184 lines
8.2 KiB
Text
Executable file
184 lines
8.2 KiB
Text
Executable file
#!/usr/bin/env nu
|
|
# Info: Prepare for kubernetes default installation
|
|
# Author: JesusPerezLorenzo
|
|
# Release: 1.0.2
|
|
# Date: 30-12-2023
|
|
|
|
use lib_provisioning/cmd/env.nu *
|
|
use lib_provisioning/cmd/lib.nu *
|
|
|
|
use lib_provisioning/utils/ui.nu *
|
|
|
|
print $"(_ansi green_bold)OS(_ansi reset) with ($env.PROVISIONING_VARS) "
|
|
|
|
let defs = load_defs
|
|
|
|
if $env.PROVISIONING_RESOURCES == null {
|
|
print $"🛑 PROVISIONING_RESOURCES not found"
|
|
exit 1
|
|
}
|
|
let resources_path = $env.PROVISIONING_RESOURCES
|
|
if not ($resources_path | path exists) { ^mkdir -p $resources_path }
|
|
|
|
#let WORK_PATH = ${WORK_PATH:-/tmp}
|
|
#[ ! -d "$WORK_PATH" ] && mkdir -p "$WORK_PATH"
|
|
#export LC_CTYPE=C.UTF-8
|
|
#export LANG=C.UTF-8
|
|
|
|
export def copy_certs [
|
|
run_root: string
|
|
] {
|
|
let provision_path = ($defs.taskserv.prov_etcd_path | default "" | str replace "~" $env.HOME)
|
|
if $provision_path == "" {
|
|
print $"🛑 prov_path not found taskserv definition"
|
|
return false
|
|
}
|
|
let src = if ($defs.taskserv.prov_etcd_path | str starts-with "/" ) {
|
|
$defs.taskserv.prov_etcd_path
|
|
} else if ($defs.taskserv.prov_etcd_path | str starts-with "resources/" ) {
|
|
($env.PROVISIONING_SETTINGS_SRC_PATH | path join $defs.taskserv.prov_etcd_path)
|
|
} else {
|
|
($env.PROVISIONING_SETTINGS_SRC_PATH | path join "resources" | path join $defs.taskserv.prov_etcd_path)
|
|
}
|
|
|
|
# Auto-fetch certs from running etcd nodes when the local etcdcerts/ dir is empty.
|
|
# Derives workspace root and infra name from PROVISIONING_SETTINGS_SRC_PATH —
|
|
# no dependency on /etc/hosts or SSH config.
|
|
if not ($src | path join "ca.crt" | path exists) {
|
|
print $"⚠ ($src)/ca.crt not found — fetching etcd certs from nodes..."
|
|
let infra_path = $env.PROVISIONING_SETTINGS_SRC_PATH
|
|
let workspace_root = ($infra_path | path dirname | path dirname)
|
|
let infra_name = ($infra_path | path basename)
|
|
let fetch_script = ($workspace_root | path join "scripts" "fetch-etcd-certs.nu")
|
|
if not ($fetch_script | path exists) {
|
|
print $"🛑 fetch-etcd-certs.nu not found at ($fetch_script)"
|
|
return false
|
|
}
|
|
let res = (do { ^nu $fetch_script $infra_name } | complete)
|
|
if $res.exit_code != 0 {
|
|
print $"🛑 fetch-etcd-certs failed:\n($res.stderr)"
|
|
return false
|
|
}
|
|
print $res.stdout
|
|
if not ($src | path join "ca.crt" | path exists) {
|
|
print $"🛑 ca.crt still missing after fetch — aborting"
|
|
return false
|
|
}
|
|
}
|
|
let etcd_certs_path = ($defs.taskserv.etcd_certs_path | default "" | str replace "~" $env.HOME)
|
|
if $etcd_certs_path == "" { print "Error etcd_certs_path not found" ; exit 1 }
|
|
if not ($run_root | path join $etcd_certs_path | path exists) { ^mkdir -p ($run_root | path join $etcd_certs_path) }
