Add platform infrastructure configuration
This commit is contained in:
donghyeon-ka
@@ -0,0 +1,569 @@
|
||||
#!/usr/bin/env bash
|
||||
# Source-only helpers for k3s Secret-encryption validation. They deliberately
|
||||
# return classifications instead of printing service, config, or key material.
|
||||
|
||||
_k3s_status_schema_valid() {
|
||||
jq -e -s '
|
||||
length == 1 and
|
||||
(.[0] | type == "object" and
|
||||
(.stage | type == "string") and
|
||||
(.activekey | type == "string") and
|
||||
((has("enable") | not) or (.enable | type == "boolean")) and
|
||||
((has("hashmatch") | not) or (.hashmatch | type == "boolean")) and
|
||||
((has("hasherror") | not) or (.hasherror | type == "string")) and
|
||||
((has("inactivekeys") | not) or (.inactivekeys | type == "array")))
|
||||
' >/dev/null 2>&1 <<<"$1"
|
||||
}
|
||||
|
||||
classify_encryption_status() {
|
||||
local status_json="$1"
|
||||
|
||||
if ! _k3s_status_schema_valid "$status_json"; then
|
||||
printf 'invalid\n'
|
||||
return 0
|
||||
fi
|
||||
|
||||
if jq -e '
|
||||
(has("enable") | not) and .stage == "" and .activekey == "" and
|
||||
(has("hasherror") | not)
|
||||
' >/dev/null <<<"$status_json"; then
|
||||
printf 'disabled_no_config\n'
|
||||
return 0
|
||||
fi
|
||||
|
||||
if jq -e '
|
||||
has("enable") and
|
||||
((.hashmatch != true) or (has("hasherror") and .hasherror != ""))
|
||||
' >/dev/null <<<"$status_json"; then
|
||||
printf 'hash_mismatch\n'
|
||||
return 0
|
||||
fi
|
||||
|
||||
if jq -e '
|
||||
.enable == false and .stage == "start" and .activekey == "" and
|
||||
.hashmatch == true and ((has("inactivekeys") | not) or (.inactivekeys | length == 0))
|
||||
' >/dev/null <<<"$status_json"; then
|
||||
printf 'transition_start\n'
|
||||
return 0
|
||||
fi
|
||||
|
||||
if jq -e '
|
||||
.enable == true and (.activekey | length > 0) and .hashmatch == true and
|
||||
(.stage == "start" or .stage == "reencrypt_finished")
|
||||
' >/dev/null <<<"$status_json"; then
|
||||
printf 'enabled_stable\n'
|
||||
return 0
|
||||
fi
|
||||
|
||||
if jq -e '.enable == true and .hashmatch == true' >/dev/null <<<"$status_json"; then
|
||||
printf 'unsafe_transition\n'
|
||||
else
|
||||
printf 'invalid\n'
|
||||
fi
|
||||
}
|
||||
|
||||
classify_encryption_provider() {
|
||||
local status_json="$1"
|
||||
local active_key
|
||||
|
||||
if ! _k3s_status_schema_valid "$status_json"; then
|
||||
printf 'invalid\n'
|
||||
return 0
|
||||
fi
|
||||
active_key="$(jq -r '.activekey' <<<"$status_json")"
|
||||
case "$active_key" in
|
||||
'AES-CBC '*)
|
||||
[[ "${active_key#AES-CBC }" != "$active_key" && -n "${active_key#AES-CBC }" ]] && printf 'aescbc\n' || printf 'invalid\n'
|
||||
;;
|
||||
'XSalsa20-POLY1305 '*)
|
||||
[[ "${active_key#XSalsa20-POLY1305 }" != "$active_key" && -n "${active_key#XSalsa20-POLY1305 }" ]] && printf 'secretbox\n' || printf 'invalid\n'
|
||||
;;
|
||||
*)
|
||||
printf 'invalid\n'
