mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 15:04:31 +00:00
26cac12759
- Refactor k3s/kube_config.sh to fetch remote kubeconfig and configure local context. - Add Ansible task svc_check.yml to deploy a status site via Kong and cert-manager. - Include svc_check.yml in k3s role's main tasks.
76 lines
2.6 KiB
Bash
76 lines
2.6 KiB
Bash
#!/usr/bin/env bash
|
|
# Refresh the local kubeconfig entry for prole-k3s using the live kubeconfig
|
|
# from myrddin.prole.org. The CA bundle on the server is malformed, so we
|
|
# deliberately disable TLS verification while keeping client cert auth.
|
|
|
|
# If invoked via `sh`, re-exec with bash to enable arrays and pipefail.
|
|
if [ -z "${BASH_VERSION:-}" ]; then
|
|
exec bash "$0" "$@"
|
|
fi
|
|
|
|
set -euo pipefail
|
|
|
|
SERVER=${K3S_SERVER:-"https://myrddin.prole.org:6443"}
|
|
REMOTE_HOST=${K3S_REMOTE_HOST:-"myrddin.prole.org"}
|
|
REMOTE_USER=${K3S_REMOTE_USER:-"ansible"}
|
|
SSH_KEY=${K3S_SSH_KEY:-"$HOME/.ssh/id_ed25519_ansible"}
|
|
REMOTE_KUBECONFIG=${K3S_REMOTE_KUBECONFIG:-"/etc/rancher/k3s/k3s.yaml"}
|
|
|
|
CLUSTER="prole-k3s"
|
|
USER="prole-k3s"
|
|
CONTEXT="prole-k3s"
|
|
|
|
echo "Configuring ${CONTEXT} from ${REMOTE_HOST}..."
|
|
|
|
if ! command -v kubectl >/dev/null 2>&1; then
|
|
echo "[error] kubectl not found in PATH" >&2
|
|
exit 1
|
|
fi
|
|
|
|
TMP_REMOTE=$(mktemp)
|
|
TMP_CERT=$(mktemp)
|
|
TMP_KEY=$(mktemp)
|
|
|
|
# Fetch kubeconfig from the control-plane node (requires ssh access).
|
|
if ! ssh -i "${SSH_KEY}" "${REMOTE_USER}@${REMOTE_HOST}" sudo cat "${REMOTE_KUBECONFIG}" >"${TMP_REMOTE}"; then
|
|
echo "[error] unable to fetch kubeconfig from ${REMOTE_HOST}" >&2
|
|
rm -f "${TMP_REMOTE}" "${TMP_CERT}" "${TMP_KEY}"
|
|
exit 1
|
|
fi
|
|
|
|
# Extract client cert/key data from the remote kubeconfig into temp files.
|
|
python - "$TMP_REMOTE" "$TMP_CERT" "$TMP_KEY" <<'PY'
|
|
import sys, base64, yaml
|
|
src, cert_path, key_path = sys.argv[1:]
|
|
cfg = yaml.safe_load(open(src))
|
|
user = cfg['users'][0]['user']
|
|
base64.b64decode(user['client-certificate-data'], validate=True, altchars=None)
|
|
base64.b64decode(user['client-key-data'], validate=True, altchars=None)
|
|
open(cert_path, 'wb').write(base64.b64decode(user['client-certificate-data']))
|
|
open(key_path, 'wb').write(base64.b64decode(user['client-key-data']))
|
|
PY
|
|
|
|
# Configure cluster entry (skip CA because the server CA is malformed).
|
|
kubectl config set-cluster "${CLUSTER}" \
|
|
--server="${SERVER}" \
|
|
--insecure-skip-tls-verify=true >/dev/null
|
|
kubectl config unset "clusters.${CLUSTER}.certificate-authority" >/dev/null 2>&1 || true
|
|
kubectl config unset "clusters.${CLUSTER}.certificate-authority-data" >/dev/null 2>&1 || true
|
|
|
|
kubectl config set-credentials "${USER}" \
|
|
--client-certificate="${TMP_CERT}" \
|
|
--client-key="${TMP_KEY}" \
|
|
--embed-certs=true >/dev/null
|
|
|
|
kubectl config set-context "${CONTEXT}" \
|
|
--cluster="${CLUSTER}" \
|
|
--user="${USER}" \
|
|
--namespace=default >/dev/null
|
|
|
|
kubectl config use-context "${CONTEXT}" >/dev/null
|
|
|
|
rm -f "${TMP_REMOTE}" "${TMP_CERT}" "${TMP_KEY}"
|
|
|
|
echo "Done. Context ${CONTEXT} is ready."
|
|
kubectl --context "${CONTEXT}" auth whoami
|