|
|
let etcd_cluster_name = ($defs.taskserv.etcd_cluster_name | default "")
|
|
if $etcd_cluster_name == "" {
|
|
print $"🛑 etcd_cluster_name not found in taskserv definition"
|
|
return false
|
|
}
|
|
let raw_etcd_peer = ($defs.taskserv.etcd_peers | default "")
|
|
let etcd_peer = if $raw_etcd_peer == "" or $raw_etcd_peer == "$hostname" {
|
|
$defs.server.hostname
|
|
} else {
|
|
$raw_etcd_peer
|
|
}
|
|
for name in [ca $etcd_peer $etcd_cluster_name] {
|
|
if not ($src | path join $"($name).key" | path exists) { continue }
|
|
open ($src | path join $"($name).key") -r | from json |
|
|
if (sops_cmd "is_sops" ($src | path join $"($name).key")) {
|
|
let content = (sops_cmd "decrypt" ($src | path join $"($name).key") --error_exit)
|
|
if $content != "" { $content | save -f ($run_root | path join $etcd_certs_path | path join $"($name).key") }
|
|
} else {
|
|
cp ($src | path join $"($name).key") ($run_root | path join $etcd_certs_path | path join $"($name).key" )
|
|
}
|
|
}
|
|
if ($run_root | path join $etcd_certs_path | path join $"($etcd_peer).key" | path exists ) {
|
|
(cp ($run_root | path join $etcd_certs_path | path join $"($etcd_peer).key")
|
|
($run_root | path join $etcd_certs_path | path join "server.key"))
|
|
(mv ($run_root | path join $etcd_certs_path | path join $"($etcd_peer).key")
|
|
($run_root | path join $etcd_certs_path | path join "peer.key"))
|
|
}
|
|
if ($src | path join "ca.crt" | path exists) {
|
|
cp ($src | path join "ca.crt") ($run_root | path join $etcd_certs_path | path join "ca.crt")
|
|
}
|
|
if ($src | path join $"($etcd_peer).crt" | path exists) {
|
|
cp ($src | path join $"($etcd_peer).crt") ($run_root | path join $etcd_certs_path | path join "server.crt")
|
|
cp ($src | path join $"($etcd_peer).crt") ($run_root | path join $etcd_certs_path | path join "peer.crt")
|
|
}
|
|
if ($run_root | path join $etcd_certs_path | path join $"($etcd_cluster_name).key" | path exists) {
|
|
( mv ($run_root | path join $etcd_certs_path | path join $"($etcd_cluster_name).key")
|
|
($run_root | path join $etcd_certs_path | path join "healthcheck-client.key"))
|
|
}
|
|
if ($src | path join $"($etcd_cluster_name).crt" | path exists) {
|
|
( cp ($src | path join $"($etcd_cluster_name).crt")
|
|
($run_root | path join $etcd_certs_path | path join "healthcheck-client.crt"))
|
|
}
|
|
print $"ETCD Certs copied from ($src) to ($run_root | path join $etcd_certs_path)"
|
|
true
|
|
}
|
|
|
|
def fetch_join_command [cp_host: string, cp_ip: string, run_root: string]: nothing -> bool {
|
|
let ssh_key = ($env.PROVISIONING_SSH_KEY? | default "~/.ssh/htz_ops" | str replace "~" $env.HOME)
|
|
let ssh_opts = if ($ssh_key | path exists) {
|
|
["-o" "StrictHostKeyChecking=accept-new" "-o" "ConnectTimeout=10" "-i" $ssh_key]
|
|
} else {
|
|
["-o" "StrictHostKeyChecking=accept-new" "-o" "ConnectTimeout=10"]
|
