63 lines
2.3 KiB
Bash
Executable File
63 lines
2.3 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
set -eu
|
|
|
|
NAMESPACE=default
|
|
SECRET_NAME=mumble-secrets
|
|
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
|
|
|
for command in kubectl openssl; do
|
|
if ! command -v "$command" >/dev/null 2>&1; then
|
|
echo "Required command not found: $command" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
for dependency in secret/postgresql secret/brunner-ninja-tls; do
|
|
if ! kubectl get "$dependency" --namespace "$NAMESPACE" >/dev/null 2>&1; then
|
|
echo "Required Kubernetes object not found: $NAMESPACE/$dependency" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
if ! kubectl get secret "$SECRET_NAME" --namespace "$NAMESPACE" >/dev/null 2>&1; then
|
|
database_password=$(openssl rand -hex 32)
|
|
superuser_password=$(openssl rand -hex 32)
|
|
registration_password=$(openssl rand -hex 32)
|
|
|
|
kubectl create secret generic "$SECRET_NAME" \
|
|
--namespace "$NAMESPACE" \
|
|
--from-literal="database-password=$database_password" \
|
|
--from-literal="superuser-password=$superuser_password" \
|
|
--from-literal="registration-password=$registration_password"
|
|
|
|
unset database_password superuser_password registration_password
|
|
echo "Created $NAMESPACE/$SECRET_NAME with random database, SuperUser, and public-registry passwords."
|
|
else
|
|
echo "Keeping existing $NAMESPACE/$SECRET_NAME."
|
|
|
|
registration_password_present=$(kubectl get secret "$SECRET_NAME" \
|
|
--namespace "$NAMESPACE" \
|
|
-o go-template='{{if index .data "registration-password"}}yes{{end}}')
|
|
|
|
if [ -z "$registration_password_present" ] || [ "${ROTATE_REGISTRATION_PASSWORD:-false}" = true ]; then
|
|
registration_password=$(openssl rand -hex 32)
|
|
kubectl patch secret "$SECRET_NAME" \
|
|
--namespace "$NAMESPACE" \
|
|
--type=merge \
|
|
--patch "{\"stringData\":{\"registration-password\":\"$registration_password\"}}" >/dev/null
|
|
unset registration_password
|
|
echo "Set a new random public-registry password in $NAMESPACE/$SECRET_NAME."
|
|
fi
|
|
|
|
unset registration_password_present
|
|
fi
|
|
|
|
kubectl apply -f "$SCRIPT_DIR/mumble.yaml"
|
|
kubectl rollout status deployment/mumble --namespace "$NAMESPACE" --timeout=5m
|
|
|
|
echo
|
|
echo "Mumble is available at brunner.ninja:64738 (MetalLB 192.168.0.14)."
|
|
echo "Retrieve the SuperUser password with:"
|
|
echo "kubectl get secret $SECRET_NAME -n $NAMESPACE -o jsonpath='{.data.superuser-password}' | base64 -d; echo"
|