1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
#!/usr/bin/env bash
# Obtains a kubeconfig for a socialweb-computer hosted tenant cluster.
#
# Sign-in is driven by socialweb-computer-kcp's oauth-signin.ts with the
# alice credential file. Credential values are read by that script, never
# by this one. The session cookie and the kubeconfig are written 0600 under
# ~/.tmp/knotless-runner-k8s/tenant.
#
# Environment:
# CREDS credential file (default ~/.aliceoa_bsky_social_source)
# ACCOUNT account prefix in CREDS (default ALICE)
# GATEWAY gateway origin (default https://k8s.socialweb.computer)
# CLUSTER cluster name, DNS label (default knotless-poc)
# SWC_REPO socialweb-computer-kcp checkout
# CHROME Chrome or Chromium binary
# FORCE_SIGNIN=1 sign in again even if a cookie file exists
# DELETE=1 delete the cluster instead and exit
set -euo pipefail
CREDS=${CREDS:-$HOME/.aliceoa_bsky_social_source}
ACCOUNT=${ACCOUNT:-ALICE}
GATEWAY=${GATEWAY:-https://k8s.socialweb.computer}
CLUSTER=${CLUSTER:-knotless-poc}
TENANT_TTL=${TENANT_TTL:-28800}
NO_CREATE=${NO_CREATE:-0}
SWC_REPO=${SWC_REPO:-/home/baptist777/src/socialweb-computer-kcp}
STATE_DIR=${STATE_DIR:-$HOME/.tmp/knotless-runner-k8s/tenant}
COOKIE=$STATE_DIR/cookies.json
KUBECONFIG=$STATE_DIR/$CLUSTER.kubeconfig.yaml
CREATE=$STATE_DIR/create.json
LIST=$STATE_DIR/clusters.json
GRANT=$STATE_DIR/kubeconfig.json
if [ ! -r "$CREDS" ]; then
echo "tenant-kubeconfig: cannot read $CREDS" >&2
exit 2
fi
mkdir -p "$STATE_DIR"
chmod 0700 "$STATE_DIR"
auth_header() {
local token
token=$(jq -r '.[] | select(.name == "swc_session") | .value' "$COOKIE" 2>/dev/null | head -1)
if [ -z "$token" ] || [ "$token" = "null" ]; then
echo "tenant-kubeconfig: no swc_session in $COOKIE; rerun with FORCE_SIGNIN=1" >&2
exit 1
fi
printf 'Cookie: swc_session=%s' "$token"
}
api() {
local path=$1 body=${2:-} out=$3
local code
code=$(curl -sS -o "$out" -w '%{http_code}' -X POST "$GATEWAY$path" \
-H 'content-type: application/json' \
-H "Origin: $GATEWAY" \
-H "$(auth_header)" \
--data "$body")
if [ "$code" != 200 ]; then
echo "tenant-kubeconfig: POST $path answered $code" >&2
jq -r '.message // .error // .' "$out" >&2 2>/dev/null || cat "$out" >&2
return 1
fi
}
if [ ! -s "$COOKIE" ] || [ "${FORCE_SIGNIN:-0}" = 1 ]; then
chrome=${CHROME:-}
if [ -z "$chrome" ]; then
for candidate in /usr/bin/google-chrome /usr/bin/chromium-browser /usr/bin/chromium; do
if [ -x "$candidate" ]; then chrome=$candidate; break; fi
done
fi
if [ -z "$chrome" ]; then
echo "tenant-kubeconfig: no Chrome or Chromium found; set CHROME" >&2
exit 2
fi
echo "tenant-kubeconfig: signing in $ACCOUNT at $GATEWAY" >&2
deno run -A --no-lock "$SWC_REPO/scripts/oauth-signin.ts" \
--creds "$CREDS" --account "$ACCOUNT" --url "$GATEWAY/" --start-api \
--chrome "$chrome" --cookie-file "$COOKIE" >/dev/null
chmod 0600 "$COOKIE"
fi
if [ "${DELETE:-0}" = 1 ]; then
api /api/clusters/delete "{\"name\":\"$CLUSTER\"}" "$STATE_DIR/delete.json"
echo "deleted tenant cluster $CLUSTER"
exit 0
fi
if [ "$NO_CREATE" != 1 ]; then
api /api/clusters/create "{\"name\":\"$CLUSTER\"}" "$CREATE"
fi
phase=$(jq -r '.phase // "Initializing"' "$CREATE" 2>/dev/null || echo Initializing)
for _ in $(seq 1 180); do
api /api/clusters/list '{}' "$LIST"
phase=$(jq -r --arg name "$CLUSTER" '.clusters[] | select(.name == $name) | .phase' "$LIST" | head -1)
case "$phase" in
Ready) break ;;
Failed) echo "tenant-kubeconfig: cluster $CLUSTER failed" >&2; exit 1 ;;
"") echo "tenant-kubeconfig: cluster $CLUSTER not listed yet" >&2 ;;
esac
sleep 5
done
if [ "$phase" != Ready ]; then
echo "tenant-kubeconfig: cluster $CLUSTER is $phase after 15 minutes" >&2
exit 1
fi
api /api/clusters/kubeconfig "{\"name\":\"$CLUSTER\",\"ttlSeconds\":$TENANT_TTL}" "$GRANT"
jq -r '.kubeconfig // empty' "$GRANT" > "$KUBECONFIG"
if [ ! -s "$KUBECONFIG" ]; then
echo "tenant-kubeconfig: gateway returned no kubeconfig" >&2
exit 1
fi
chmod 0600 "$KUBECONFIG"
printf '%s\n' "$KUBECONFIG"
