tegwick
0da83472c4
config-hosteurope names port 16443, but the k3s-api-railiance01 ops-bridge tunnel listens on 16444, so every default target failed with connection refused. Switch Makefile, tools and docs to ~/.kube/config-railiance01 and fix the restore recipe to rewrite the API address to the tunnel port. The node-side hostPath in STATE.md is unrelated and unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1031639@bnt-lap001 Assistant-Session: e5073fee-f4ae-4fc3-a75a-6c1fc83e0576
44 lines
No EOL
1.2 KiB
Bash
Executable file
44 lines
No EOL
1.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# One-time: capture cluster runner registration token into SOPS (operator host with age key).
|
|
# RAIL-HO-WP-0005 T05 — closes runner secret gap when bootstrap used kubectl create secret.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
OUT="${ROOT}/helm/forgejo-runner-registration.sops.yaml"
|
|
KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-railiance01}"
|
|
FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}"
|
|
|
|
export KUBECONFIG
|
|
|
|
if ! command -v sops >/dev/null 2>&1; then
|
|
echo "ERROR: sops required" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -f "${OUT}" ]]; then
|
|
echo "Already exists: ${OUT}" >&2
|
|
echo "Remove it first if you intend to re-capture from cluster." >&2
|
|
exit 1
|
|
fi
|
|
|
|
token="$(kubectl get secret forgejo-runner-registration -n "${FORGEJO_NAMESPACE}" \
|
|
-o jsonpath='{.data.token}' | base64 -d)"
|
|
if [[ -z "${token}" ]]; then
|
|
echo "ERROR: forgejo-runner-registration secret missing or empty in ${FORGEJO_NAMESPACE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cat > "${OUT}" <<EOF
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: forgejo-runner-registration
|
|
namespace: ${FORGEJO_NAMESPACE}
|
|
type: Opaque
|
|
stringData:
|
|
token: ${token}
|
|
EOF
|
|
|
|
sops --encrypt --in-place "${OUT}"
|
|
echo "Created ${OUT}"
|
|
echo "Verify: SOPS_SENTINEL=${OUT} make check-sops" |