fix: Make deploy key job fully idempotent with SSH known hosts
Restructure the argocd-deploy-key-init job so each step (known hosts, deploy key registration, secret creation) is independently idempotent. Add ssh-keyscan of Forgejo host key and patch ArgoCD known hosts ConfigMap. Use kubectl apply with inline YAML to create the repo secret with the argocd label in a single atomic step. Switch images from bitnami/kubectl to alpine/k8s. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Felix Wolf
parent
a094b7d70a
commit
70559c614b
|
|
@ -18,6 +18,9 @@ rules:
|
|||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "create"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "patch"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -54,22 +57,57 @@ spec:
|
|||
- |
|
||||
set -e
|
||||
|
||||
apk add --no-cache openssh-keygen > /dev/null 2>&1
|
||||
apk add --no-cache openssh-keygen openssh-client > /dev/null 2>&1
|
||||
|
||||
ARGOCD_NS="argocd"
|
||||
REPO_SECRET="forgejo-repo"
|
||||
REPO_URL="ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git"
|
||||
FORGEJO_URL="https://git.tr1ceracop.de"
|
||||
FORGEJO_HOST="git.tr1ceracop.de"
|
||||
FORGEJO_SSH_PORT="222"
|
||||
FORGEJO_URL="https://${FORGEJO_HOST}"
|
||||
REPO_OWNER="gitea_admin"
|
||||
REPO_NAME="k8s-and-chill"
|
||||
KNOWN_HOSTS_CM="argocd-ssh-known-hosts-cm"
|
||||
|
||||
# Check if ArgoCD repo secret already exists
|
||||
if kubectl get secret "${REPO_SECRET}" -n "${ARGOCD_NS}" >/dev/null 2>&1; then
|
||||
echo "Secret ${REPO_SECRET} already exists in ${ARGOCD_NS}, skipping"
|
||||
exit 0
|
||||
# Wait for Forgejo to be ready
|
||||
echo "Waiting for Forgejo to be ready..."
|
||||
for i in $(seq 1 60); do
|
||||
if curl -sk "${FORGEJO_URL}/api/v1/version" >/dev/null 2>&1; then
|
||||
echo "Forgejo HTTPS is ready"
|
||||
break
|
||||
fi
|
||||
if [ "$i" -eq 60 ]; then
|
||||
echo "Forgejo did not become ready in time"
|
||||
exit 1
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
|
||||
# Step 1: Add Forgejo SSH host key to ArgoCD known hosts
|
||||
echo "Scanning Forgejo SSH host key..."
|
||||
HOSTKEY=$(ssh-keyscan -p "${FORGEJO_SSH_PORT}" "${FORGEJO_HOST}" 2>/dev/null | grep -v '^#' | head -1)
|
||||
if [ -z "${HOSTKEY}" ]; then
|
||||
echo "Failed to scan SSH host key"
|
||||
exit 1
|
||||
fi
|
||||
echo "Got host key: ${HOSTKEY}"
|
||||
|
||||
EXISTING=$(kubectl get configmap "${KNOWN_HOSTS_CM}" -n "${ARGOCD_NS}" -o jsonpath='{.data.ssh_known_hosts}')
|
||||
if echo "${EXISTING}" | grep -qF "[${FORGEJO_HOST}]:${FORGEJO_SSH_PORT}"; then
|
||||
echo "Forgejo host key already in known hosts"
|
||||
else
|
||||
echo "Adding Forgejo host key to ArgoCD known hosts..."
|
||||
UPDATED=$(printf '%s\n%s\n' "${EXISTING}" "${HOSTKEY}")
|
||||
kubectl patch configmap "${KNOWN_HOSTS_CM}" -n "${ARGOCD_NS}" \
|
||||
--type merge -p "{\"data\":{\"ssh_known_hosts\":$(printf '%s' "${UPDATED}" | jq -Rs .)}}"
|
||||
echo "Added Forgejo SSH host key to known hosts"
|
||||
fi
|
||||
|
||||
# Read admin credentials from forgejo-admin-secret
|
||||
# Step 2: Create deploy key and repo secret (if not already done)
|
||||
if kubectl get secret "${REPO_SECRET}" -n "${ARGOCD_NS}" >/dev/null 2>&1; then
|
||||
echo "Secret ${REPO_SECRET} already exists in ${ARGOCD_NS}, skipping key generation"
|
||||
else
|
||||
# Read admin credentials
|
||||
ADMIN_USER=$(kubectl get secret forgejo-admin-secret -n "${NAMESPACE}" -o jsonpath='{.data.username}' | base64 -d)
|
||||
ADMIN_PASS=$(kubectl get secret forgejo-admin-secret -n "${NAMESPACE}" -o jsonpath='{.data.password}' | base64 -d)
|
||||
|
||||
|
|
@ -80,20 +118,6 @@ spec:
|
|||
PUBKEY=$(cat "${KEYDIR}/id_ed25519.pub")
|
||||
rm -rf "${KEYDIR}"
|
||||
|
||||
# Wait for Forgejo to be ready
|
||||
echo "Waiting for Forgejo to be ready..."
