From f0443606e07479ccf7cf79905c25670807272fe0 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 8 Jul 2026 08:07:17 +0000 Subject: [PATCH] Update install instructions from guided-setup --- .../guided-setup/cloudscale-decommission.adoc | 70 +---------- .../partials/guided-setup/cloudscale.adoc | 117 +----------------- .../guided-setup/exoscale-decommission.adoc | 70 +---------- .../ROOT/partials/guided-setup/exoscale.adoc | 117 +----------------- .../guided-setup/guided-setup-alias.adoc | 1 + 5 files changed, 23 insertions(+), 352 deletions(-) diff --git a/docs/modules/ROOT/partials/guided-setup/cloudscale-decommission.adoc b/docs/modules/ROOT/partials/guided-setup/cloudscale-decommission.adoc index 1b3a491b..63bae3cf 100644 --- a/docs/modules/ROOT/partials/guided-setup/cloudscale-decommission.adoc +++ b/docs/modules/ROOT/partials/guided-setup/cloudscale-decommission.adoc @@ -27,7 +27,6 @@ *   <> *   <> *   <> -*   <> [[step-1]] === Given I have all prerequisites installed @@ -70,7 +69,7 @@ if which aws >/dev/null 2>&1 ; then { echo "✅ aws (AWS CLI) is installed."; } if which restic >/dev/null 2>&1 ; then { echo "✅ restic (Backup CLI) is installed."; } ; else { echo "❌ restic (Backup CLI) is not installed. Please install restic to proceed."; exit 1; } ; fi -if which emergency-credentials-receive >/dev/null 2>&1 ; then { echo "✅ emergency-credentials-receive (Cluster emergency access helper) is installed."; } ; else { echo "❌ emergency-credentials-receive is not installed. Please install it from https://github.com/vshn/emergency-credentials-receive ."; exit 1; } ; fi +if which kharon >/dev/null 2>&1 ; then { echo "✅ kharon (Cluster access helper) is installed."; } ; else { echo "❌ kharon is not installed. Please install it from https://github.com/vshn/kharon ."; exit 1; } ; fi if which commodore >/dev/null 2>&1 ; then { echo "✅ commodore (Project Syn) is installed."; } ; else { echo "❌ commodore (Project Syn) is not installed. Please install it with 'uv tool install syn-commodore && commodore tool install --missing' ."; exit 1; } ; fi @@ -314,11 +313,6 @@ This step ensures the emergency credentials for the cluster have been retrieved ==== Inputs -* `cluster_domain`: Domain of the cluster - the part after `api` or `apps`, respectively. - -Usually of the form `.` - - * `passbolt_passphrase`: Your password for Passbolt. This is required to access the encrypted emergency credentials. @@ -336,16 +330,15 @@ This is required to access the encrypted emergency credentials. ---- OUTPUT=$(mktemp) -# export INPUT_cluster_domain= # export INPUT_passbolt_passphrase= # export INPUT_commodore_cluster_id= set -euo pipefail -export EMR_KUBERNETES_ENDPOINT=https://api.${INPUT_cluster_domain}:6443 -export EMR_PASSPHRASE="${INPUT_passbolt_passphrase}" -emergency-credentials-receive "${INPUT_commodore_cluster_id}" - +export KHARON_PASSBOLT_PASSPHRASE="${INPUT_passbolt_passphrase}" export KUBECONFIG="em-${INPUT_commodore_cluster_id}" +kharon update +kharon emergency-credentials "${INPUT_commodore_cluster_id}" + kubectl get nodes env -i "kubeconfig_path=$(pwd)/em-${INPUT_commodore_cluster_id}" >> "$OUTPUT" @@ -1484,56 +1477,3 @@ sleep 2 ---- -[[step-28]] -=== And I remove the cluster from openshift4-clusters - -This step removes the cluster from https://git.vshn.net/vshn/openshift4-clusters - -==== Inputs - -* `commodore_cluster_id` -* `gitlab_api_token` - -==== Script - -[source,bash] ----- -OUTPUT=$(mktemp) - -# export INPUT_commodore_cluster_id= -# export INPUT_gitlab_api_token= - -set -euo pipefail -if [ -e openshift4-clusters ] -then - rm -rf openshift4-clusters -fi -git clone git@git.vshn.net:vshn/openshift4-clusters.git -pushd openshift4-clusters - -git rm -rf "${INPUT_commodore_cluster_id}" || true - -if git diff-index --quiet HEAD -then - echo "No changes, skipping commit" -else - git checkout -b "remove-${INPUT_commodore_cluster_id}" - git commit -m"Remove ${INPUT_commodore_cluster_id}" - git push origin "remove-${INPUT_commodore_cluster_id}" - - auth="PRIVATE-TOKEN: ${INPUT_gitlab_api_token}" - - response=$( curl -s -XPOST -H"$auth" -H"Content-Type: application/json" https://git.vshn.net/api/v4/projects/57660/merge_requests -d'{"source_branch":"'remove-${INPUT_commodore_cluster_id}'","target_branch":"main","title":"Remove cluster '${INPUT_commodore_cluster_id}'"}' ) - echo - echo ">>> Please review and merge the MR at $( echo "$response" | jq -r .web_url )" - echo -fi || true -popd - - -# echo "# Outputs" -# cat "$OUTPUT" -# rm -f "$OUTPUT" - ----- - diff --git a/docs/modules/ROOT/partials/guided-setup/cloudscale.adoc b/docs/modules/ROOT/partials/guided-setup/cloudscale.adoc index 35fe5900..29fbdd6a 100644 --- a/docs/modules/ROOT/partials/guided-setup/cloudscale.adoc +++ b/docs/modules/ROOT/partials/guided-setup/cloudscale.adoc @@ -35,8 +35,7 @@ *   <> * <> *   <> -*   <> -*   <> +*   <> [[step-1]] === Given I have all prerequisites installed @@ -79,7 +78,7 @@ if which aws >/dev/null 2>&1 ; then { echo "✅ aws (AWS CLI) is installed."; } if which restic >/dev/null 2>&1 ; then { echo "✅ restic (Backup CLI) is installed."; } ; else { echo "❌ restic (Backup CLI) is not installed. Please install restic to proceed."; exit 1; } ; fi -if which emergency-credentials-receive >/dev/null 2>&1 ; then { echo "✅ emergency-credentials-receive (Cluster emergency access helper) is installed."; } ; else { echo "❌ emergency-credentials-receive is not installed. Please install it from https://github.com/vshn/emergency-credentials-receive ."; exit 1; } ; fi +if which kharon >/dev/null 2>&1 ; then { echo "✅ kharon (Cluster access helper) is installed."; } ; else { echo "❌ kharon is not installed. Please install it from https://github.com/vshn/kharon ."; exit 1; } ; fi if which commodore >/dev/null 2>&1 ; then { echo "✅ commodore (Project Syn) is installed."; } ; else { echo "❌ commodore (Project Syn) is not installed. Please install it with 'uv tool install syn-commodore && commodore tool install --missing' ."; exit 1; } ; fi @@ -2256,7 +2255,6 @@ This step ensures the emergency credentials for the cluster can be retrieved. ==== Inputs * `kubeconfig_path` -* `cluster_domain` * `commodore_cluster_id` * `passbolt_passphrase`: Your password for Passbolt. @@ -2275,7 +2273,6 @@ This is required to access the encrypted emergency credentials. OUTPUT=$(mktemp) # export INPUT_kubeconfig_path= -# export INPUT_cluster_domain= # export INPUT_commodore_cluster_id= # export INPUT_passbolt_passphrase= @@ -2293,12 +2290,12 @@ do echo -n . done -export EMR_KUBERNETES_ENDPOINT=https://api.${INPUT_cluster_domain}:6443 -export EMR_PASSPHRASE="${INPUT_passbolt_passphrase}" -emergency-credentials-receive "${INPUT_commodore_cluster_id}" +export KHARON_PASSBOLT_PASSPHRASE="${INPUT_passbolt_passphrase}" +export KUBECONFIG="em-${INPUT_commodore_cluster_id}" +kharon update +kharon emergency-credentials "${INPUT_commodore_cluster_id}" yq -i e '.clusters[0].cluster.insecure-skip-tls-verify = true' "em-${INPUT_commodore_cluster_id}" -export KUBECONFIG="em-${INPUT_commodore_cluster_id}" kubectl get nodes oc whoami | grep system:serviceaccount:appuio-emergency-credentials-controller: || exit 1 @@ -2630,108 +2627,6 @@ mc rb "${INPUT_commodore_cluster_id}/${INPUT_commodore_cluster_id}-bootstrap-ign ---- [[step-36]] -=== And I add the cluster to openshift4-clusters - -This step adds the cluster to https://git.vshn.net/vshn/openshift4-clusters - -==== Inputs - -* `commodore_cluster_id` -* `kubeconfig_path` -* `jumphost_fqdn`: FQDN of the jumphost used to connect to this cluster, if any. - -If no jumphost is used, enter "NONE". - - -* `socks5_port`: SOCKS5 port number to use for this cluster, of the form 120XX. -If the cluster shares a proxy jumphost with another cluster, use the same port. -If the cluster uses a brand new jumphost, choose a new unique port. - -If the cluster does not use a proxy jumphost, enter "NONE". - - - -==== Script - -[source,bash] ----- -OUTPUT=$(mktemp) - -# export