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
version_supports_late_enable() {
|
||||
local version="$1"
|
||||
local minor patch
|
||||
|
||||
[[ "$version" =~ ^v1\.([0-9]+)\.([0-9]+)\+k3s[0-9]+$ ]] || return 1
|
||||
minor="${BASH_REMATCH[1]}"
|
||||
patch="${BASH_REMATCH[2]}"
|
||||
case "$minor" in
|
||||
33) (( patch >= 10 )) ;;
|
||||
34) (( patch >= 6 )) ;;
|
||||
35) (( patch >= 3 )) ;;
|
||||
*) (( minor >= 36 )) ;;
|
||||
esac
|
||||
}
|
||||
|
||||
require_exact_encryption_state() {
|
||||
local expected="$1"
|
||||
local status_json="$2"
|
||||
[[ "$(classify_encryption_status "$status_json")" == "$expected" ]]
|
||||
}
|
||||
|
||||
_k3s_secure_regular_file() {
|
||||
local path="$1"
|
||||
local metadata
|
||||
|
||||
[[ -f "$path" && ! -L "$path" ]] || return 1
|
||||
metadata="$(stat --format='%u:%a:%F' -- "$path" 2>/dev/null)" || return 1
|
||||
[[ "$metadata" == '0:600:regular file' ]]
|
||||
}
|
||||
|
||||
_k3s_read_file() {
|
||||
local path="$1"
|
||||
[[ -f "$path" && ! -L "$path" ]] || return 1
|
||||
command cat -- "$path"
|
||||
}
|
||||
|
||||
_k3s_list_yaml_files() {
|
||||
local config="$1" file
|
||||
[[ -f "$config" && ! -L "$config" ]] && printf '%s\n' "$config"
|
||||
if [[ -d "${config}.d" && ! -L "${config}.d" ]]; then
|
||||
while IFS= read -r file; do printf '%s\n' "$file"; done < <(
|
||||
find "${config}.d" -maxdepth 1 -type f -name '*.yaml' -print | sort
|
||||
)
|
||||
fi
|
||||
}
|
||||
|
||||
verify_local_encryption_config_integrity() {
|
||||
local config_path="$1"
|
||||
local state_path="$2"
|
||||
local annotation_value="$3"
|
||||
local status_stage="$4"
|
||||
local state_value config_hash config_metadata state_metadata
|
||||
|
||||
if ! _k3s_secure_regular_file "$config_path" || ! _k3s_secure_regular_file "$state_path"; then
|
||||
printf 'mismatch\n'
|
||||
return 1
|
||||
fi
|
||||
[[ "$status_stage" =~ ^[a-z_]+$ ]] || {
|
||||
printf 'mismatch\n'
|
||||
return 1
|
||||
}
|
||||
state_value="$(<"$state_path")"
|
||||
[[ "$(wc -c <"$state_path" | tr -d '[:space:]')" == "${#state_value}" ]] || {
|
||||
printf 'mismatch\n'
|
||||
return 1
|
||||
}
|
||||
[[ "$state_value" =~ ^([a-z_]+)-([0-9a-f]{64})$ ]] || {
|
||||
printf 'mismatch\n'
|
||||
return 1
|
||||
}
|
||||
config_hash="$(sha256sum -- "$config_path" | awk '{print $1}')" || {
|
||||
printf 'mismatch\n'
|
||||
return 1
|
||||
}
|
||||
config_metadata="$(stat --format='%u:%a:%F' -- "$config_path" 2>/dev/null)" || config_metadata=''
|
||||
state_metadata="$(stat --format='%u:%a:%F' -- "$state_path" 2>/dev/null)" || state_metadata=''
|
||||
verify_local_encryption_config_integrity_evidence \
|
||||
"$config_metadata" "$state_metadata" "$config_hash" "$state_value" \
|
||||
"$annotation_value" "$status_stage"
|
||||
}
|
||||
|
||||
verify_local_encryption_config_integrity_evidence() {
|
||||
local config_metadata="$1" state_metadata="$2" config_hash="$3"
|
||||
local state_value="$4" annotation_value="$5" status_stage="$6" expected
