k.rennerandClaude Opus 4.7
d882895d87
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
41 lines
1.4 KiB
Bash
Executable File
41 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Import SOPS-encrypted talosconfig and kubeconfig from Garage (s3://k8s-secrets/cluster-access/)
|
|
# into local ~/.talos/config and ~/.kube/config.
|
|
#
|
|
# Requires aws-cli + sops on the workstation, and Garage `secrets-key` credentials reachable
|
|
# either via env (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY) or via an aws-cli profile passed in
|
|
# AWS_PROFILE.
|
|
|
|
ENDPOINT="https://s3.nas-1.renner.uno"
|
|
BUCKET="k8s-secrets"
|
|
PREFIX="cluster-access"
|
|
export AWS_PROFILE="secrets"
|
|
|
|
|
|
command -v aws >/dev/null || { echo "aws-cli not found"; exit 1; }
|
|
command -v sops >/dev/null || { echo "sops not found"; exit 1; }
|
|
|
|
TMPDIR=$(mktemp -d)
|
|
trap 'rm -rf "$TMPDIR"' EXIT
|
|
|
|
echo "Fetching access files from $ENDPOINT/$BUCKET/$PREFIX/ ..."
|
|
AWS_DEFAULT_REGION=garage aws --endpoint-url "$ENDPOINT" \
|
|
s3 cp "s3://$BUCKET/$PREFIX/talosconfig.sops" "$TMPDIR/talosconfig.sops"
|
|
AWS_DEFAULT_REGION=garage aws --endpoint-url "$ENDPOINT" \
|
|
s3 cp "s3://$BUCKET/$PREFIX/kubeconfig.sops" "$TMPDIR/kubeconfig.sops"
|
|
|
|
mkdir -p ~/.talos ~/.kube
|
|
|
|
sops -d --input-type binary --output-type binary "$TMPDIR/talosconfig.sops" > ~/.talos/config
|
|
chmod 600 ~/.talos/config
|
|
|
|
sops -d --input-type binary --output-type binary "$TMPDIR/kubeconfig.sops" > ~/.kube/config
|
|
chmod 600 ~/.kube/config
|
|
|
|
echo "Imported:"
|
|
echo " ~/.talos/config"
|
|
echo " ~/.kube/config"
|
|
kubectl get nodes 2>&1 | head -5
|