prole/etc/init_service_layer.sh

#!/usr/bin/env bash

set -euo pipefail

# init_service_layer.sh
# Purpose:
# - Deploy the Prole service layer (registry, OpenBao, OpenTofu, Garage, Authority)
# - Keep service-layer resources grouped in SERVICE_NAMESPACE
# - Migrate service layer to a new namespace with best-effort registry data copy

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
# shellcheck disable=SC1090
source "$SCRIPT_DIR/prole_cfg.sh"

if [[ "${1:-}" == "--mode" || "${1:-}" == "-m" ]]; then
  prole_set_mode "${2:-}"
  shift 2
elif [[ "${1:-}" == --mode=* || "${1:-}" == -m=* ]]; then
  prole_set_mode "${1#*=}"
  shift
fi

prole_ensure_kubeconfig >/dev/null 2>&1 || true

ACTION=""
SERVICE_NAMESPACE_OVERRIDE=""
FROM_NAMESPACE=""
TO_NAMESPACE=""

usage() {
  cat <<EOF
Usage: init_service_layer.sh [-n|--namespace NS] [--from OLD_NS] [--to NEW_NS] <start|update|restart|status|stop|migrate>
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    -n|--namespace)
      shift
      SERVICE_NAMESPACE_OVERRIDE="${1:-}"
      shift
      ;;
    -n=*|--namespace=*)
      SERVICE_NAMESPACE_OVERRIDE="${1#*=}"
      shift
      ;;
    --from)
      shift
      FROM_NAMESPACE="${1:-}"
      shift
      ;;
    --from=*)
      FROM_NAMESPACE="${1#*=}"
      shift
      ;;
    --to)
      shift
      TO_NAMESPACE="${1:-}"
      shift
      ;;
    --to=*)
      TO_NAMESPACE="${1#*=}"
      shift
      ;;
    start|update|restart|status|stop|migrate|initialize|reload)
      ACTION="$1"
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      usage
      exit 2
      ;;
  esac
done

if [[ -n "$SERVICE_NAMESPACE_OVERRIDE" ]]; then
  SERVICE_NAMESPACE="$SERVICE_NAMESPACE_OVERRIDE"
fi
SERVICE_NAMESPACE="${SERVICE_NAMESPACE:-${NAMESPACE:-default}}"

if [[ -n "$TO_NAMESPACE" ]]; then
  SERVICE_NAMESPACE="$TO_NAMESPACE"
fi

SERVICE_LAYER_NAMESPACE="$SERVICE_NAMESPACE"

STATE_DIR=""
if [[ -n "${PROLE_SERVICE:-}" && -f "$PROLE_SERVICE/prole_cfg.sh" ]]; then
  STATE_DIR="${PROLE_SERVICE}/secrets"
else
  STATE_DIR="${SCRIPT_DIR}/secrets"
fi
STATE_FILE="${STATE_DIR}/service-layer.namespace"

log() { printf '%s\n' "$*"; }
err() { printf '%s\n' "$*" >&2; }

ensure_tools() {
  command -v kubectl >/dev/null || { err "Missing required tool: kubectl"; exit 1; }
}

ensure_namespace() {
  local ns="$1"
  if ! kubectl get namespace "$ns" >/dev/null 2>&1; then
    log "Creating namespace '$ns' ..."
    kubectl create namespace "$ns" >/dev/null 2>&1 || true
  fi
}

label_namespace() {
  local ns="$1"
  kubectl label namespace "$ns" prole.layer=service --overwrite >/dev/null 2>&1 || true
}

read_last_namespace() {
  if [[ -f "$STATE_FILE" ]]; then
    cat "$STATE_FILE"
  fi
}

write_last_namespace() {
  mkdir -p "$STATE_DIR"
  printf '%s' "$1" >"$STATE_FILE"
}

cleanup_openbao() {
  local ns="$1"
  kubectl -n "$ns" delete deploy openbao --ignore-not-found >/dev/null 2>&1 || true
  kubectl -n "$ns" delete svc openbao --ignore-not-found >/dev/null 2>&1 || true
  kubectl -n "$ns" delete secret openbao-root --ignore-not-found >/dev/null 2>&1 || true
  kubectl -n "$ns" delete configmap prole-krb5-conf --ignore-not-found >/dev/null 2>&1 || true
}

copy_registry_data() {
  local from_ns="$1"
  local to_ns="$2"
  local src_pod dst_pod

  src_pod=$(kubectl -n "$from_ns" get pods -l app=registry -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
  dst_pod=$(kubectl -n "$to_ns" get pods -l app=registry -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
  if [[ -z "$src_pod" || -z "$dst_pod" ]]; then
    log "Registry pods not found for copy ($from_ns -> $to_ns); skipping."
    return 0
  fi