|
||||
for i in $(seq 1 60); do
|
||||
if curl -sk "${FORGEJO_URL}/api/v1/version" >/dev/null 2>&1; then
|
||||
echo "Forgejo is ready"
|
||||
break
|
||||
fi
|
||||
if [ "$i" -eq 60 ]; then
|
||||
echo "Forgejo did not become ready in time"
|
||||
exit 1
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
|
||||
# Register deploy key via Forgejo API
|
||||
echo "Registering deploy key..."
|
||||
HTTP_CODE=$(curl -sk -o /tmp/response.json -w "%{http_code}" \
|
||||
|
|
@ -112,19 +136,26 @@ spec:
|
|||
exit 1
|
||||
fi
|
||||
|
||||
# Create ArgoCD repository secret
|
||||
kubectl create secret generic "${REPO_SECRET}" \
|
||||
-n "${ARGOCD_NS}" \
|
||||
--from-literal=type=git \
|
||||
--from-literal=url="${REPO_URL}" \
|
||||
--from-literal=sshPrivateKey="${PRIVKEY}"
|
||||
|
||||
# Label the secret for ArgoCD
|
||||
kubectl label secret "${REPO_SECRET}" \
|
||||
-n "${ARGOCD_NS}" \
|
||||
argocd.argoproj.io/secret-type=repository
|
||||
# Create ArgoCD repository secret with label
|
||||
cat <<EOSECRET | kubectl apply -f -
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: ${REPO_SECRET}
|
||||
namespace: ${ARGOCD_NS}
|
||||
labels:
|
||||
argocd.argoproj.io/secret-type: repository
|
||||
stringData:
|
||||
type: git
|
||||
url: "${REPO_URL}"
|
||||
sshPrivateKey: |
|
||||
$(echo "${PRIVKEY}" | sed 's/^/ /')
|
||||
EOSECRET
|
||||
|
||||
echo "Created ArgoCD repository secret ${REPO_SECRET} in ${ARGOCD_NS}"
|
||||
fi
|
||||
|
||||
echo "Done"
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
|
|
|
|||
|
|
@ -13,3 +13,10 @@ rules:
|
|||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
|
|
|
|||
|
|
@ -15,22 +15,57 @@ spec:
|
|||
- |
|
||||
set -e
|
||||
|
||||
apk add --no-cache openssh-keygen > /dev/null 2>&1
|
||||
apk add --no-cache openssh-keygen openssh-client > /dev/null 2>&1
|
||||
|
||||
ARGOCD_NS="argocd"
|
||||
REPO_SECRET="forgejo-repo"
|
||||
REPO_URL="ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git"
|
||||
FORGEJO_URL="https://git.tr1ceracop.de"
|
||||
FORGEJO_HOST="git.tr1ceracop.de"
|
||||
FORGEJO_SSH_PORT="222"
|
||||
FORGEJO_URL="https://${FORGEJO_HOST}"
|
||||
REPO_OWNER="gitea_admin"
|
||||
REPO_NAME="k8s-and-chill"
|
||||
KNOWN_HOSTS_CM="argocd-ssh-known-hosts-cm"
|
||||
|
||||
# Check if ArgoCD repo secret already exists
|
||||
if kubectl get secret "${REPO_SECRET}" -n "${ARGOCD_NS}" >/dev/null 2>&1; then
|
||||
echo "Secret ${REPO_SECRET} already exists in ${ARGOCD_NS}, skipping"
|
||||
exit 0
|
||||
# Wait for Forgejo to be ready
|
||||
echo "Waiting for Forgejo to be ready..."
|
||||
for i in $(seq 1 60); do
|
||||
if curl -sk "${FORGEJO_URL}/api/v1/version" >/dev/null 2>&1; then
|
||||
echo "Forgejo HTTPS is ready"
|
||||
break
|
||||
fi
|
||||
if [ "$i" -eq 60 ]; then
|
||||
echo "Forgejo did not become ready in time"
|
||||
exit 1
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
|
||||
# Step 1: Add Forgejo SSH host key to ArgoCD known hosts
|
||||
echo "Scanning Forgejo SSH host key..."
