k.rennerandClaude Opus 4.8
0ce60164e1
rebuild-k8s.yml was the one-shot PVE->K8s migration/rebuild pipeline; it is no longer needed and still pointed at the retired Garage S3 on the now-off nas-1. Remove it (DR restore is via Velero + flux bootstrap). The live cluster-access path is kept and migrated off Garage onto Hetzner Object Storage (renner-uno-k8s-secrets, fsn1.your-objectstorage.com, region fsn1, hetzner_s3_* keypair): - scripts/ci/fetch-kubeconfig.sh: Garage -> Hetzner; env vars renamed GARAGE_SECRETS_* -> S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY. - .woodpecker/e2e.yml, e2e-test.yml: pass hetzner_s3_access_key/secret_key (the live cron e2e pipeline needs this — it was broken against dead nas-1). - scripts/import-cluster-access.sh: Garage -> Hetzner endpoint/bucket/region. NOTE: the workstation aws-cli "secrets" profile must now hold the Hetzner Object Storage keypair. Also: delete the orphaned test-garage-smoke play + pipeline, and fix the two dangling rebuild-k8s.yml references (zfs-tuning play comment; update-audit prompt Talos-pin file list). Assumes cluster-access objects (kubeconfig.sops/talosconfig.sops) were migrated into renner-uno-k8s-secrets; with rebuild-k8s gone, nothing auto-refreshes them, which is fine for a stable cluster. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
28 lines
1.0 KiB
Bash
Executable File
28 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch kubeconfig.sops from Hetzner Object Storage and decrypt to ~/.kube/config.
|
|
# Used by every Woodpecker step that needs cluster access (the e2e pipelines).
|
|
#
|
|
# Required env (typically from_secret in the calling pipeline):
|
|
# S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY — Hetzner Object Storage keypair
|
|
# SOPS_AGE_KEY — age private key (Flux/CI keyring)
|
|
set -euo pipefail
|
|
|
|
: "${S3_ACCESS_KEY_ID:?S3_ACCESS_KEY_ID not set}"
|
|
: "${S3_SECRET_ACCESS_KEY:?S3_SECRET_ACCESS_KEY not set}"
|
|
: "${SOPS_AGE_KEY:?SOPS_AGE_KEY not set}"
|
|
|
|
mkdir -p ~/.config/sops/age ~/.kube
|
|
echo "$SOPS_AGE_KEY" > ~/.config/sops/age/keys.txt
|
|
|
|
TMP=$(mktemp)
|
|
trap 'rm -f "$TMP"' EXIT
|
|
|
|
AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY_ID" \
|
|
AWS_SECRET_ACCESS_KEY="$S3_SECRET_ACCESS_KEY" \
|
|
AWS_DEFAULT_REGION=fsn1 \
|
|
aws --endpoint-url https://fsn1.your-objectstorage.com \
|
|
s3 cp s3://renner-uno-k8s-secrets/cluster-access/kubeconfig.sops "$TMP"
|
|
|
|
sops -d --input-type binary --output-type binary "$TMP" > ~/.kube/config
|
|
chmod 600 ~/.kube/config
|