483 lines
19 KiB
Bash
Executable File
483 lines
19 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -o errexit
|
|
set -o pipefail
|
|
|
|
# shellcheck disable=SC2155
|
|
export PROJECT_DIR=$(git rev-parse --show-toplevel)
|
|
|
|
# shellcheck disable=SC2155
|
|
export SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt
|
|
|
|
# shellcheck disable=SC1091
|
|
source "${PROJECT_DIR}/.config.env"
|
|
|
|
show_help() {
|
|
cat << EOF
|
|
Usage: $(basename "$0") <options>
|
|
-h, --help Display help
|
|
--verify Verify .config.env settings
|
|
EOF
|
|
}
|
|
|
|
main() {
|
|
local verify=
|
|
parse_command_line "$@"
|
|
if [[ "${verify}" == 1 ]]; then
|
|
verify_start
|
|
verify_binaries
|
|
verify_master_count
|
|
verify_ansible_hosts
|
|
verify_lbs
|
|
verify_kubevip
|
|
verify_cluster_service_cidrs
|
|
verify_age
|
|
verify_git_repository
|
|
verify_cloudflare
|
|
verify_success
|
|
else
|
|
# generate sops configuration file
|
|
envsubst < "${PROJECT_DIR}/tmpl/.sops.yaml" \
|
|
> "${PROJECT_DIR}/.sops.yaml"
|
|
# generate cluster settings
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster-settings.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/flux/vars/cluster-settings.yaml"
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/flux/config/cluster.yaml"
|
|
# generate secrets
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cluster-secrets.sops.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml"
|
|
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml"
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cert-manager-secret.sops.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml"
|
|
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml"
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cloudflared-secret.sops.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/apps/networking/cloudflared/app/secret.sops.yaml"
|
|
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/cloudflared/app/secret.sops.yaml"
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/external-dns-secret.sops.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
|
|
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
|
|
# generate ansible settings
|
|
envsubst < "${PROJECT_DIR}/tmpl/ansible/supplemental.yml" \
|
|
> "${PROJECT_DIR}/ansible/inventory/group_vars/kubernetes/supplemental.yml"
|
|
# generate ansible hosts file and secrets
|
|
generate_ansible_hosts
|
|
generate_ansible_host_secrets
|
|
setup_github_webhook
|
|
setup_weave_gitops
|
|
setup_grafana_admin
|
|
setup_prometheus_endpoints
|
|
success
|
|
fi
|
|
}
|
|
|
|
parse_command_line() {
|
|
while :; do
|
|
case "${1:-}" in
|
|
-h|--help)
|
|
show_help
|
|
exit
|
|
;;
|
|
--verify)
|
|
verify=1
|
|
;;
|
|
*)
|
|
break
|
|
;;
|
|
esac
|
|
|
|
shift
|
|
done
|
|
if [[ -z "$verify" ]]; then
|
|
verify=0
|
|
fi
|
|
}
|
|
|
|
_has_binary() {
|
|
command -v "${1}" >/dev/null 2>&1 || {
|
|