|
||||
HOSTKEY=$(ssh-keyscan -p "${FORGEJO_SSH_PORT}" "${FORGEJO_HOST}" 2>/dev/null | grep -v '^#' | head -1)
|
||||
if [ -z "${HOSTKEY}" ]; then
|
||||
echo "Failed to scan SSH host key"
|
||||
exit 1
|
||||
fi
|
||||
echo "Got host key: ${HOSTKEY}"
|
||||
|
||||
EXISTING=$(kubectl get configmap "${KNOWN_HOSTS_CM}" -n "${ARGOCD_NS}" -o jsonpath='{.data.ssh_known_hosts}')
|
||||
if echo "${EXISTING}" | grep -qF "[${FORGEJO_HOST}]:${FORGEJO_SSH_PORT}"; then
|
||||
echo "Forgejo host key already in known hosts"
|
||||
else
|
||||
echo "Adding Forgejo host key to ArgoCD known hosts..."
|
||||
UPDATED=$(printf '%s\n%s\n' "${EXISTING}" "${HOSTKEY}")
|
||||
kubectl patch configmap "${KNOWN_HOSTS_CM}" -n "${ARGOCD_NS}" \
|
||||
--type merge -p "{\"data\":{\"ssh_known_hosts\":$(printf '%s' "${UPDATED}" | jq -Rs .)}}"
|
||||
echo "Added Forgejo SSH host key to known hosts"
|
||||
fi
|
||||
|
||||
# Read admin credentials from forgejo-admin-secret
|
||||
# Step 2: Create deploy key and repo secret (if not already done)
|
||||
if kubectl get secret "${REPO_SECRET}" -n "${ARGOCD_NS}" >/dev/null 2>&1; then
|
||||
echo "Secret ${REPO_SECRET} already exists in ${ARGOCD_NS}, skipping key generation"
|
||||
else
|
||||
# Read admin credentials
|
||||
ADMIN_USER=$(kubectl get secret forgejo-admin-secret -n "${NAMESPACE}" -o jsonpath='{.data.username}' | base64 -d)
|
||||
ADMIN_PASS=$(kubectl get secret forgejo-admin-secret -n "${NAMESPACE}" -o jsonpath='{.data.password}' | base64 -d)
|
||||
|
||||
|
|
@ -41,20 +76,6 @@ spec:
|
|||
PUBKEY=$(cat "${KEYDIR}/id_ed25519.pub")
|
||||
rm -rf "${KEYDIR}"
|
||||
|
||||
# Wait for Forgejo to be ready
|
||||
echo "Waiting for Forgejo to be ready..."
|
||||
for i in $(seq 1 60); do
|
||||
if curl -sk "${FORGEJO_URL}/api/v1/version" >/dev/null 2>&1; then
|
||||
echo "Forgejo is ready"
|
||||
break
|
||||
fi
|
||||
if [ "$i" -eq 60 ]; then
|
||||
echo "Forgejo did not become ready in time"
|
||||
exit 1
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
|
||||
# Register deploy key via Forgejo API
|
||||
echo "Registering deploy key..."
|
||||
HTTP_CODE=$(curl -sk -o /tmp/response.json -w "%{http_code}" \
|
||||
|
|
@ -73,19 +94,26 @@ spec:
|
|||
exit 1
|
||||
fi
|
||||
|
||||
# Create ArgoCD repository secret
|
||||
kubectl create secret generic "${REPO_SECRET}" \
|
||||
-n "${ARGOCD_NS}" \
|
||||
--from-literal=type=git \
|
||||
--from-literal=url="${REPO_URL}" \
|
||||
--from-literal=sshPrivateKey="${PRIVKEY}"
|
||||
|
||||
# Label the secret for ArgoCD
|
||||
kubectl label secret "${REPO_SECRET}" \
|
||||
-n "${ARGOCD_NS}" \
|
||||
argocd.argoproj.io/secret-type=repository
|
||||
# Create ArgoCD repository secret with label
|
||||
cat <<EOSECRET | kubectl apply -f -
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: ${REPO_SECRET}
|
||||
namespace: ${ARGOCD_NS}
|
||||
labels:
|
||||
argocd.argoproj.io/secret-type: repository
|
||||
stringData:
|
||||
type: git
|
||||
url: "${REPO_URL}"
|
||||
sshPrivateKey: |
|
||||
$(echo "${PRIVKEY}" | sed 's/^/ /')
|
||||
EOSECRET
|
||||
|
||||
echo "Created ArgoCD repository secret ${REPO_SECRET} in ${ARGOCD_NS}"
|
||||
fi
|
||||
|
||||
echo "Done"
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
valueFrom:
|
||||
|
|
|
|||
Loading…
Reference in a new issue