|
||||
|
||||
if [[ "$config_metadata" != '0:600:regular file' ||
|
||||
"$state_metadata" != '0:600:regular file' ||
|
||||
! "$config_hash" =~ ^[0-9a-f]{64}$ ||
|
||||
! "$status_stage" =~ ^[a-z_]+$ ||
|
||||
! "$state_value" =~ ^[a-z_]+-[0-9a-f]{64}$ ]]; then
|
||||
printf 'mismatch\n'
|
||||
return 1
|
||||
fi
|
||||
expected="${status_stage}-${config_hash}"
|
||||
if [[ "$state_value" == "$expected" && "$annotation_value" == "$expected" ]]; then
|
||||
printf 'match\n'
|
||||
return 0
|
||||
fi
|
||||
printf 'mismatch\n'
|
||||
return 1
|
||||
}
|
||||
|
||||
_k3s_systemctl_show() {
|
||||
systemctl show k3s \
|
||||
--property=ExecStart \
|
||||
--property=Environment \
|
||||
--property=EnvironmentFiles 2>/dev/null
|
||||
}
|
||||
|
||||
_k3s_systemd_dropin_lines() {
|
||||
local dropin_dir="${K3S_SYSTEMD_DROPIN_DIR:-/etc/systemd/system/k3s.service.d}"
|
||||
local file
|
||||
|
||||
[[ -e "$dropin_dir" ]] || return 0
|
||||
[[ -d "$dropin_dir" && ! -L "$dropin_dir" ]] || return 1
|
||||
while IFS= read -r file; do
|
||||
[[ -r "$file" && ! -L "$file" ]] || return 1
|
||||
sed -n -E '/^[[:space:]]*(Environment|EnvironmentFile)=/p' "$file"
|
||||
done < <(find "$dropin_dir" -maxdepth 1 -type f -name '*.conf' -print | sort)
|
||||
}
|
||||
|
||||
_k3s_is_dynamic_value() {
|
||||
local value="$1"
|
||||
[[ "$value" == *'$'* || "$value" == *'`'* || "$value" == *'\\'* ]]
|
||||
}
|
||||
|
||||
# Strict, non-evaluating readers for systemd's already-resolved show output and
|
||||
# EnvironmentFile syntax. Unsupported quoting, resets, or expansions fail
|
||||
# closed instead of being interpreted by a shell.
|
||||
_k3s_plain_value() {
|
||||
local value="$1" quote="'"
|
||||
[[ -n "$value" && "$value" != *' '* && "$value" != *'"'* && "$value" != *"$quote"* && "$value" != *'$'* && "$value" != *'`'* && "$value" != *'\\'* ]]
|
||||
}
|
||||
|
||||
_k3s_safe_payload() {
|
||||
local value="$1" quote="'"
|
||||
[[ -n "$value" && "$value" != *'"'* && "$value" != *"$quote"* && "$value" != *'$'* && "$value" != *'`'* && "$value" != *'\\'* ]]
|
||||
}
|
||||
|
||||
_k3s_effective_service_show() {
|
||||
local show dropins line has_environment=false
|
||||
show="$(_k3s_systemctl_show)" || return 2
|
||||
while IFS= read -r line; do
|
||||
[[ "$line" == Environment=* || "$line" == EnvironmentFiles=* ]] || continue
|
||||
[[ -n "${line#*=}" ]] && has_environment=true
|
||||
done <<<"$show"
|
||||
if ! "$has_environment"; then
|
||||
dropins="$(_k3s_systemd_dropin_lines)" || return 2
|
||||
[[ -z "$dropins" ]] || show+=$'\n'"$dropins"
|
||||
fi
|
||||
printf '%s\n' "$show"
|
||||
}
|
||||
|
||||
_k3s_envfile_values() {
|
||||
local file="$1" key="$2" line trimmed name value text char quote='' content
|
||||
local in_record=false target_record=false continued=false
|
||||
local index length
|
||||
content="$(_k3s_read_file "$file")" || return 2
|
||||
while IFS= read -r line || [[ -n "$line" ]]; do