_log "ERROR(${FUNCNAME[0]})" "${1} is not installed or not found in \$PATH"
|
|
exit 1
|
|
}
|
|
_log "INFO(${FUNCNAME[0]})" "Found CLI tool ${1} and it is in \$PATH"
|
|
}
|
|
|
|
_has_optional_envar() {
|
|
local option="${1}"
|
|
# shellcheck disable=SC2015
|
|
[[ "${!option}" == "" ]] && {
|
|
_log "WARN" "Unset optional variable ${option}"
|
|
} || {
|
|
_log "INFO(${FUNCNAME[0]})" "Found variable '${option}' with value '${!option}'"
|
|
}
|
|
}
|
|
|
|
_has_envar() {
|
|
local option="${1}"
|
|
local secret="${2:-false}"
|
|
local value=
|
|
# shellcheck disable=SC2015
|
|
if [[ "${!option}" == "" ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "Unset variable ${option}"
|
|
exit 1
|
|
fi
|
|
value="${!option}"
|
|
if [[ $secret == "true" ]]; then
|
|
value="***"
|
|
fi
|
|
_log "INFO(${FUNCNAME[0]})" "Found variable '${option}' with value '${value}'"
|
|
}
|
|
|
|
_has_valid_ip() {
|
|
local ip="${1}"
|
|
local variable_name="${2}"
|
|
if ! ipcalc "${ip}" | awk 'BEGIN{FS=":"; is_invalid=0} /^INVALID/ {is_invalid=1; print $1} END{exit is_invalid}' >/dev/null 2>&1; then
|
|
_log "INFO(${FUNCNAME[0]})" "Variable '${variable_name}' has an invalid IP address '${ip}'"
|
|
exit 1
|
|
else
|
|
_log "INFO(${FUNCNAME[0]})" "Variable '${variable_name}' has a valid IP address '${ip}'"
|
|
fi
|
|
}
|
|
|
|
verify_age() {
|
|
_has_envar "BOOTSTRAP_AGE_PUBLIC_KEY"
|
|
_has_envar "SOPS_AGE_KEY_FILE"
|
|
if [[ ! "$BOOTSTRAP_AGE_PUBLIC_KEY" =~ ^age.* ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "BOOTSTRAP_AGE_PUBLIC_KEY does not start with age"
|
|
exit 1
|
|
else
|
|
_log "INFO(${FUNCNAME[0]})" "Age public key is in the correct format"
|
|
fi
|
|
if [[ ! -f ~/.config/sops/age/keys.txt ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "Unable to find Age file keys.txt in ~/.config/sops/age"
|
|
exit 1
|
|
else
|
|
_log "INFO(${FUNCNAME[0]})" "Found Age public key '${BOOTSTRAP_AGE_PUBLIC_KEY}'"
|
|
fi
|
|
}
|
|
|
|
verify_binaries() {
|
|
_has_binary "age"
|
|
_has_binary "ansible"
|
|
_has_binary "envsubst"
|
|
_has_binary "flux"
|
|
_has_binary "git"
|
|
_has_binary "gitops"
|
|
_has_binary "ipcalc"
|
|
_has_binary "jq"
|
|
_has_binary "pip3"
|
|
_has_binary "sops"
|
|
_has_binary "ssh"
|
|
_has_binary "task"
|
|
_has_binary "yq"
|
|
if ! [[ "$(sops --version)" =~ 3\.[0-9]+\.[0-9]+ ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "Incompatible sops version, make sure you are using the latest release of github.com/mozilla/sops"
|
|
exit 1
|
|
fi
|
|
if ! [[ "$(yq --version)" =~ 4\.[0-9]+\.[0-9]+ ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "Incompatible yq version, make sure you are using the latest release of github.com/mikefarah/yq"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
verify_kubevip() {
|
|
_has_envar "BOOTSTRAP_KUBE_VIP_ADDR"
|
|
_has_valid_ip "${BOOTSTRAP_KUBE_VIP_ADDR}" "BOOTSTRAP_KUBE_VIP_ADDR"
|
|
}
|
|
|
|
verify_lbs() {
|
|
