50 lines
2.1 KiB
Text
50 lines
2.1 KiB
Text
|
#!/usr/bin/env nu
|
||
|
|
def main [
|
||
|
|
--workspace: string = ""
|
||
|
|
--key-type: string = ""
|
||
|
|
--dry-run
|
||
|
|
]: nothing -> nothing {
|
||
|
|
let ws = if ($workspace | is-not-empty) { $workspace } else { $env.PLAYBOOK_PARAM_WORKSPACE? | default "" }
|
||
|
|
let ktype = if ($key_type | is-not-empty) { $key_type } else { $env.PLAYBOOK_PARAM_KEY_TYPE? | default "" }
|
||
|
|
|
||
|
|
if ($ws | is-empty) { error make { msg: "workspace is required" } }
|
||
|
|
|
||
|
|
if $dry_run {
|
||
|
|
print $"[dry-run] would verify ($ktype) signing continuity for workspace ($ws)"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
match $ktype {
|
||
|
|
"ops-controller" => {
|
||
|
|
let rollout_r = do { ^kubectl rollout status deployment/ops-controller --namespace "ops-system" --timeout=120s } | complete
|
||
|
|
if $rollout_r.exit_code != 0 {
|
||
|
|
print $"WARNING: ops-controller rollout not stable: ($rollout_r.stderr | str trim)"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
print "ops-controller rollout stable"
|
||
|
|
|
||
|
|
let stream = $"OPS_PENDING_(($ws | str upcase))"
|
||
|
|
let nats_r = do { ^nats stream info $stream --json } | complete
|
||
|
|
if $nats_r.exit_code != 0 {
|
||
|
|
print "WARNING: cannot verify NATS stream connectivity after key rotation"
|
||
|
|
} else {
|
||
|
|
let depth = $nats_r.stdout | from json | get state.messages
|
||
|
|
print $"NATS stream ($stream) reachable — pending ops: ($depth)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"keeper" => {
|
||
|
|
let health_r = do { ^ssh $"($env.PLAYBOOK_PARAM_OPS_VM_HOST? | default "ops-vm")" "curl -sf http://127.0.0.1:9081/health" } | complete
|
||
|
|
if $health_r.exit_code != 0 {
|
||
|
|
print "WARNING: keeper health endpoint not responding after key rotation"
|
||
|
|
} else {
|
||
|
|
print "keeper health: OK"
|
||
|
|
print $health_r.stdout
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"operator" => {
|
||
|
|
print "operator key rotation continuity: verified at sign_delegation_patch step (quorum threshold maintained)"
|
||
|
|
}
|
||
|
|
_ => { print $"WARNING: no continuity check defined for key-type ($ktype)" }
|
||
|
|
}
|
||
|
|
}
|