|
}
|
|
let cache_path = ($env.HOME | path join ".cache" "provisioning" $"k8s-join-($cp_host).sh")
|
|
let cache_valid = if ($cache_path | path exists) {
|
|
let age_sec = ((date now) - (ls $cache_path | get 0.modified)) / 1sec
|
|
$age_sec < 3600
|
|
} else { false }
|
|
let raw_join = if $cache_valid {
|
|
print "✓ prepare: using cached join command (< 1h old)"
|
|
open --raw $cache_path
|
|
} else {
|
|
let script = "export PATH=/usr/local/bin:/usr/bin:/bin
|
|
if command -v kubeadm >/dev/null 2>&1; then
|
|
kubeadm token create --print-join-command 2>/dev/null
|
|
else
|
|
echo 'ERROR: kubeadm not found' >&2; exit 1
|
|
fi"
|
|
let res = (do -i { $script | ^ssh ...$ssh_opts $"root@($cp_host)" "bash -s" } | complete)
|
|
if $res.exit_code != 0 or ($res.stdout | str trim | is-empty) {
|
|
print $"🛑 prepare: failed to get join command from CP ($cp_host): ($res.stderr)"
|
|
exit 1
|
|
}
|
|
let out = ($res.stdout | str trim)
|
|
^mkdir -p ($cache_path | path dirname)
|
|
$out | save -f $cache_path
|
|
$out
|
|
}
|
|
let join_cmd = if ($cp_ip | is-not-empty) {
|
|
$raw_join | str replace "127.0.0.1" $cp_ip
|
|
} else { $raw_join }
|
|
#print $"join_cmd = ($join_cmd) "
|
|
#$"#!/usr/bin/env bash\n($join_cmd) --ignore-preflight-errors=all\n" | save -f ($run_root | path join "k8s_join.sh")
|
|
$"($join_cmd) --ignore-preflight-errors=all\n" | save -f ($run_root | path join "k8s_join.sh")
|
|
^chmod +x ($run_root | path join "k8s_join.sh")
|
|
print $"✓ prepare: k8s_join.sh ready CP=($cp_host), endpoint=($cp_ip):6443"
|
|
true
|
|
}
|
|
|
|
def main [] {
|
|
let run_root = $env.PROVISIONING_WK_ENV_PATH
|
|
let TEMPLATES_PATH = ($run_root | path join "templates")
|
|
let server_hostname = ($defs.server.hostname | default "")
|
|
let cp_name = ($defs.taskserv.cp_name | default "")
|
|
let cp_ip = ($defs.taskserv.cp_ip? | default "" | str trim)
|
|
let is_worker = ($cp_name | is-not-empty) and ($server_hostname != $cp_name)
|
|
let K8S_TPL = ($defs.taskserv.tpl | default "" | str replace ".j2" "")
|
|
let K8S_CONFIG = ($K8S_TPL | str replace ".j2" "")
|
|
if not $is_worker and ($K8S_TPL | is-not-empty) {
|
|
if not ($run_root | path join "resources" | path exists) { ^mkdir -p ($run_root | path join "resources") }
|
|
if ($TEMPLATES_PATH | path join $K8S_TPL | path exists) {
|
|
cp ($TEMPLATES_PATH | path join $K8S_TPL) ($run_root | path join "resources" | path join $K8S_CONFIG)
|
|
} else if ($TEMPLATES_PATH | path join $"($K8S_TPL).j2" | path exists) {
|
|
cp ($TEMPLATES_PATH | path join $"($K8S_TPL).j2") ($run_root | path join "resources" | path join $"($K8S_CONFIG).j2")
|
|
}
|
|
}
|
|
let res = if not $is_worker and $defs.taskserv.etcd_mode == "external" {
|
|
copy_certs $run_root
|
|
} else if $is_worker {
|
|
fetch_join_command $cp_name $cp_ip $run_root
|
|
} else { true }
|
|
rm -rf ($run_root | path join "templates")
|
|
$res
|
|
}
|