#TODO: Validate IPs aren't already in use with arp
|
|
_has_envar "BOOTSTRAP_K8S_GATEWAY_ADDR"
|
|
_has_envar "BOOTSTRAP_INGRESS_NGINX_ADDR"
|
|
_has_valid_ip "${BOOTSTRAP_K8S_GATEWAY_ADDR}" "BOOTSTRAP_K8S_GATEWAY_ADDR"
|
|
_has_valid_ip "${BOOTSTRAP_INGRESS_NGINX_ADDR}" "BOOTSTRAP_INGRESS_NGINX_ADDR"
|
|
}
|
|
|
|
verify_cluster_service_cidrs() {
|
|
#TODO: Validate input is a CIDR range
|
|
_has_envar "BOOTSTRAP_CLUSTER_CIDR"
|
|
_has_envar "BOOTSTRAP_SERVICE_CIDR"
|
|
}
|
|
|
|
verify_git_repository() {
|
|
_has_envar "BOOTSTRAP_GIT_REPOSITORY"
|
|
export GIT_TERMINAL_PROMPT=0
|
|
pushd "$(mktemp -d)" >/dev/null 2>&1
|
|
[ "$(git ls-remote "${BOOTSTRAP_GIT_REPOSITORY}" 2> /dev/null)" ] || {
|
|
_log "ERROR(${FUNCNAME[0]})" "Unable to find the remote Git repository '${BOOTSTRAP_GIT_REPOSITORY}'"
|
|
exit 1
|
|
}
|
|
popd >/dev/null 2>&1
|
|
export GIT_TERMINAL_PROMPT=1
|
|
}
|
|
|
|
verify_master_count() {
|
|
local master_node_count=
|
|
master_node_count=0
|
|
for var in "${!BOOTSTRAP_ANSIBLE_HOST_ADDR_@}"; do
|
|
node_id=$(echo "${var}" | awk -F"_" '{print $5}')
|
|
node_control="BOOTSTRAP_ANSIBLE_CONTROL_NODE_${node_id}"
|
|
if [[ "${!node_control}" == "true" ]]; then
|
|
master_node_count=$((master_node_count+1))
|
|
fi
|
|
done
|
|
# Check for existance of master nodes and that their count is not an even number
|
|
if [[ ${master_node_count} -eq 0 || $((master_node_count%2)) -eq 0 ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "You must have 1, 3 or an odd number of master nodes >=3 inorder for etcd to have quorum"
|
|
exit 1
|
|
fi
|
|
_log "INFO(${FUNCNAME[0]})" "Verified control plane node count"
|
|
}
|
|
|
|
verify_cloudflare() {
|
|
local errors=
|
|
local account_zone=
|
|
_has_envar "BOOTSTRAP_CLOUDFLARE_APITOKEN" "true"
|
|
_has_envar "BOOTSTRAP_CLOUDFLARE_DOMAIN" "true"
|
|
_has_envar "BOOTSTRAP_ACME_EMAIL" "true"
|
|
# Try to retrieve zone information from Cloudflare's API
|
|
account_zone=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=${BOOTSTRAP_CLOUDFLARE_DOMAIN}&status=active" \
|
|
-H "Authorization: Bearer ${BOOTSTRAP_CLOUDFLARE_APITOKEN}" \
|
|
-H "Content-Type: application/json"
|
|
)
|
|
if [[ "$(echo "${account_zone}" | jq ".success")" == "true" ]]; then
|
|
_log "INFO(${FUNCNAME[0]})" "Verified Cloudflare Account and Zone information"
|
|
else
|
|
errors=$(echo "${account_zone}" | jq -c ".errors")
|
|
_log "ERROR(${FUNCNAME[0]})" "Unable to get Cloudflare Account and Zone information ${errors}"
|
|
exit 1
|
|
fi
|
|
local cloudflare_tunnel=
|
|
_has_envar "BOOTSTRAP_CLOUDFLARE_ACCOUNT_TAG" "true"
|
|
_has_envar "BOOTSTRAP_CLOUDFLARE_TUNNEL_SECRET" "true"
|
|
_has_envar "BOOTSTRAP_CLOUDFLARE_TUNNEL_ID" "true"
|
|
# Try to retrieve the Cloudflare Tunnel information from Cloudflare's API
|
|
cloudflare_tunnel=$(curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/${BOOTSTRAP_CLOUDFLARE_ACCOUNT_TAG}/cfd_tunnel/${BOOTSTRAP_CLOUDFLARE_TUNNEL_ID}" \
