tegwick
6635fdc976
Materialize offsite Secret from OpenBao, deploy per-cluster CronJobs, generalize multi-cluster logical backup + status health for Option A, seed encrypted uploads and restore-drill evidence; workplan finished.
67 lines
2.3 KiB
Bash
Executable file
67 lines
2.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Materialize databases/cnpg-backup-offsite from OpenBao (RAILIANCE-WP-0015-T02).
|
|
# Never prints secret values. Does not place AGE_PRIVATE_KEY in-cluster.
|
|
set -euo pipefail
|
|
|
|
NAMESPACE="${CNPG_NAMESPACE:-databases}"
|
|
SECRET_NAME="${CNPG_BACKUP_OFFSITE_SECRET:-cnpg-backup-offsite}"
|
|
BAO_PATH="${RAILIANCE_BACKUP_BAO_PATH:-platform/workloads/railiance/backup/offsite-lane}"
|
|
AGE_PUBLIC_KEY="${RAILIANCE_BACKUP_AGE_PUBLIC_KEY:-age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz}"
|
|
DRY_RUN="${DRY_RUN:-0}"
|
|
|
|
if ! command -v bao >/dev/null 2>&1; then
|
|
echo "ERROR: bao CLI required" >&2
|
|
exit 1
|
|
fi
|
|
if ! command -v kubectl >/dev/null 2>&1; then
|
|
echo "ERROR: kubectl required" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! bao token lookup >/dev/null 2>&1; then
|
|
echo "ERROR: no valid OpenBao token" >&2
|
|
echo "Run: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! bao kv metadata get "$BAO_PATH" >/dev/null 2>&1; then
|
|
echo "ERROR: cannot read metadata for ${BAO_PATH}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Fetch into env without echoing
|
|
NC_WEBDAV_TOKEN="$(bao kv get -field=NC_WEBDAV_TOKEN "$BAO_PATH")"
|
|
NC_WEBDAV_URL="$(bao kv get -field=NC_WEBDAV_URL "$BAO_PATH")"
|
|
|
|
if [[ -z "${NC_WEBDAV_TOKEN}" || -z "${NC_WEBDAV_URL}" ]]; then
|
|
echo "ERROR: NC_WEBDAV_TOKEN or NC_WEBDAV_URL empty at ${BAO_PATH}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "cnpg-backup-offsite secret apply"
|
|
echo " namespace: ${NAMESPACE}"
|
|
echo " secret: ${SECRET_NAME}"
|
|
echo " source: ${BAO_PATH}"
|
|
echo " keys: NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PUBLIC_KEY"
|
|
echo " dry-run: ${DRY_RUN}"
|
|
|
|
if [[ "$DRY_RUN" == "1" ]]; then
|
|
echo "ok: dry-run — would create/update Secret ${NAMESPACE}/${SECRET_NAME}"
|
|
exit 0
|
|
fi
|
|
|
|
kubectl create secret generic "$SECRET_NAME" \
|
|
-n "$NAMESPACE" \
|
|
--from-literal=NC_WEBDAV_TOKEN="$NC_WEBDAV_TOKEN" \
|
|
--from-literal=NC_WEBDAV_URL="$NC_WEBDAV_URL" \
|
|
--from-literal=AGE_PUBLIC_KEY="$AGE_PUBLIC_KEY" \
|
|
--dry-run=client -o yaml \
|
|
| kubectl apply -f -
|
|
|
|
# Clear locals
|
|
unset NC_WEBDAV_TOKEN NC_WEBDAV_URL
|
|
|
|
# Non-secret verification
|
|
keys="$(kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" -o jsonpath='{.data}' \
|
|
| python3 -c 'import sys,json; print(",".join(sorted(json.load(sys.stdin).keys())))')"
|
|
echo "ok: Secret ${NAMESPACE}/${SECRET_NAME} applied (keys: ${keys})"
|