205 lines
8.4 KiB
Bash
Executable file
205 lines
8.4 KiB
Bash
Executable file
#!/bin/bash
|
|
# Methods library for buildkit_lite — sourced by run-*.sh scripts generated from manifest_plan.
|
|
# SCRIPT_DIR must be set by the caller before sourcing.
|
|
|
|
[ -f "${SCRIPT_DIR}/env-buildkit_lite" ] && source "${SCRIPT_DIR}/env-buildkit_lite"
|
|
[ -f "${SCRIPT_DIR}/_credentials.env" ] && source "${SCRIPT_DIR}/_credentials.env"
|
|
|
|
BUILDKIT_NAMESPACE="${BUILDKIT_NAMESPACE:-build-system}"
|
|
BUILDKIT_DEPLOYMENT="${BUILDKIT_DEPLOYMENT:-buildkitd}"
|
|
BUILDKIT_REGISTRY_SECRET="${BUILDKIT_REGISTRY_SECRET:-zot-credentials}"
|
|
|
|
_kubectl() {
|
|
if command -v kubectl >/dev/null 2>&1; then
|
|
command kubectl "$@"
|
|
elif command -v k0s >/dev/null 2>&1; then
|
|
k0s kubectl "$@"
|
|
else
|
|
echo "ERROR: no kubectl or k0s binary found" >&2; exit 127
|
|
fi
|
|
}
|
|
|
|
# ── Manifest plan helpers ─────────────────────────────────────────────────────
|
|
|
|
# Treat blank/whitespace-only manifests as no-ops — used by conditional templates
|
|
# (e.g. service-vpn.yaml renders empty when vpn_service.enabled = false).
|
|
_manifest_is_blank() {
|
|
local path="$1"
|
|
[ -f "$path" ] || return 0
|
|
! grep -q '[^[:space:]]' "$path"
|
|
}
|
|
|
|
_plan_apply() {
|
|
local file="$1"
|
|
local path="$SCRIPT_DIR/manifests/${file}.yaml"
|
|
[ -f "$path" ] || { echo " [skip] $file.yaml not in manifests/"; return 0; }
|
|
if _manifest_is_blank "$path"; then
|
|
echo " [skip] $file.yaml is empty (template inactive)"
|
|
return 0
|
|
fi
|
|
_kubectl apply -f "$path"
|
|
}
|
|
|
|
_plan_apply_skip() {
|
|
local file="$1"
|
|
local path="$SCRIPT_DIR/manifests/${file}.yaml"
|
|
[ -f "$path" ] || { echo " [skip] $file.yaml not in manifests/"; return 0; }
|
|
if _manifest_is_blank "$path"; then
|
|
echo " [skip] $file.yaml is empty (template inactive)"
|
|
return 0
|
|
fi
|
|
if _kubectl get -f "$path" >/dev/null 2>&1; then
|
|
echo " [skip] $file already exists in cluster"
|
|
return 0
|
|
fi
|
|
_kubectl apply -f "$path"
|
|
}
|
|
|
|
_plan_rollout_restart() {
|
|
local file="$1"
|
|
local path="$SCRIPT_DIR/manifests/${file}.yaml"
|
|
[ -f "$path" ] || { echo " [skip] $file.yaml not in manifests/"; return 0; }
|
|
if _manifest_is_blank "$path"; then
|
|
echo " [skip] $file.yaml is empty (template inactive)"
|
|
return 0
|
|
fi
|
|
_kubectl rollout restart -f "$path"
|
|
}
|
|
|
|
_plan_delete() {
|
|
local file="$1"
|
|
local path="$SCRIPT_DIR/manifests/${file}.yaml"
|
|
[ -f "$path" ] || { echo " [skip] $file.yaml not in manifests/"; return 0; }
|
|
if _manifest_is_blank "$path"; then
|
|
echo " [skip] $file.yaml is empty (template inactive)"
|
|
return 0
|
|
fi
|
|
_kubectl delete -f "$path" --ignore-not-found
|
|
}
|
|
|
|
# ── Component methods ─────────────────────────────────────────────────────────
|
|
|
|
_method_create-credentials() {
|
|
if _kubectl get secret "$BUILDKIT_REGISTRY_SECRET" \
|
|
--namespace "$BUILDKIT_NAMESPACE" >/dev/null 2>&1; then
|
|
echo " [skip] secret $BUILDKIT_REGISTRY_SECRET already in $BUILDKIT_NAMESPACE"
