63 lines
No EOL
2.1 KiB
Bash
Executable file
63 lines
No EOL
2.1 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
# Generate Kubernetes secrets from 1Password
|
|
|
|
# Ensure we're logged in to 1Password
|
|
if ! op whoami &>/dev/null; then
|
|
echo "Please log in to 1Password first: eval \$(op signin)"
|
|
exit 1
|
|
fi
|
|
|
|
# Get PostgreSQL password
|
|
POSTGRES_PASSWORD=$(op item get "APRS PostgreSQL Password" --fields password)
|
|
|
|
# Get APRS application secrets
|
|
DATABASE_URL=$(op item get "APRS Application Secrets" --fields database.url)
|
|
DATABASE_URL_PGBOUNCER=$(op item get "APRS Application Secrets" --fields database.url.pgbouncer)
|
|
DATABASE_PASSWORD=$(op item get "APRS Application Secrets" --fields password)
|
|
SECRET_KEY_BASE=$(op item get "APRS Application Secrets" --fields secret.key.base)
|
|
ERLANG_COOKIE=$(op item get "APRS Application Secrets" --fields erlang.cookie)
|
|
|
|
# Get GitHub Container Registry credentials
|
|
GHCR_USERNAME=$(op item get "GitHub Container Registry" --fields username)
|
|
GHCR_PASSWORD=$(op item get "GitHub Container Registry" --fields password)
|
|
GHCR_AUTH=$(echo -n "${GHCR_USERNAME}:${GHCR_PASSWORD}" | base64)
|
|
|
|
# Create PostgreSQL secret
|
|
kubectl create secret generic postgis-secret \
|
|
--namespace=aprs \
|
|
--from-literal=postgres-password="${POSTGRES_PASSWORD}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
# Create APRS application secret
|
|
kubectl create secret generic aprs-secret \
|
|
--namespace=aprs \
|
|
--from-literal=database-url="${DATABASE_URL}" \
|
|
--from-literal=database-url-pgbouncer="${DATABASE_URL_PGBOUNCER}" \
|
|
--from-literal=database-password="${DATABASE_PASSWORD}" \
|
|
--from-literal=secret-key-base="${SECRET_KEY_BASE}" \
|
|
--from-literal=erlang-cookie="${ERLANG_COOKIE}" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
# Create Docker registry secret
|
|
cat <<EOF | kubectl apply -f -
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ghcr-pull-secret
|
|
namespace: aprs
|
|
type: kubernetes.io/dockerconfigjson
|
|
stringData:
|
|
.dockerconfigjson: |
|
|
{
|
|
"auths": {
|
|
"ghcr.io": {
|
|
"username": "${GHCR_USERNAME}",
|
|
"password": "${GHCR_PASSWORD}",
|
|
"auth": "${GHCR_AUTH}"
|
|
}
|
|
}
|
|
}
|
|
EOF
|
|
|
|
echo "Secrets successfully created/updated from 1Password" |