provisioning-catalog/components/cv/cluster/cv-lib.sh

#!/bin/bash
# Methods library for cv — sourced by generated run-*.sh scripts.
# SCRIPT_DIR must be set before sourcing.

_kubectl() {
  if command -v kubectl >/dev/null 2>&1; then
    command kubectl "$@"
  elif command -v k0s >/dev/null 2>&1; then
    k0s kubectl "$@"
  else
    echo "ERROR: no kubectl or k0s binary found" >&2; exit 127
  fi
}

_wait_for_pod() {
  local timeout="${1:-300}"
  _kubectl wait pod \
    --namespace "$CV_NAMESPACE" \
    --selector "app.kubernetes.io/name=${CV_NAME}" \
    --for=condition=Ready \
    --timeout="${timeout}s"
}

# ── Manifest plan helpers ─────────────────────────────────────────────────────

_plan_apply() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] ${file}.yaml not in manifests/"; return 0; }
  _kubectl apply -f "$path"
}

_plan_apply_skip() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] ${file}.yaml not in manifests/"; return 0; }
  if _kubectl get -f "$path" >/dev/null 2>&1; then
    echo "  [skip] ${file} already exists in cluster"
    return 0
  fi
  _kubectl apply -f "$path"
}

_plan_rollout_restart() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] ${file}.yaml not in manifests/"; return 0; }
  _kubectl rollout restart -f "$path"
}

_plan_delete() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] ${file}.yaml not in manifests/"; return 0; }
  _kubectl delete -f "$path" --ignore-not-found
}

# shellcheck source=lib/gateway-tls.sh
source "${SCRIPT_DIR}/lib/gateway-tls.sh"

# ── Component methods ─────────────────────────────────────────────────────────

# Creates the config ConfigMap by rendering config.yaml.tmpl with CV_JWT_KEY and CV_MAIL_PSWD.
# Only the two secret fields are injected at deploy time; the rest of the config lives in the template.
_method_create-config() {
  local jwt_key="${CV_JWT_KEY:-}"
  local mail_pswd="${CV_MAIL_PSWD:-}"
  if [ -z "$jwt_key" ]; then
    echo "ERROR: CV_JWT_KEY is not set" >&2; exit 1
  fi
  if [ -z "$mail_pswd" ]; then
    echo "ERROR: CV_MAIL_PSWD is not set" >&2; exit 1
  fi

  local tpl="${SCRIPT_DIR}/config.yaml.tmpl"
  if [ ! -f "$tpl" ]; then
    echo "ERROR: config template not found: ${tpl}" >&2; exit 1
  fi

  local cm_name="${CV_NAME}-config"
  local filename="${CV_CONFIG_FILENAME:-config.yaml}"
  local config_content
  config_content=$(CV_JWT_KEY="$jwt_key" CV_MAIL_PSWD="$mail_pswd" \
    envsubst '${CV_JWT_KEY}${CV_MAIL_PSWD}' < "$tpl")

  _kubectl create configmap "$cm_name" \
    --namespace "$CV_NAMESPACE" \
    --from-literal="${filename}=${config_content}" \
    --dry-run=client -o yaml | _kubectl apply -f -
  echo "  [ok] config ConfigMap '${cm_name}' in ${CV_NAMESPACE}"
}

_method_delete-config() {
  local cm_name="${CV_NAME}-config"
  _kubectl delete configmap "$cm_name" \
    --namespace "$CV_NAMESPACE" \
    --ignore-not-found
  echo "  [ok] config ConfigMap '${cm_name}' deleted"
}

_method_wait-ready() {
  _wait_for_pod 300
}

_method_protect-volume() {
  local pvc="${CV_PVC_NAME:-cv-home}"

  echo "  waiting for PVC '${pvc}' to bind..."
  _kubectl wait pvc "$pvc" \
    --namespace "$CV_NAMESPACE" \
    --for=jsonpath='{.status.phase}'=Bound \
    --timeout=120s

  local pv_name
  pv_name=$(_kubectl get pvc "$pvc" \
    --namespace "$CV_NAMESPACE" \
    -o jsonpath='{.spec.volumeName}')
  if [ -z "$pv_name" ]; then
    echo "  [warn] could not resolve PV name for PVC '${pvc}' — skipping volume protection"
    return 0
  fi

  if command -v hcloud >/dev/null 2>&1; then
    hcloud volume enable-protection "$pv_name" delete 2>/dev/null \
      && echo "  [ok] volume '${pv_name}' protected" \
      || echo "  [warn] hcloud protect failed — run manually: hcloud volume enable-protection ${pv_name} delete"
  else
    echo "  [warn] hcloud CLI not found — skip volume protection for '${pv_name}'"
  fi
}