60 lines
2.6 KiB
Bash
Executable File
60 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# One-time helper for the existing arschrock deployment. It copies credentials
|
|
# from live resources into one Kubernetes Secret without printing them.
|
|
set -euo pipefail
|
|
|
|
namespace=${NAMESPACE:-gramps}
|
|
workdir=$(mktemp --directory)
|
|
trap 'rm -rf "${workdir}"' EXIT HUP INT TERM
|
|
chmod 0700 "${workdir}"
|
|
|
|
extract_env() {
|
|
local deployment=$1 name=$2 destination=$3
|
|
kubectl --namespace "${namespace}" get deployment "${deployment}" --output=json \
|
|
| jq --raw-output --join-output --arg name "${name}" \
|
|
'.spec.template.spec.containers[0].env[] | select(.name == $name) | .value' \
|
|
> "${destination}"
|
|
test -s "${destination}"
|
|
}
|
|
|
|
extract_secret() {
|
|
local source_secret=$1 key=$2 destination=$3
|
|
kubectl --namespace "${namespace}" get secret "${source_secret}" --output=json \
|
|
| jq --raw-output --join-output --arg key "${key}" '.data[$key]' \
|
|
| base64 --decode > "${destination}"
|
|
test -s "${destination}"
|
|
}
|
|
|
|
extract_env grampsweb-celery GRAMPSWEB_SECRET_KEY "${workdir}/app-secret-key" \
|
|
|| openssl rand -hex 32 > "${workdir}/app-secret-key"
|
|
extract_env grampsweb GRAMPSWEB_POSTGRES_PASSWORD "${workdir}/password"
|
|
extract_env grampsweb GRAMPSWEB_USER_DB_URI "${workdir}/user-database-uri"
|
|
extract_env grampsweb GRAMPSWEB_SEARCH_INDEX_DB_URI "${workdir}/search-index-database-uri"
|
|
extract_env grampsweb GRAMPSWEB_OIDC_CLIENT_SECRET "${workdir}/oidc-client-secret"
|
|
extract_env grampsweb AWS_ACCESS_KEY_ID "${workdir}/aws-access-key-id"
|
|
extract_env grampsweb AWS_SECRET_ACCESS_KEY "${workdir}/aws-secret-access-key"
|
|
extract_secret postgresql postgres-password "${workdir}/postgres-password"
|
|
extract_secret valkey valkey-password "${workdir}/valkey-password"
|
|
|
|
kubectl --namespace "${namespace}" create secret generic gramps-runtime \
|
|
--from-file="${workdir}/app-secret-key" \
|
|
--from-file="${workdir}/user-database-uri" \
|
|
--from-file="${workdir}/search-index-database-uri" \
|
|
--from-file="${workdir}/oidc-client-secret" \
|
|
--from-file="${workdir}/aws-access-key-id" \
|
|
--from-file="${workdir}/aws-secret-access-key" \
|
|
--dry-run=client --output=yaml \
|
|
| kubectl apply --filename=-
|
|
kubectl --namespace "${namespace}" create secret generic gramps-postgresql \
|
|
--from-file="${workdir}/postgres-password" \
|
|
--from-file="${workdir}/password" \
|
|
--dry-run=client --output=yaml \
|
|
| kubectl apply --filename=-
|
|
kubectl --namespace "${namespace}" create secret generic gramps-valkey \
|
|
--from-file="${workdir}/valkey-password" \
|
|
--dry-run=client --output=yaml \
|
|
| kubectl apply --filename=-
|
|
|
|
echo "Runtime, PostgreSQL, and Valkey Secrets are ready; no values were printed."
|