|
|
-H "Authorization: Bearer ${BOOTSTRAP_CLOUDFLARE_APITOKEN}" \
|
|
-H "Content-Type: application/json"
|
|
)
|
|
if [[ "$(echo "${cloudflare_tunnel}" | jq ".success")" == "true" ]]; then
|
|
_log "INFO(${FUNCNAME[0]})" "Verified Cloudflare Tunnel information"
|
|
else
|
|
errors=$(echo "${cloudflare_tunnel}" | jq -c ".errors")
|
|
_log "ERROR(${FUNCNAME[0]})" "Unable to get Cloudflare Tunnel information ${errors}"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
verify_ansible_hosts() {
|
|
local node_id=
|
|
local node_addr=
|
|
local node_username=
|
|
local node_password=
|
|
local node_control=
|
|
local node_hostname=
|
|
local default_control_node_prefix=
|
|
local default_worker_node_prefix=
|
|
default_control_node_prefix="BOOTSTRAP_ANSIBLE_DEFAULT_CONTROL_NODE_HOSTNAME_PREFIX"
|
|
default_worker_node_prefix="BOOTSTRAP_ANSIBLE_DEFAULT_NODE_HOSTNAME_PREFIX"
|
|
_has_optional_envar "${default_control_node_prefix}"
|
|
_has_optional_envar "${default_worker_node_prefix}"
|
|
for var in "${!BOOTSTRAP_ANSIBLE_HOST_ADDR_@}"; do
|
|
node_id=$(echo "${var}" | awk -F"_" '{print $5}')
|
|
node_addr="BOOTSTRAP_ANSIBLE_HOST_ADDR_${node_id}"
|
|
node_username="BOOTSTRAP_ANSIBLE_SSH_USERNAME_${node_id}"
|
|
node_password="BOOTSTRAP_ANSIBLE_SUDO_PASSWORD_${node_id}"
|
|
node_control="BOOTSTRAP_ANSIBLE_CONTROL_NODE_${node_id}"
|
|
node_hostname="BOOTSTRAP_ANSIBLE_HOSTNAME_${node_id}"
|
|
_has_envar "${node_addr}"
|
|
_has_envar "${node_username}"
|
|
_has_envar "${node_password}" "true"
|
|
_has_envar "${node_control}"
|
|
_has_optional_envar "${node_hostname}"
|
|
if [[ "${!node_addr}" == "${BOOTSTRAP_KUBE_VIP_ADDR}" ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "The kube-vip IP '${BOOTSTRAP_KUBE_VIP_ADDR}' should not be the same as the IP for node '${!node_addr}'"
|
|
exit 1
|
|
fi
|
|
if [[ "${!node_addr}" == "${BOOTSTRAP_K8S_GATEWAY_ADDR}" ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "The k8s-gateway load balancer IP '${BOOTSTRAP_K8S_GATEWAY_ADDR}' should not be the same as the IP for node '${!node_addr}'"
|
|
exit 1
|
|
fi
|
|
if [[ "${!node_addr}" == "${BOOTSTRAP_INGRESS_NGINX_ADDR}" ]]; then
|
|
_log "ERROR(${FUNCNAME[0]})" "The ingress load balancer IP '${BOOTSTRAP_INGRESS_NGINX_ADDR}' should not be the same as the IP for node '${!node_addr}'"
|
|
exit 1
|
|
fi
|
|
if ssh -q -o BatchMode=yes -o ConnectTimeout=5 "${!node_username}"@"${!var}" "true"; then
|
|
_log "INFO(${FUNCNAME[0]})" "SSH into host '${!var}' with username '${!node_username}' was successfull"
|
|
else
|
|
_log "ERROR(${FUNCNAME[0]})" "SSH into host '${!var}' with username '${!node_username}'was NOT successful, did you copy over your SSH key?"
|
|
exit 1
|
|
fi
|
|
done
|
|
}
|
|
|
|
verify_start() {
|
|
_log "INFO(${FUNCNAME[0]})" "Starting verification of .config.env, please wait..."
|
|
}
|
|
|
|
verify_success() {
|
|
_log "INFO(${FUNCNAME[0]})" "All checks passed!"
