mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:04:31 +00:00
598eae4633
- Add ssl_hosts group and prole_ssl role to deploy registry cert/key to /etc/ssl/certs/prole - Configure k8s registry deployment to serve HTTPS using mounted host certs - Switch k3s/containerd registry mirror config to https:// and prefer HTTPS checks with HTTP fallback Co-authored-by: Junie <junie@jetbrains.com>
85 lines
2.2 KiB
Bash
85 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
# init_k3s_registry.sh
|
|
# Purpose:
|
|
# - Configure k3s/containerd to allow HTTPS access to the Prole registry
|
|
# - Writes /etc/rancher/k3s/registries.yaml on the k3s node
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck disable=SC1090
|
|
source "$SCRIPT_DIR/prole_cfg.sh"
|
|
|
|
ACTION=${1:-apply}
|
|
|
|
registry_host_from_url() {
|
|
local value="${1:-}"
|
|
value="${value#http://}"
|
|
value="${value#https://}"
|
|
value="${value%%/*}"
|
|
value="${value%%:*}"
|
|
printf '%s' "$value"
|
|
}
|
|
|
|
K3S_REGISTRY_HOST=${K3S_REGISTRY_HOST:-$(registry_host_from_url "${PROLE_K3S_SERVER:-${K3S_SERVER_URL:-}}")}
|
|
K3S_REGISTRY_PORT=${K3S_REGISTRY_PORT:-5000}
|
|
K3S_REGISTRY_NAMESPACE=${K3S_REGISTRY_NAMESPACE:-${REGISTRY_NAMESPACE:-${SERVICE_NAMESPACE:-${PROLE_NAMESPACE:-default}}}}
|
|
K3S_REGISTRY_FILE=${K3S_REGISTRY_FILE:-/etc/rancher/k3s/registries.yaml}
|
|
|
|
ensure_root() {
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
echo "ERROR: must run as root to write $K3S_REGISTRY_FILE" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
render_registries_yaml() {
|
|
local host="$1"
|
|
local port="$2"
|
|
local ns="$3"
|
|
cat <<EOF
|
|
mirrors:
|
|
"${host}:${port}":
|
|
endpoint:
|
|
- "https://${host}:${port}"
|
|
"registry.${ns}.svc.cluster.local:${port}":
|
|
endpoint:
|
|
- "https://${host}:${port}"
|
|
configs:
|
|
"${host}:${port}":
|
|
tls:
|
|
insecure_skip_verify: true
|
|
"registry.${ns}.svc.cluster.local:${port}":
|
|
tls:
|
|
insecure_skip_verify: true
|
|
EOF
|
|
}
|
|
|
|
case "$ACTION" in
|
|
apply|update)
|
|
if [[ -z "${K3S_REGISTRY_HOST:-}" ]]; then
|
|
echo "ERROR: K3S_REGISTRY_HOST is empty (set PROLE_K3S_SERVER or K3S_REGISTRY_HOST)." >&2
|
|
exit 2
|
|
fi
|
|
ensure_root
|
|
mkdir -p "$(dirname "$K3S_REGISTRY_FILE")"
|
|
render_registries_yaml "$K3S_REGISTRY_HOST" "$K3S_REGISTRY_PORT" "$K3S_REGISTRY_NAMESPACE" >"$K3S_REGISTRY_FILE"
|
|
echo "Wrote $K3S_REGISTRY_FILE for ${K3S_REGISTRY_HOST}:${K3S_REGISTRY_PORT}"
|
|
echo "Restart k3s to apply: sudo systemctl restart k3s"
|
|
;;
|
|
status)
|
|
if [[ -f "$K3S_REGISTRY_FILE" ]]; then
|
|
echo "Found $K3S_REGISTRY_FILE"
|
|
cat "$K3S_REGISTRY_FILE"
|
|
else
|
|
echo "No registries.yaml at $K3S_REGISTRY_FILE"
|
|
exit 1
|
|
fi
|
|
;;
|
|
*)
|
|
echo "Usage: $0 {apply|status}" >&2
|
|
exit 2
|
|
;;
|
|
esac
|