  if ! kubectl -n "$from_ns" exec "$src_pod" -- sh -c 'command -v tar >/dev/null 2>&1'; then
    log "Registry source pod lacks tar; skipping data copy."
    return 0
  fi
  if ! kubectl -n "$to_ns" exec "$dst_pod" -- sh -c 'command -v tar >/dev/null 2>&1'; then
    log "Registry destination pod lacks tar; skipping data copy."
    return 0
  fi

  log "Copying registry data from '$from_ns' to '$to_ns' (best-effort)..."
  if kubectl -n "$from_ns" exec "$src_pod" -- tar -C /var/lib/registry -cf - . \
    | kubectl -n "$to_ns" exec -i "$dst_pod" -- tar -C /var/lib/registry -xf -; then
    log "Registry data copy complete."
  else
    log "Registry data copy failed; continuing."
  fi
}

deploy_service_layer() {
  local action="$1"
  local ns="$2"
  local rc=0

  ensure_namespace "$ns"
  label_namespace "$ns"

  local registry_action openbao_action opentofu_action garage_action kdc_action
  case "$action" in
    start|initialize|update|reload) registry_action="update" ;;
    restart) registry_action="restart" ;;
    stop) registry_action="stop" ;;
    status) registry_action="status" ;;
    *) registry_action="update" ;;
  esac

  case "$action" in
    status) openbao_action="status" ;;
    *) openbao_action="update" ;;
  esac

  case "$action" in
    start|initialize|update|reload) opentofu_action="update" ;;
    restart) opentofu_action="restart" ;;
    stop) opentofu_action="stop" ;;
    status) opentofu_action="status" ;;
    *) opentofu_action="update" ;;
  esac

  case "$action" in
    start|initialize|update|reload) garage_action="start" ;;
    restart) garage_action="restart" ;;
    stop) garage_action="stop" ;;
    status) garage_action="status" ;;
    *) garage_action="start" ;;
  esac

  case "$action" in
    stop) kdc_action="cleanup" ;;
    status) kdc_action="status" ;;
    *) kdc_action="update" ;;
  esac

  REGISTRY_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_registry.sh" -n "$ns" "$registry_action" || rc=$?

  if [[ "$action" == "stop" ]]; then
    cleanup_openbao "$ns" || true
  else
    OPENBAO_NAMESPACE="$ns" OPENBAO_PATH_NAMESPACE="${NAMESPACE:-$ns}" SERVICE_NAMESPACE="$ns" \
      "$SCRIPT_DIR/init_openbao.sh" -n "$ns" "$openbao_action" || rc=$?
  fi

  OPENTOFU_NAMESPACE="$ns" OPENTOFU_SECRET_NAMESPACE="${NAMESPACE:-$ns}" OPENTOFU_OPENBAO_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_opentofu.sh" -n "$ns" "$opentofu_action" || rc=$?

  NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_garage_store.sh" "$garage_action" || rc=$?

  SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_kdc.sh" "$kdc_action" || rc=$?

  return "$rc"
}

cleanup_old_namespace() {
  local ns="$1"
  log "Cleaning up service layer in old namespace '$ns' ..."
  REGISTRY_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_registry.sh" -n "$ns" stop || true
  OPENTOFU_NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_opentofu.sh" -n "$ns" stop || true
  NAMESPACE="$ns" SERVICE_NAMESPACE="$ns" GARAGE_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_garage_store.sh" stop || true
  SERVICE_NAMESPACE="$ns" PROLE_KDC_NAMESPACE="$ns" \
    "$SCRIPT_DIR/init_kdc.sh" cleanup || true
  cleanup_openbao "$ns"
}

migrate_service_layer() {
  local from_ns="$FROM_NAMESPACE"
  local to_ns="$SERVICE_LAYER_NAMESPACE"

  if [[ -z "$from_ns" ]]; then
    from_ns="$(read_last_namespace || true)"
  fi
  if [[ -z "$to_ns" ]]; then
    err "Missing target SERVICE_NAMESPACE"
    exit 2
  fi

  if [[ -z "$from_ns" || "$from_ns" == "$to_ns" ]]; then
    log "Deploying service layer in '$to_ns' ..."
    deploy_service_layer update "$to_ns"
    write_last_namespace "$to_ns"
    return 0
  fi

  log "Migrating service layer from '$from_ns' to '$to_ns' ..."
  deploy_service_layer update "$to_ns"
  copy_registry_data "$from_ns" "$to_ns" || true
  cleanup_old_namespace "$from_ns"
  write_last_namespace "$to_ns"
}

ensure_tools

case "$ACTION" in
  start|update|restart|status|stop|initialize|reload)
    deploy_service_layer "$ACTION" "$SERVICE_LAYER_NAMESPACE"
    if [[ "$ACTION" != "status" && "$ACTION" != "stop" ]]; then
      write_last_namespace "$SERVICE_LAYER_NAMESPACE"
    fi
    ;;
  migrate)
    migrate_service_layer
    ;;
  *)
    usage
    exit 2
    ;;
esac