|
|
_log "INFO(${FUNCNAME[0]})" "Run the script without --verify to template all the files out"
|
|
exit 0
|
|
}
|
|
|
|
generate_ansible_host_secrets() {
|
|
local node_id=
|
|
local node_username=
|
|
local node_password=
|
|
local node_hostname=
|
|
local node_control=
|
|
default_control_node_prefix=${BOOTSTRAP_ANSIBLE_DEFAULT_CONTROL_NODE_HOSTNAME_PREFIX:-k8s-}
|
|
default_worker_node_prefix=${BOOTSTRAP_ANSIBLE_DEFAULT_NODE_HOSTNAME_PREFIX:-k8s-}
|
|
for var in "${!BOOTSTRAP_ANSIBLE_HOST_ADDR_@}"; do
|
|
node_id=$(echo "${var}" | awk -F"_" '{print $5}')
|
|
node_control="BOOTSTRAP_ANSIBLE_CONTROL_NODE_${node_id}"
|
|
if [[ "${!node_control}" == "true" ]]; then
|
|
node_hostname="BOOTSTRAP_ANSIBLE_HOSTNAME_${node_id}"
|
|
host_key="${!node_hostname:-${default_control_node_prefix}}"
|
|
if [ "${host_key}" == "${default_control_node_prefix}" ]; then
|
|
node_hostname=${default_control_node_prefix}${node_id}
|
|
else
|
|
node_hostname=${!node_hostname}
|
|
fi
|
|
else
|
|
node_hostname="BOOTSTRAP_ANSIBLE_HOSTNAME_${node_id}"
|
|
host_key="${!node_hostname:-${default_worker_node_prefix}}"
|
|
if [ "${host_key}" == "${default_worker_node_prefix}" ]; then
|
|
node_hostname=${default_worker_node_prefix}${node_id}
|
|
else
|
|
node_hostname=${!node_hostname}
|
|
fi
|
|
fi
|
|
{
|
|
node_username="BOOTSTRAP_ANSIBLE_SSH_USERNAME_${node_id}"
|
|
node_password="BOOTSTRAP_ANSIBLE_SUDO_PASSWORD_${node_id}"
|
|
printf "kind: Secret\n"
|
|
printf "ansible_user: %s\n" "${!node_username}"
|
|
printf "ansible_become_pass: %s\n" "${!node_password}"
|
|
} > "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml"
|
|
sops --encrypt --in-place "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml"
|
|
done
|
|
}
|
|
|
|
generate_ansible_hosts() {
|
|
local worker_node_count=
|
|
default_control_node_prefix=${BOOTSTRAP_ANSIBLE_DEFAULT_CONTROL_NODE_HOSTNAME_PREFIX:-k8s-}
|
|
default_worker_node_prefix=${BOOTSTRAP_ANSIBLE_DEFAULT_NODE_HOSTNAME_PREFIX:-k8s-}
|
|
{
|
|
printf -- "---\n"
|
|
printf "kubernetes:\n"
|
|
printf " children:\n"
|
|
printf " master:\n"
|
|
printf " hosts:\n"
|
|
master_node_count=0
|
|
worker_node_count=0
|
|
for var in "${!BOOTSTRAP_ANSIBLE_HOST_ADDR_@}"; do
|
|
node_id=$(echo "${var}" | awk -F"_" '{print $5}')
|
|
node_control="BOOTSTRAP_ANSIBLE_CONTROL_NODE_${node_id}"
|
|
if [[ "${!node_control}" == "true" ]]; then
|
|
master_node_count=$((master_node_count+1))
|
|
node_hostname="BOOTSTRAP_ANSIBLE_HOSTNAME_${node_id}"
|
|
host_key="${!node_hostname:-${default_control_node_prefix}}"
|
|
if [ "${host_key}" == "${default_control_node_prefix}" ]; then
|
|
node_hostname=${default_control_node_prefix}${node_id}
|
|
else
|
|
node_hostname=${!node_hostname}
|
|
fi
|
|
printf " %s:\n" "${node_hostname}"
|
|
printf " ansible_host: %s\n" "${!var}"
|
|
else
|
|
worker_node_count=$((worker_node_count+1))
|
|
fi
|
|
done
|
|
if [[ ${worker_node_count} -gt 0 ]]; then
|
|
printf " worker:\n"
|
|
printf " hosts:\n"
|
|
for var in "${!BOOTSTRAP_ANSIBLE_HOST_ADDR_@}"; do
|
|
node_id=$(echo "${var}" | awk -F"_" '{print $5}')
|
|
node_control="BOOTSTRAP_ANSIBLE_CONTROL_NODE_${node_id}"
|
|
if [[ "${!node_control}" == "false" ]]; then
|
|
node_hostname="BOOTSTRAP_ANSIBLE_HOSTNAME_${node_id}"
|
|
host_key="${!node_hostname:-${default_worker_node_prefix}}"
|
|
if [ "${host_key}" == "${default_worker_node_prefix}" ]; then
|
|
node_hostname=${default_worker_node_prefix}${node_id}
|
|
else
|
|
node_hostname=${!node_hostname}
|
|
fi
|
|
