k.rennerandClaude Opus 4.7
b4975fabbb
The rebuild-k8s pipeline previously SOPS-encrypted talosconfig and kubeconfig and pushed them back to master. The git push raced with concurrent commits and forced workstation users to `git pull --rebase` after every rebuild. Replace the transport with Garage's k8s-secrets bucket (s3://k8s-secrets/cluster-access/), reusing the existing secrets-key that the install-garage-synology playbook already provisions. SOPS encryption is unchanged — only the storage layer moves. - New scripts/ci/fetch-kubeconfig.sh helper: 9 CI steps that previously inlined `sops -d kubernetes/access/kubeconfig.sops` now call this. - scripts/import-cluster-access.sh rewritten to pull both files from Garage; no more git fetch/checkout. - export-access step uploads via aws s3 cp; gitea_token + git config removed. - All consuming Woodpecker steps gain garage_secrets_key_id / garage_secrets_secret_key from_secret env vars, and bump to ci-k8s:2026-05-01 (the tag with aws-cli baked in). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
39 lines
1.4 KiB
Bash
Executable File
39 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Import SOPS-encrypted talosconfig and kubeconfig from Garage (s3://k8s-secrets/cluster-access/)
|
|
# into local ~/.talos/config and ~/.kube/config.
|
|
#
|
|
# Requires aws-cli + sops on the workstation, and Garage `secrets-key` credentials reachable
|
|
# either via env (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY) or via an aws-cli profile passed in
|
|
# AWS_PROFILE. Creds live on nas-1 at /volume1/docker/garage/config/keys/secrets-key.creds.
|
|
|
|
ENDPOINT="https://s3.nas-1.renner.uno"
|
|
BUCKET="k8s-secrets"
|
|
PREFIX="cluster-access"
|
|
|
|
command -v aws >/dev/null || { echo "aws-cli not found"; exit 1; }
|
|
command -v sops >/dev/null || { echo "sops not found"; exit 1; }
|
|
|
|
TMPDIR=$(mktemp -d)
|
|
trap 'rm -rf "$TMPDIR"' EXIT
|
|
|
|
echo "Fetching access files from $ENDPOINT/$BUCKET/$PREFIX/ ..."
|
|
AWS_DEFAULT_REGION=garage aws --endpoint-url "$ENDPOINT" \
|
|
s3 cp "s3://$BUCKET/$PREFIX/talosconfig.sops" "$TMPDIR/talosconfig.sops"
|
|
AWS_DEFAULT_REGION=garage aws --endpoint-url "$ENDPOINT" \
|
|
s3 cp "s3://$BUCKET/$PREFIX/kubeconfig.sops" "$TMPDIR/kubeconfig.sops"
|
|
|
|
mkdir -p ~/.talos ~/.kube
|
|
|
|
sops -d --input-type binary --output-type binary "$TMPDIR/talosconfig.sops" > ~/.talos/config
|
|
chmod 600 ~/.talos/config
|
|
|
|
sops -d --input-type binary --output-type binary "$TMPDIR/kubeconfig.sops" > ~/.kube/config
|
|
chmod 600 ~/.kube/config
|
|
|
|
echo "Imported:"
|
|
echo " ~/.talos/config"
|
|
echo " ~/.kube/config"
|
|
kubectl get nodes 2>&1 | head -5
|