k.rennerandClaude Opus 4.8
0ce60164e1
rebuild-k8s.yml was the one-shot PVE->K8s migration/rebuild pipeline; it is no longer needed and still pointed at the retired Garage S3 on the now-off nas-1. Remove it (DR restore is via Velero + flux bootstrap). The live cluster-access path is kept and migrated off Garage onto Hetzner Object Storage (renner-uno-k8s-secrets, fsn1.your-objectstorage.com, region fsn1, hetzner_s3_* keypair): - scripts/ci/fetch-kubeconfig.sh: Garage -> Hetzner; env vars renamed GARAGE_SECRETS_* -> S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY. - .woodpecker/e2e.yml, e2e-test.yml: pass hetzner_s3_access_key/secret_key (the live cron e2e pipeline needs this — it was broken against dead nas-1). - scripts/import-cluster-access.sh: Garage -> Hetzner endpoint/bucket/region. NOTE: the workstation aws-cli "secrets" profile must now hold the Hetzner Object Storage keypair. Also: delete the orphaned test-garage-smoke play + pipeline, and fix the two dangling rebuild-k8s.yml references (zfs-tuning play comment; update-audit prompt Talos-pin file list). Assumes cluster-access objects (kubeconfig.sops/talosconfig.sops) were migrated into renner-uno-k8s-secrets; with rebuild-k8s gone, nothing auto-refreshes them, which is fine for a stable cluster. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
43 lines
1.5 KiB
Bash
Executable File
43 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Import SOPS-encrypted talosconfig and kubeconfig from Hetzner Object Storage
|
|
# (s3://renner-uno-k8s-secrets/cluster-access/) into local ~/.talos/config and
|
|
# ~/.kube/config.
|
|
#
|
|
# Requires aws-cli + sops on the workstation, and Hetzner Object Storage
|
|
# credentials reachable either via env (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)
|
|
# or via an aws-cli profile passed in AWS_PROFILE (the "secrets" profile must
|
|
# hold the Hetzner Object Storage keypair).
|
|
|
|
ENDPOINT="https://fsn1.your-objectstorage.com"
|
|
BUCKET="renner-uno-k8s-secrets"
|
|
PREFIX="cluster-access"
|
|
export AWS_PROFILE="secrets"
|
|
|
|
|
|
command -v aws >/dev/null || { echo "aws-cli not found"; exit 1; }
|
|
command -v sops >/dev/null || { echo "sops not found"; exit 1; }
|
|
|
|
TMPDIR=$(mktemp -d)
|
|
trap 'rm -rf "$TMPDIR"' EXIT
|
|
|
|
echo "Fetching access files from $ENDPOINT/$BUCKET/$PREFIX/ ..."
|
|
AWS_DEFAULT_REGION=fsn1 aws --endpoint-url "$ENDPOINT" \
|
|
s3 cp "s3://$BUCKET/$PREFIX/talosconfig.sops" "$TMPDIR/talosconfig.sops"
|
|
AWS_DEFAULT_REGION=fsn1 aws --endpoint-url "$ENDPOINT" \
|
|
s3 cp "s3://$BUCKET/$PREFIX/kubeconfig.sops" "$TMPDIR/kubeconfig.sops"
|
|
|
|
mkdir -p ~/.talos ~/.kube
|
|
|
|
sops -d --input-type binary --output-type binary "$TMPDIR/talosconfig.sops" > ~/.talos/config
|
|
chmod 600 ~/.talos/config
|
|
|
|
sops -d --input-type binary --output-type binary "$TMPDIR/kubeconfig.sops" > ~/.kube/config
|
|
chmod 600 ~/.kube/config
|
|
|
|
echo "Imported:"
|
|
echo " ~/.talos/config"
|
|
echo " ~/.kube/config"
|
|
kubectl get nodes 2>&1 | head -5
|