printf " %s:\n" "${node_hostname}"
|
|
printf " ansible_host: %s\n" "${!var}"
|
|
fi
|
|
done
|
|
fi
|
|
} > "${PROJECT_DIR}/ansible/inventory/hosts.yml"
|
|
}
|
|
|
|
setup_prometheus_endpoints() {
|
|
yq --inplace 'del(.spec.values.kubeControllerManager.endpoints[])' \
|
|
"${PROJECT_DIR}/kubernetes/apps/monitoring/kube-prometheus-stack/app/helmrelease.yaml"
|
|
for var in "${!BOOTSTRAP_ANSIBLE_HOST_ADDR_@}"; do
|
|
node_id=$(echo "${var}" | awk -F"_" '{print $5}')
|
|
node_control="BOOTSTRAP_ANSIBLE_CONTROL_NODE_${node_id}"
|
|
if [[ "${!node_control}" == "true" ]]; then
|
|
node_addr="BOOTSTRAP_ANSIBLE_HOST_ADDR_${node_id}"
|
|
_log "INFO(${FUNCNAME[0]})" "Setting up Prometheus endpoint for '${!node_addr}'"
|
|
yq --inplace ".spec.values.kubeControllerManager.endpoints += \"${!node_addr}\"" \
|
|
"${PROJECT_DIR}/kubernetes/apps/monitoring/kube-prometheus-stack/app/helmrelease.yaml"
|
|
fi
|
|
done
|
|
}
|
|
|
|
setup_github_webhook() {
|
|
_has_envar "BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET"
|
|
WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}"
|
|
if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then
|
|
WEBHOOK_SECRET="$(openssl rand -hex 12)"
|
|
fi
|
|
export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
|
|
_log "INFO(${FUNCNAME[0]})" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/github-webhook-token-secret.sops.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml"
|
|
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml"
|
|
}
|
|
|
|
setup_weave_gitops() {
|
|
_has_envar "BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD"
|
|
WEAVE_GITOPS_ADMIN_PASSWORD="${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}"
|
|
if [[ "${WEAVE_GITOPS_ADMIN_PASSWORD}" == "generated" ]]; then
|
|
WEAVE_GITOPS_ADMIN_PASSWORD="$(openssl rand -hex 12)"
|
|
fi
|
|
export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="${WEAVE_GITOPS_ADMIN_PASSWORD}"
|
|
_log "INFO(${FUNCNAME[0]})" "Using admin password '${WEAVE_GITOPS_ADMIN_PASSWORD}' for Weave Gitops"
|
|
# Convert password to bcrypt hash
|
|
# shellcheck disable=SC2155
|
|
export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="$(echo -n "${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}" | gitops get bcrypt-hash)"
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/weave-gitops-secret.sops.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml"
|
|
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml"
|
|
}
|
|
|
|
setup_grafana_admin() {
|
|
_has_envar "BOOTSTRAP_GRAFANA_ADMIN_PASSWORD"
|
|
GRAFANA_ADMIN_PASSWORD="${BOOTSTRAP_GRAFANA_ADMIN_PASSWORD}"
|
|
if [[ "${GRAFANA_ADMIN_PASSWORD}" == "generated" ]]; then
|
|
GRAFANA_ADMIN_PASSWORD="$(openssl rand -hex 12)"
|
|
fi
|
|
export BOOTSTRAP_GRAFANA_ADMIN_PASSWORD="${GRAFANA_ADMIN_PASSWORD}"
|
|
_log "INFO(${FUNCNAME[0]})" "Using password '${GRAFANA_ADMIN_PASSWORD}' for Grafana"
|
|
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/grafana-admin-secret.sops.yaml" \
|
|
> "${PROJECT_DIR}/kubernetes/apps/monitoring/grafana/app/secret.sops.yaml"
|
|
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/monitoring/grafana/app/secret.sops.yaml"
|
|
}
|
|
|
|
success() {
|
|
_log "INFO(${FUNCNAME[0]})" "All files have been templated, proceed to the next steps outlined in the README"
|
|
exit 0
|
|
}
|
|
|
|
_log() {
|
|
local type="${1}"
|
|
local msg="${2}"
|
|
printf 'timestamp="%s" type="%s" message="%s"\n' "$(date)" "${type}" "${msg}"
|
|
}
|
|
|
|
main "$@"
|