|
||||
if ! "$in_record"; then
|
||||
trimmed="${line#"${line%%[![:space:]]*}"}"
|
||||
[[ -z "$trimmed" || "$trimmed" == \#* || "$trimmed" == \;* ]] && continue
|
||||
[[ "$trimmed" == *=* ]] || { [[ "$trimmed" == "$key" ]] && return 2; continue; }
|
||||
name="${trimmed%%=*}"
|
||||
value="${trimmed#*=}"
|
||||
target_record=false
|
||||
[[ "$name" == "$key" ]] && target_record=true
|
||||
text="$value"
|
||||
quote=''
|
||||
else
|
||||
text="$line"
|
||||
fi
|
||||
|
||||
continued=false
|
||||
length=${#text}
|
||||
for ((index=0; index<length; index++)); do
|
||||
char="${text:index:1}"
|
||||
case "$quote" in
|
||||
"'")
|
||||
[[ "$char" == "'" ]] && quote=''
|
||||
;;
|
||||
'"')
|
||||
if [[ "$char" == "\\" ]]; then
|
||||
if (( index + 1 < length )); then ((index++)); else continued=true; fi
|
||||
elif [[ "$char" == '"' ]]; then
|
||||
quote=''
|
||||
fi
|
||||
;;
|
||||
'')
|
||||
if [[ "$char" == "\\" ]]; then
|
||||
if (( index + 1 < length )); then ((index++)); else continued=true; fi
|
||||
elif [[ "$char" == "'" || "$char" == '"' ]]; then
|
||||
quote="$char"
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ -n "$quote" ]] || "$continued"; then
|
||||
in_record=true
|
||||
continue
|
||||
fi
|
||||
|
||||
if "$target_record"; then
|
||||
_k3s_plain_value "$value" || return 2
|
||||
printf '%s\n' "$value"
|
||||
fi
|
||||
in_record=false
|
||||
target_record=false
|
||||
done <<<"$content"
|
||||
"$in_record" && return 2
|
||||
return 0
|
||||
}
|
||||
|
||||
_k3s_service_env_values() {
|
||||
local show="$1" key="$2" line payload token name value candidate file result policy
|
||||
local index
|
||||
local -a words=()
|
||||
candidate=''
|
||||
while IFS= read -r line; do
|
||||
[[ "$line" == Environment=* ]] || continue
|
||||
payload="${line#Environment=}"
|
||||
[[ -n "$payload" ]] || continue
|
||||
_k3s_safe_payload "$payload" || return 2
|
||||
for token in $payload; do
|
||||
[[ "$token" == *=* ]] || return 2
|
||||
name="${token%%=*}"; value="${token#*=}"
|
||||
[[ "$name" == "$key" ]] || continue
|
||||
[[ -n "$value" ]] || return 2
|
||||
candidate="$value"
|
||||
done
|
||||
done <<<"$show"
|
||||
while IFS= read -r line; do
|
||||
[[ "$line" == EnvironmentFiles=* ]] || continue
|
||||
payload="${line#EnvironmentFiles=}"
|
||||
[[ -n "$payload" ]] || continue
|
||||
_k3s_safe_payload "$payload" || return 2
|
||||
read -r -a words <<<"$payload"
|
||||
for ((index=0; index<${#words[@]};)); do
|
||||
file="${words[index]}"; ((index++))
|
||||
policy=no
|
||||
if (( index < ${#words[@]} )) && [[ "${words[index]}" =~ ^\(ignore_errors=(yes|no)\)$ ]]; then
|
||||
policy="${BASH_REMATCH[1]}"; ((index++))
|
||||
fi
|
||||
[[ "$file" != \(* ]] || return 2
|
||||
file="${file#-}"
|
||||
if [[ ! -r "$file" || -L "$file" ]]; then
|
||||
[[ "$policy" == yes ]] && continue
|
||||
return 2
|
||||
fi
|
||||
result="$(_k3s_envfile_values "$file" "$key")" || return $?