INPUT_commodore_cluster_id= -# export INPUT_kubeconfig_path= -# export INPUT_jumphost_fqdn= -# export INPUT_socks5_port= - -set -euo pipefail -if [ -e openshift4-clusters ] -then - rm -rf openshift4-clusters -fi -git clone git@git.vshn.net:vshn/openshift4-clusters.git -pushd openshift4-clusters - -if [[ -d "${INPUT_commodore_cluster_id}" ]] -then - echo "Cluster entry already exists - not touching that!" - exit 0 -else - API_URL=$(yq e '.clusters[0].cluster.server' "${INPUT_kubeconfig_path}") - - mkdir -p "${INPUT_commodore_cluster_id}" - pushd "${INPUT_commodore_cluster_id}" - ln -s ../base_envrc .envrc - cat >.connection_facts <> "${INPUT_commodore_cluster_id}/.connection_facts" <> *   <> *   <> -*   <> [[step-1]] === Given I have all prerequisites installed @@ -76,7 +75,7 @@ if which virt-edit >/dev/null 2>&1 ; then { echo "✅ virt-edit (VM image editin if which cpio >/dev/null 2>&1 ; then { echo "✅ cpio (file archiving) is installed."; } ; else { echo "❌ cpio (file archiving) is not installed. Please install cpio to proceed."; exit 1; } ; fi -if which emergency-credentials-receive >/dev/null 2>&1 ; then { echo "✅ emergency-credentials-receive (Cluster emergency access helper) is installed."; } ; else { echo "❌ emergency-credentials-receive is not installed. Please install it from https://github.com/vshn/emergency-credentials-receive ."; exit 1; } ; fi +if which kharon >/dev/null 2>&1 ; then { echo "✅ kharon (Cluster access helper) is installed."; } ; else { echo "❌ kharon is not installed. Please install it from https://github.com/vshn/kharon ."; exit 1; } ; fi echo "✅ All prerequisites are met." @@ -319,11 +318,6 @@ This step ensures the emergency credentials for the cluster have been retrieved ==== Inputs -* `cluster_domain`: Domain of the cluster - the part after `api` or `apps`, respectively. - -Usually of the form `.` - - * `passbolt_passphrase`: Your password for Passbolt. This is required to access the encrypted emergency credentials. @@ -341,16 +335,15 @@ This is required to access the encrypted emergency credentials. ---- OUTPUT=$(mktemp) -# export INPUT_cluster_domain= # export INPUT_passbolt_passphrase= # export INPUT_commodore_cluster_id= set -euo pipefail -export EMR_KUBERNETES_ENDPOINT=https://api.${INPUT_cluster_domain}:6443 -export EMR_PASSPHRASE="${INPUT_passbolt_passphrase}" -emergency-credentials-receive "${INPUT_commodore_cluster_id}" - +export KHARON_PASSBOLT_PASSPHRASE="${INPUT_passbolt_passphrase}" export KUBECONFIG="em-${INPUT_commodore_cluster_id}" +kharon update +kharon emergency-credentials "${INPUT_commodore_cluster_id}" + kubectl get nodes env -i "kubeconfig_path=$(pwd)/em-${INPUT_commodore_cluster_id}" >> "$OUTPUT" @@ -1329,56 +1322,3 @@ sleep 2 ---- -[[step-24]] -=== And I remove the cluster from openshift4-clusters - -This step removes the cluster from https://git.vshn.net/vshn/openshift4-clusters - -==== Inputs - -* `commodore_cluster_id` -* `gitlab_api_token` - -==== Script - -[source,bash] ----- -OUTPUT=$(mktemp) - -# export INPUT_commodore_cluster_id= -# export INPUT_gitlab_api_token= - -set -euo pipefail -if [ -e openshift4-clusters ] -then - rm -rf openshift4-clusters -fi -git clone git@git.vshn.net:vshn/openshift4-clusters.git -pushd openshift4-clusters - -git rm -rf "${INPUT_commodore_cluster_id}" || true - -if git diff-index --quiet HEAD -then - echo "No changes, skipping commit" -else - git checkout -b "remove-${INPUT_commodore_cluster_id}" - git commit -m"Remove ${INPUT_commodore_cluster_id}" - git push origin "remove-${INPUT_commodore_cluster_id}" - - auth="PRIVATE-TOKEN: ${INPUT_gitlab_api_token}" - - response=$( curl -s -XPOST -H"$auth" -H"Content-Type: application/json" https://git.vshn.net/api/v4/projects/57660/merge_requests -d'{"source_branch":"'remove-${INPUT_commodore_cluster_id}'","target_branch":"main","title":"Remove cluster '${INPUT_commodore_cluster_id}'"}' ) - echo - echo ">>> Please review and merge the MR at $( echo "$response" | jq -r .web_url )" - echo -fi || true -popd - - -# echo "# Outputs" -# cat "$OUTPUT" -# rm -f "$OUTPUT" - ----- - diff --git a/docs/modules/ROOT/partials/guided-setup/exoscale.adoc b/docs/modules/ROOT/partials/guided-setup/exoscale.adoc index f2e9c88d..b34849d4 100644 --- a/docs/modules/ROOT/partials/guided-setup/exoscale.adoc +++ b/docs/modules/ROOT/partials/guided-setup/exoscale.adoc @@ -39,8 +39,7 @@ *   <> * <> *   <> -*   <> -*   <> +*   <> [[step-1]] === Given I have all prerequisites installed @@ -93,7 +92,7 @@ if which virt-edit >/dev/null 2>&1 ; then { echo "✅ virt-edit (VM image editin if which cpio >/dev/null 2>&1 ; then { echo "✅ cpio (file archiving) is installed."; } ; else { echo "❌ cpio (file archiving) is not installed. Please install cpio to proceed."; exit 1; } ; fi -if which emergency-credentials-receive >/dev/null 2>&1 ; then { echo "✅ emergency-credentials-receive (Cluster emergency access helper) is installed."; } ; else { echo "❌ emergency-credentials-receive is not installed. Please install it from https://github.com/vshn/emergency-credentials-receive ."; exit 1; } ; fi +if which kharon >/dev/null 2>&1 ; then { echo "✅ kharon (Cluster access helper) is installed."; } ; else { echo "❌ kharon is not installed. Please install it from https://github.com/vshn/kharon ."; exit 1; } ; fi echo "✅ All prerequisites are met." @@ -2451,7 +2450,6 @@ This step ensures the emergency credentials for the cluster can be retrieved. ==== Inputs * `kubeconfig_path` -* `cluster_domain` * `commodore_cluster_id` * `passbolt_passphrase`: Your password for Passbolt. @@ -2470,7 +2468,6 @@ This is required to access the encrypted emergency credentials. OUTPUT=$(mktemp) # export INPUT_kubeconfig_path= -# export INPUT_cluster_domain= # export INPUT_commodore_cluster_id= # export INPUT_passbolt_passphrase= @@ -2488,12 +2485,12 @@ do echo -n . done -export EMR_KUBERNETES_ENDPOINT=https://api.${INPUT_cluster_domain}:6443 -export EMR_PASSPHRASE="${INPUT_passbolt_passphrase}" -emergency-credentials-receive "${INPUT_commodore_cluster_id}" +export KHARON_PASSBOLT_PASSPHRASE="${INPUT_passbolt_passphrase}" +export KUBECONFIG="em-${INPUT_commodore_cluster_id}" +kharon update +kharon emergency-credentials "${INPUT_commodore_cluster_id}" yq -i e '.clusters[0].cluster.insecure-skip-tls-verify = true' "em-${INPUT_commodore_cluster_id}" -export KUBECONFIG="em-${INPUT_commodore_cluster_id}" kubectl get nodes oc whoami | grep system:serviceaccount:appuio-emergency-credentials-controller: || exit 1 @@ -2759,108 +2756,6 @@ exo storage rb -r -f "sos://${INPUT_commodore_cluster_id}-bootstrap" ---- [[step-40]] -=== And I add the cluster to openshift4-clusters - -This step adds the cluster to https://git.vshn.net/vshn/openshift4-clusters - -==== Inputs - -* `commodore_cluster_id` -* `kubeconfig_path` -* `jumphost_fqdn`: FQDN of the jumphost used to connect to this cluster, if any. - -If no jumphost is used, enter "NONE". - - -* `socks5_port`: SOCKS5 port number to use for this cluster, of the form 120XX. -If the cluster shares a proxy jumphost with another cluster, use the same port. -If the cluster uses a brand new jumphost, choose a new unique port. - -If the cluster does not use a proxy jumphost, enter "NONE". - - - -==== Script - -[source,bash] ----- -OUTPUT=$(mktemp) - -# export INPUT_commodore_cluster_id= -# export INPUT_kubeconfig_path= -# export INPUT_jumphost_fqdn= -# export INPUT_socks5_port= - -set -euo pipefail -if [ -e openshift4-clusters ] -then - rm -rf openshift4-clusters -fi -git clone git@git.vshn.net:vshn/openshift4-clusters.git -pushd openshift4-clusters - -if [[ -d "${INPUT_commodore_cluster_id}" ]] -then - echo "Cluster entry already exists - not touching that!" - exit 0 -else - API_URL=$(yq e '.clusters[0].cluster.server' "${INPUT_kubeconfig_path}") - - mkdir -p "${INPUT_commodore_cluster_id}" - pushd "${INPUT_commodore_cluster_id}" - ln -s ../base_envrc .envrc - cat >.connection_facts <> "${INPUT_commodore_cluster_id}/.connection_facts" <