OVERRIDE=""
FROM_NAMESPACE=""
TO_NAMESPACE=""
ENABLE_KERBEROS=0

usage() {
  cat <<EOF
Usage: init_service_layer.sh [-n|--namespace NS] [-k|--kerberos] [--from OLD_NS] [--to NEW_NS] <start|update|restart|status|stop|migrate>
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    -n|--namespace)
      shift
      SERVICE_NAMESPACE_OVERRIDE="${1:-}"
      shift
      ;;
    -n=*|--namespace=*)
      SERVICE_NAMESPACE_OVERRIDE="${1#*=}"
      shift
      ;;
    -k|--kerberos)
      ENABLE_KERBEROS=1
      shift
      ;;
    --from)
      shift
      FROM_NAMESPACE="${1:-}"
      shift
      ;;
    --from=*)
      FROM_NAMESPACE="${1#*=}"
      shift
      ;;
    --to)
      shift
      TO_NAMESPACE="${1:-}"
      shift
      ;;
    --to=*)
      TO_NAMESPACE="${1#*=}"
      shift
      ;;
    start|update|restart|status|stop|migrate|initialize|reload)
      ACTION="$1"
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      usage
      exit 2
      ;;
  esac
done

if [[ -n "$SERVICE_NAMESPACE_OVERRIDE" ]]; then
  SERVICE_NAMESPACE="$SERVICE_NAMESPACE_OVERRIDE"
fi
SERVICE_NAMESPACE="${SERVICE_NAMESPACE:-${NAMESPACE:-default}}"

if [[ -n "$TO_NAMESPACE" ]]; then
  SERVICE_NAMESPACE="$TO_NAMESPACE"
fi

SERVICE_LAYER_NAMESPACE="$SERVICE_NAMESPACE"
ARGOCD_NS="${ARGOCD_NAMESPACE:-argocd}"
REGISTRY_NS="${REGISTRY_NAMESPACE:-default}"

STATE_DIR=""
if [[ -n "${PROLE_SERVICE:-}" && -f "$PROLE_SERVICE/prole_cfg.sh" ]]; then
  STATE_DIR="${PROLE_SERVICE}/secrets"
else
  STATE_DIR="${SCRIPT_DIR}/secrets"
fi
STATE_FILE="${STATE_DIR}/service-layer.namespace"

log() { printf '%s\n' "$*"; }
err() { printf '%s\n' "$*" >&2; }

ensure_tools() {
  command -v kubectl >/dev/null || { err "Missing required tool: kubectl"; exit 1; }
}

ensure_namespace() {
  local ns="$1"
  if ! kubectl get namespace "$ns" >/dev/null 2>&1; then
    log "Creating namespace '$ns' ..."
    kubectl create namespace "$ns" >/dev/null 2>&1 || true
  fi
}

label_namespace() {
  local ns="$1"
  kubectl label namespace "$ns" prole.layer=service --overwrite >/dev/null 2>&1 || true
}

read_last_namespace() {
  if [[ -f "$STATE_FILE" ]]; then
    cat "$STATE_FILE"
  fi
}

write_last_namespace() {
  mkdir -p "$STATE_DIR"
  printf '%s' "$1" >"$STATE_FILE"
}



deploy_service_layer() {
  local action="$1"
  local ns="$2"
  local rc=0

  ensure_namespace "$ns"
  label_namespace "$ns"

  local argocd_action opentofu_action garage_action kdc_action openbao_action certmgr_action kong_action
  case "$action" in
    start|initialize|update|reload) argocd_action="update" ;;
    restart) argocd_action="restart" ;;
    stop) argocd_action="stop" ;;
    status) argocd_action="status" ;;
    *) argocd_action="update" ;;
  esac

  case "$action" in
    start|initialize|update|reload) opentofu_action="update" ;;
    restart) opentofu_action="restart" ;;
    stop) opentofu_action="stop" ;;
    status) opentofu_action="status" ;;
    *) opentofu_action="update" ;;
  esac

  case "$action" in
    start|initialize|update|reload) openbao_action="update" ;;
    restart) openbao_action="restart" ;;
    stop) openbao_action="stop" ;;
    status) openbao_action="status" ;;
    *) openbao_action="update" ;;
  esac