|
||||
while IFS= read -r token; do [[ -n "$token" ]] && candidate="$token"; done <<<"$result"
|
||||
done
|
||||
done <<<"$show"
|
||||
[[ -n "$candidate" ]] && printf '%s\n' "$candidate"
|
||||
return 0
|
||||
}
|
||||
|
||||
_k3s_cli_values() {
|
||||
local show="$1" option="$2" line payload option_value exec_count=0
|
||||
local serialized_path serialized_argv serialized_body serialized_tail
|
||||
local serialized_prefix='{ path=' serialized_separator=' ; argv[]='
|
||||
local serialized_short_suffix=' ; ignore_errors=no ; }'
|
||||
local serialized_full_marker=' ; ignore_errors=no ; start_time='
|
||||
local serialized_full_pattern='^ ; ignore_errors=no ; start_time=\[[^][;={}]+\] ; stop_time=\[[^][;={}]+\] ; pid=[0-9]+ ; code=(\(null\)|exited|killed|dumped) ; status=[0-9]+/[0-9]+ \}$'
|
||||
local -a words=()
|
||||
local index token
|
||||
while IFS= read -r line; do
|
||||
[[ "$line" == ExecStart=* ]] || continue
|
||||
((exec_count+=1))
|
||||
payload="${line#ExecStart=}"
|
||||
[[ -n "$payload" ]] || return 2
|
||||
_k3s_safe_payload "$payload" || return 2
|
||||
if [[ "$payload" == "$serialized_prefix"* ]]; then
|
||||
serialized_body="${payload#"$serialized_prefix"}"
|
||||
[[ "$serialized_body" == *"$serialized_separator"* ]] || return 2
|
||||
serialized_path="${serialized_body%%"$serialized_separator"*}"
|
||||
serialized_body="${serialized_body#"${serialized_path}${serialized_separator}"}"
|
||||
if [[ "$serialized_body" == *"$serialized_short_suffix" ]]; then
|
||||
serialized_argv="${serialized_body%"$serialized_short_suffix"}"
|
||||
serialized_tail="$serialized_short_suffix"
|
||||
elif [[ "$serialized_body" == *"$serialized_full_marker"* ]]; then
|
||||
serialized_argv="${serialized_body%%"$serialized_full_marker"*}"
|
||||
serialized_tail="${serialized_body#"$serialized_argv"}"
|
||||
[[ "$serialized_tail" =~ $serialized_full_pattern ]] || return 2
|
||||
else
|
||||
return 2
|
||||
fi
|
||||
[[ "$payload" == "${serialized_prefix}${serialized_path}${serialized_separator}${serialized_argv}${serialized_tail}" ]] || return 2
|
||||
[[ "$serialized_path" == /usr/local/bin/k3s ]] || return 2
|
||||
[[ -n "$serialized_argv" && "$serialized_argv" != *'argv[]='* && "$serialized_argv" != *' ; '* && "$serialized_argv" != *'{'* && "$serialized_argv" != *'}'* ]] || return 2
|
||||
payload="$serialized_argv"
|
||||
elif [[ "$payload" == *'argv[]='* || "$payload" == *'path='* || "$payload" == *'ignore_errors='* || "$payload" == *'{'* || "$payload" == *'}'* || "$payload" == *';'* ]]; then
|
||||
return 2
|
||||
fi
|
||||
read -r -a words <<<"$payload"
|
||||
(( ${#words[@]} >= 2 )) || return 2
|
||||
[[ "${words[0]##*/}" == k3s && "${words[1]}" == server ]] || return 2
|
||||
for ((index=0; index<${#words[@]}; index++)); do
|
||||
token="${words[index]}"
|
||||
case "$token" in
|
||||
"${option}" )
|
||||
if [[ "$option" == '--secrets-encryption' ]]; then printf 'true\n';
|
||||
elif (( index + 1 < ${#words[@]} )); then option_value="${words[index + 1]}"; _k3s_plain_value "$option_value" || return 2; printf '%s\n' "$option_value"; else return 2; fi
