recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix: provision v6 keys before a v5 to v6 upgrade
continuous-integration/drone/push Build is failing
Details

Browse Source
This commit is contained in:
notplants
2026-11-02 18:29:12 +00:00
parent c7545505f2
commit 53f204fc8c
1 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/lasuite-docs/install_steps.sh
+10 -11
View File
@@ -21,23 +21,22 @@ set -euo pipefail
ENV_PATH="${CCCI_APP_ENV:?missing}" ENV_PATH="${CCCI_APP_ENV:?missing}"
# The v6 release requires two RSA PEM secrets with generate=false. CI must # The v6 release requires two RSA PEM secrets with generate=false. CI must
# supply those operator-managed keys for the published base recipe; a PR head # supply those operator-managed keys before deploy, including when the base
# that provides its own keys still runs without these secrets after upgrade. # is v5 and the upgrade head is v6. A PR head with its own key sidecar ignores
RECIPE_DIR="${ABRA_DIR:-$HOME/.abra}/recipes/lasuite-docs" # these secrets after upgrade.
if grep -qE '^[[:space:]]{2}(jwt_pk|yhub_jwt_pk):' "$RECIPE_DIR/compose.yml"; then STACK_NAME="${CCCI_APP_DOMAIN//./_}"
STACK_NAME="${CCCI_APP_DOMAIN//./_}" for SECRET_NAME in jwt_pk yhub_jwt_pk; do
for SECRET_NAME in jwt_pk yhub_jwt_pk; do ENV_NAME="SECRET_${SECRET_NAME^^}_VERSION"
ENV_NAME="SECRET_${SECRET_NAME^^}_VERSION" VERSION=$(sed -n "s/^${ENV_NAME}=\([^ #]*\).*/\1/p" "$ENV_PATH" | tail -1)
VERSION=$(sed -n "s/^${ENV_NAME}=\([^ #]*\).*/\1/p" "$ENV_PATH" | tail -1) if [ -n "$VERSION" ]; then
: "${VERSION:?missing $ENV_NAME}"
DOCKER_SECRET="${STACK_NAME}_${SECRET_NAME}_${VERSION}" DOCKER_SECRET="${STACK_NAME}_${SECRET_NAME}_${VERSION}"
if ! docker secret inspect "$DOCKER_SECRET" >/dev/null 2>&1; then if ! docker secret inspect "$DOCKER_SECRET" >/dev/null 2>&1; then
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 2>/dev/null \ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 2>/dev/null \
| docker secret create "$DOCKER_SECRET" - >/dev/null | docker secret create "$DOCKER_SECRET" - >/dev/null
echo " install_steps: supplied ${SECRET_NAME} for the published base recipe" echo " install_steps: supplied ${SECRET_NAME} for the published base recipe"
fi fi
done fi
fi done
# No deps file / no keycloak entry → install-time provisioning failed or was skipped. NO-OP so the # No deps file / no keycloak entry → install-time provisioning failed or was skipped. NO-OP so the
# recipe still boots; the @requires_deps OIDC custom test then SKIPs and F2-11 flips the run RED. # recipe still boots; the @requires_deps OIDC custom test then SKIPs and F2-11 flips the run RED.