  case "$action" in
    start|initialize|update|reload) certmgr_action="update" ;;
    restart) certmgr_action="restart" ;;
    stop) certmgr_action="stop" ;;
    status) certmgr_action="status" ;;
    *) certmgr_action="update" ;;
  esac

  case "$action" in
    start|initialize|update|reload) garage_action="start" ;;
    restart) garage_action="restart" ;;
    stop) garage_action="stop" ;;
    status) garage_action="status" ;;
    *) garage_action="start" ;;
  esac

  case "$action" in
    start|initialize|update|reload) kong_action="update" ;;
    restart) kong_action="restart" ;;
    stop) kong_action="stop" ;;
    status) kong_action="status" ;;
    *) kong_action="update" ;;
  esac

  case "$action" in
    stop) kdc_action="cleanup" ;;
    status) kdc_action="status" ;;
    *) kdc_action="update" ;;
  esac

  ARGOCD_NAMESPACE="$ARGOCD_NS" REGISTRY_NAMESPACE="$REGISTRY_NS" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_registry.sh" -n "$ARGOCD_NS" --registry-namespace "$REGISTRY_NS" "$argocd_action" || rc=$?

  OPENTOFU_NAMESPACE="$ns" OPENTOFU_SECRET_NAMESPACE="${NAMESPACE:-$ns}" OPENTOFU_OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_opentofu.sh" -n "$ns" "$opentofu_action" || rc=$?

  OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_openbao.sh" -n "$ns" "$openbao_action" || rc=$?

  CERTMGR_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_certmgr.sh" -n "$ns" "$certmgr_action" || rc=$?

  NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_garage_store.sh" "$garage_action" || rc=$?

  KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_kong.sh" -n "$ns" "$kong_action" || rc=$?

  if [[ "$ENABLE_KERBEROS" == "1" ]]; then
    SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
      "$SCRIPT_DIR/init_kdc.sh" "$kdc_action" || rc=$?
  fi

  return "$rc"
}

cleanup_old_namespace() {
  local ns="$1"
  log "Cleaning up service layer in old namespace '$ns' ..."
  ARGOCD_NAMESPACE="$ARGOCD_NS" REGISTRY_NAMESPACE="$REGISTRY_NS" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_registry.sh" -n "$ARGOCD_NS" --registry-namespace "$REGISTRY_NS" stop || true
  OPENTOFU_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_opentofu.sh" -n "$ns" stop || true
  OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_openbao.sh" -n "$ns" stop || true
  CERTMGR_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_certmgr.sh" -n "$ns" stop || true
  NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_garage_store.sh" stop || true
  KONG_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_kong.sh" -n "$ns" stop || true
  if [[ "$ENABLE_KERBEROS" == "1" ]]; then
    SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
      "$SCRIPT_DIR/init_kdc.sh" cleanup || true
  fi
  cleanup_openbao "$ns"
}

migrate_service_layer() {
  local from_ns="$FROM_NAMESPACE"
  local to_ns="$SERVICE_LAYER_NAMESPACE"

  if [[ -z "$from_ns" ]]; then
    from_ns="$(read_last_namespace || true)"
  fi
  if [[ -z "$to_ns" ]]; then
    err "Missing target SERVICE_NAMESPACE"
    exit 2
  fi

  if [[ -z "$from_ns" || "$from_ns" == "$to_ns" ]]; then
    log "Deploying service layer in '$to_ns' ..."
    deploy_service_layer update "$to_ns"
    write_last_namespace "$to_ns"
    return 0
  fi

  log "Migrating service layer from '$from_ns' to '$to_ns' ..."
  deploy_service_layer update "$to_ns"
  cleanup_old_namespace "$from_ns"
  write_last_namespace "$to_ns"
}

ensure_tools

case "$ACTION" in
  start|update|restart|status|stop|initialize|reload)
    deploy_service_layer "$ACTION" "$SERVICE_LAYER_NAMESPACE"
    if [[ "$ACTION" != "status" && "$ACTION" != "stop" ]]; then
      write_last_namespace "$SERVICE_LAYER_NAMESPACE"
    fi
    ;;
  migrate)
    migrate_service_layer
    ;;
  *)
    usage
    exit 2
    ;;
esac