|
|
return 0
|
|
fi
|
|
# Prefer credentials injected from SOPS at deploy time (REGISTRY_HOST/USER/PASS).
|
|
if [ -n "${REGISTRY_USER:-}" ] && [ -n "${REGISTRY_PASS:-}" ]; then
|
|
local host="${REGISTRY_HOST:-daoreg.librecloud.online}"
|
|
local auth
|
|
auth=$(printf '%s:%s' "$REGISTRY_USER" "$REGISTRY_PASS" | base64 | tr -d '\n')
|
|
local config
|
|
config=$(printf '{"auths":{"%s":{"auth":"%s"}}}' "$host" "$auth")
|
|
_kubectl create secret generic "$BUILDKIT_REGISTRY_SECRET" \
|
|
--namespace "$BUILDKIT_NAMESPACE" \
|
|
--from-literal=config.json="$config" \
|
|
--dry-run=client -o yaml | _kubectl apply -f -
|
|
echo " Created $BUILDKIT_REGISTRY_SECRET in $BUILDKIT_NAMESPACE from injected credentials"
|
|
return 0
|
|
fi
|
|
# Fallback: copy pre-existing docker config secret from registry namespace.
|
|
if _kubectl get secret "$BUILDKIT_REGISTRY_SECRET" \
|
|
--namespace registry >/dev/null 2>&1; then
|
|
_kubectl get secret "$BUILDKIT_REGISTRY_SECRET" \
|
|
--namespace registry -o yaml \
|
|
| sed "s/namespace: registry/namespace: $BUILDKIT_NAMESPACE/" \
|
|
| _kubectl apply -f -
|
|
echo " Copied $BUILDKIT_REGISTRY_SECRET from registry → $BUILDKIT_NAMESPACE"
|
|
return 0
|
|
fi
|
|
echo " WARNING: no registry credentials available — buildkitd will have no registry auth" >&2
|
|
}
|
|
|
|
_method_wait-ready() {
|
|
local timeout="${1:-120}"
|
|
_kubectl rollout status deployment/"$BUILDKIT_DEPLOYMENT" \
|
|
--namespace "$BUILDKIT_NAMESPACE" \
|
|
--timeout="${timeout}s"