|
||||
;;
|
||||
"${option}"=*) option_value="${token#*=}"; _k3s_plain_value "$option_value" || return 2; printf '%s\n' "$option_value" ;;
|
||||
esac
|
||||
done
|
||||
done <<<"$show"
|
||||
(( exec_count == 1 )) || return 2
|
||||
return 0
|
||||
}
|
||||
|
||||
_k3s_unique_value() {
|
||||
local values="$1" value count=0 chosen=''
|
||||
while IFS= read -r value; do
|
||||
[[ -n "$value" ]] || continue
|
||||
((count++)); chosen="$value"
|
||||
done <<<"$values"
|
||||
(( count <= 1 )) || return 2
|
||||
[[ -n "$chosen" ]] && printf '%s\n' "$chosen"
|
||||
return 0
|
||||
}
|
||||
|
||||
_k3s_selected_config() {
|
||||
local show="$1" cli env default_root raw
|
||||
raw="$(_k3s_cli_values "$show" --config)" || return 2
|
||||
cli="$(_k3s_unique_value "$raw")" || return 2
|
||||
raw="$(_k3s_service_env_values "$show" K3S_CONFIG_FILE)" || return 2
|
||||
env="$(_k3s_unique_value "$raw")" || return 2
|
||||
if _k3s_is_dynamic_value "$cli" || _k3s_is_dynamic_value "$env"; then
|
||||
return 2
|
||||
fi
|
||||
default_root="${K3S_CONFIG_DIR:-/etc/rancher/k3s}"
|
||||
if [[ -n "$cli" ]]; then printf '%s\n' "$cli"; elif [[ -n "$env" ]]; then printf '%s\n' "$env"; else printf '%s\n' "${default_root}/config.yaml"; fi
|
||||
}
|
||||
|
||||
_k3s_yaml_value() {
|
||||
local config="$1" key="$2" file line raw value selected='' selected_file='' content files
|
||||
files="$(_k3s_list_yaml_files "$config")" || return 2
|
||||
while IFS= read -r file; do
|
||||
[[ -n "$file" ]] || continue
|
||||
content="$(_k3s_read_file "$file")" || return 2
|
||||
raw=''
|
||||
while IFS= read -r line || [[ -n "$line" ]]; do
|
||||
line="${line#"${line%%[![:space:]]*}"}"
|
||||
[[ "$line" == "${key}:"* ]] || continue
|
||||
value="${line#"${key}:"}"
|
||||
value="$(sed -E 's/[[:space:]]+#.*$//; s/^[[:space:]]+//; s/[[:space:]]+$//;' <<<"$value")"
|
||||
_k3s_plain_value "$value" || return 2
|
||||
[[ -z "$raw" || "$raw" == "$value" ]] || return 2
|
||||
raw="$value"
|
||||
done <<<"$content"
|
||||
if [[ -n "$raw" ]]; then selected="$raw"; selected_file="$file"; fi
|
||||
done <<<"$files"
|
||||
[[ -n "$selected" ]] && printf '%s|%s\n' "$selected_file" "$selected"
|
||||
return 0
|
||||
}
|
||||
|
||||
_k3s_resolve_key() {
|
||||
local show="$1" cli_option="$2" env_key="$3" yaml_key="$4" cli env config yaml raw
|
||||
raw="$(_k3s_cli_values "$show" "$cli_option")" || return 2
|
||||
cli="$(_k3s_unique_value "$raw")" || return 2
|
||||
[[ -z "$cli" ]] || { printf 'command-line|%s\n' "$cli"; return 0; }
|
||||
raw="$(_k3s_service_env_values "$show" "$env_key")" || return 2
|
||||
env="$(_k3s_unique_value "$raw")" || return 2
|
||||
[[ -z "$env" ]] || { printf 'environment|%s\n' "$env"; return 0; }
|
||||
config="$(_k3s_selected_config "$show")" || return 2
|
||||
yaml="$(_k3s_yaml_value "$config" "$yaml_key")" || return 2
|
||||
[[ -z "$yaml" ]] || printf '%s\n' "$yaml"
|
||||
}
|
||||
|
||||
detect_effective_encryption_config_owner() {
|
||||
