tegwick
3a9236148a
Introduce forgejo-verify acceptance checks, idempotent operator bootstrap, runner registration SOPS capture helper, and session/security Helm values.
44 lines
No EOL
1.2 KiB
Bash
Executable file
44 lines
No EOL
1.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# One-time: capture cluster runner registration token into SOPS (operator host with age key).
|
|
# RAIL-HO-WP-0005 T05 — closes runner secret gap when bootstrap used kubectl create secret.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
OUT="${ROOT}/helm/forgejo-runner-registration.sops.yaml"
|
|
KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
|
|
FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}"
|
|
|
|
export KUBECONFIG
|
|
|
|
if ! command -v sops >/dev/null 2>&1; then
|
|
echo "ERROR: sops required" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -f "${OUT}" ]]; then
|
|
echo "Already exists: ${OUT}" >&2
|
|
echo "Remove it first if you intend to re-capture from cluster." >&2
|
|
exit 1
|
|
fi
|
|
|
|
token="$(kubectl get secret forgejo-runner-registration -n "${FORGEJO_NAMESPACE}" \
|
|
-o jsonpath='{.data.token}' | base64 -d)"
|
|
if [[ -z "${token}" ]]; then
|
|
echo "ERROR: forgejo-runner-registration secret missing or empty in ${FORGEJO_NAMESPACE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cat > "${OUT}" <<EOF
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: forgejo-runner-registration
|
|
namespace: ${FORGEJO_NAMESPACE}
|
|
type: Opaque
|
|
stringData:
|
|
token: ${token}
|
|
EOF
|
|
|
|
sops --encrypt --in-place "${OUT}"
|
|
echo "Created ${OUT}"
|
|
echo "Verify: SOPS_SENTINEL=${OUT} make check-sops" |