|
|
}
|
|
|
|
# ── mTLS client-cert minting (cert-manager-driven) ────────────────────────────
|
|
#
|
|
# Source of truth: runtime-manifests/mtls-client-certificate.yaml.tmpl
|
|
# This helper renders that template with envsubst → kubectl apply.
|
|
# The resulting Certificate CR persists in cluster etcd (cert-manager rotates it
|
|
# automatically); subsequent issue calls for the same name are idempotent.
|
|
#
|
|
# Preferred path for known consumers: declare a Certificate manifest in the
|
|
# consumer's own catalog (e.g. lian_build/cluster/manifests/buildkit-client-cert.yaml.j2).
|
|
# This helper is for ad-hoc operator clients (humans, debug sessions) — the
|
|
# Certificate it creates still survives redeploys because it lives in etcd.
|
|
|
|
_method_issue-client-cert() {
|
|
local client_name="${1:?client name required}"
|
|
local output_dir="${2:-./client-${client_name}}"
|
|
local duration="${3:-${BUILDKIT_CLIENT_DURATION:-2160h}}"
|
|
local renew="${4:-${BUILDKIT_CLIENT_RENEW:-360h}}"
|
|
local ca_issuer_name="${BUILDKIT_MTLS_CA_ISSUER:-buildkit-ca-issuer}"
|
|
local secret_name="buildkit-client-${client_name}-tls"
|
|
local tmpl="${SCRIPT_DIR}/runtime-manifests/mtls-client-certificate.yaml.tmpl"
|
|
|
|
if [ ! -f "$tmpl" ]; then
|
|
echo "ERROR: client cert template missing: $tmpl" >&2
|
|
return 1
|
|
fi
|
|
if ! _kubectl get issuer "$ca_issuer_name" --namespace "$BUILDKIT_NAMESPACE" >/dev/null 2>&1; then
|
|
echo "ERROR: Issuer $ca_issuer_name not found in $BUILDKIT_NAMESPACE — enable mtls.cert_manager first" >&2
|
|
return 1
|
|
fi
|
|
|
|
BUILDKIT_CLIENT_NAME="$client_name" \
|
|
BUILDKIT_NAMESPACE="$BUILDKIT_NAMESPACE" \
|
|
BUILDKIT_MTLS_CA_ISSUER="$ca_issuer_name" \
|
|
BUILDKIT_CLIENT_DURATION="$duration" \
|
|
BUILDKIT_CLIENT_RENEW="$renew" \
|
|
envsubst < "$tmpl" | _kubectl apply -f -
|
|
|
|
_method_export-client-cert "$client_name" "$output_dir"
|
|
}
|
|
|
|
# Reads an existing buildkit-client-<name>-tls secret and dumps the contents
|
|
# (ca.crt, tls.crt, tls.key) to $output_dir for buildctl consumption.
|
|
# Waits up to 60s for cert-manager to populate the secret on first call.
|
|
_method_export-client-cert() {
|
|
local client_name="${1:?client name required}"
|
|
local output_dir="${2:-./client-${client_name}}"
|
|
local secret_name="buildkit-client-${client_name}-tls"
|
|
mkdir -p "$output_dir"
|
|
|
|
local attempts=30
|
|
while [ "$attempts" -gt 0 ]; do
|
|
if _kubectl get secret "$secret_name" --namespace "$BUILDKIT_NAMESPACE" >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 2
|
|
attempts=$((attempts - 1))
|
|
done
|
|
if [ "$attempts" -eq 0 ]; then
|
|
echo "ERROR: secret $secret_name not found in $BUILDKIT_NAMESPACE — issue the Certificate first" >&2
|
|
return 1
|
|
fi
|
|
|
|
_kubectl get secret "$secret_name" --namespace "$BUILDKIT_NAMESPACE" \
|
|
-o jsonpath='{.data.ca\.crt}' | base64 -d > "$output_dir/ca.crt"
|
|
_kubectl get secret "$secret_name" --namespace "$BUILDKIT_NAMESPACE" \
|
|
-o jsonpath='{.data.tls\.crt}' | base64 -d > "$output_dir/tls.crt"
|
|
_kubectl get secret "$secret_name" --namespace "$BUILDKIT_NAMESPACE" \
|
|
-o jsonpath='{.data.tls\.key}' | base64 -d > "$output_dir/tls.key"
|
|
chmod 0600 "$output_dir/tls.key"
|
|
echo " Client cert for '${client_name}' exported to $output_dir"
|
|
echo " Use with: buildctl --tlscacert=$output_dir/ca.crt --tlscert=$output_dir/tls.crt --tlskey=$output_dir/tls.key --addr tcp://build.librecloud.online:31234 ..."
|
|
}
|
|
|
|
# Deletes the Certificate CR (and its Secret). For Certificates declared in
|
|
# a consumer's catalog (e.g. lian_build), prefer removing the manifest from the
|
|
# catalog and re-running the consumer's install — this is for ad-hoc clients only.
|
|
_method_revoke-client-cert() {
|
|
local client_name="${1:?client name required}"
|
|
local cert_name="buildkit-client-${client_name}"
|
|
local secret_name="${cert_name}-tls"
|
|
_kubectl delete certificate "$cert_name" --namespace "$BUILDKIT_NAMESPACE" --ignore-not-found
|
|
_kubectl delete secret "$secret_name" --namespace "$BUILDKIT_NAMESPACE" --ignore-not-found
|
|
echo " Revoked client cert for '${client_name}'"
|
|
}
|