local show enable provider enable_source enable_value provider_source provider_value
|
||||
show="$(_k3s_effective_service_show)" || { printf 'ambiguous\n'; return 0; }
|
||||
enable="$(_k3s_resolve_key "$show" --secrets-encryption K3S_SECRETS_ENCRYPTION secrets-encryption)" || { printf 'ambiguous\n'; return 0; }
|
||||
provider="$(_k3s_resolve_key "$show" --secrets-encryption-provider K3S_SECRETS_ENCRYPTION_PROVIDER secrets-encryption-provider)" || { printf 'ambiguous\n'; return 0; }
|
||||
[[ -n "$enable" ]] || { printf 'ambiguous\n'; return 0; }
|
||||
IFS='|' read -r enable_source enable_value <<<"$enable"
|
||||
[[ "$enable_value" == true ]] || { printf 'ambiguous\n'; return 0; }
|
||||
if [[ -n "$provider" ]]; then IFS='|' read -r provider_source provider_value <<<"$provider"; [[ "$provider_value" == aescbc || "$provider_value" == secretbox ]] || { printf 'ambiguous\n'; return 0; }; printf '%s/%s\n' "$provider_value" "$provider_source"; else printf 'aescbc/implicit-default\n'; fi
|
||||
}
|
||||
|
||||
_k3s_datastore_local_evidence() {
|
||||
local data_dir="$1"
|
||||
local state_db="${data_dir}/server/db/state.db"
|
||||
local etcd_dir="${data_dir}/server/db/etcd"
|
||||
if [[ -f "$state_db" && -d "$etcd_dir" ]]; then printf 'ambiguous\n';
|
||||
elif [[ -f "$state_db" ]]; then printf 'sqlite\n';
|
||||
elif [[ -d "$etcd_dir" ]]; then printf 'embedded-etcd\n';
|
||||
else printf 'none\n'; fi
|
||||
}
|
||||
|
||||
detect_k3s_datastore() {
|
||||
local show data endpoint source value evidence
|
||||
show="$(_k3s_effective_service_show)" || { printf 'ambiguous\n'; return 0; }
|
||||
data="$(_k3s_resolve_key "$show" --data-dir K3S_DATA_DIR data-dir)" || { printf 'ambiguous\n'; return 0; }
|
||||
endpoint="$(_k3s_resolve_key "$show" --datastore-endpoint K3S_DATASTORE_ENDPOINT datastore-endpoint)" || { printf 'ambiguous\n'; return 0; }
|
||||
if [[ -n "$data" ]]; then IFS='|' read -r source value <<<"$data"; data="$value"; else source=default; data=/var/lib/rancher/k3s; fi
|
||||
_k3s_is_dynamic_value "$data" || [[ "$data" == /* ]] || { printf 'ambiguous\n'; return 0; }
|
||||
[[ "$source" == default || "$data" == /var/lib/rancher/k3s ]] || { printf 'ambiguous\n'; return 0; }
|
||||
evidence="$(_k3s_datastore_local_evidence "$data")" || { printf 'ambiguous\n'; return 0; }
|
||||
if [[ -n "$endpoint" ]]; then [[ "$evidence" == none ]] && printf 'external\n' || printf 'ambiguous\n';
|
||||
elif [[ "$evidence" == sqlite || "$evidence" == embedded-etcd ]]; then printf '%s\n' "$evidence";
|
||||
else printf 'ambiguous\n'; fi
|
||||
}
|
||||
|
||||
_k3s_now_seconds() {
|
||||
printf '%s\n' "$SECONDS"
|
||||
}
|
||||
|
||||
_k3s_timeout_before_deadline() {
|
||||
local deadline="$1" now remaining command_timeout=9
|
||||
now="$(_k3s_now_seconds)" || return 1
|
||||
[[ "$now" =~ ^[0-9]+$ ]] || return 1
|
||||
remaining=$((deadline - now))
|
||||
(( remaining > 1 )) || return 1
|
||||
(( command_timeout < remaining )) || command_timeout=$((remaining - 1))
|
||||
printf '%s\n' "$command_timeout"
|
||||
}
|
||||
|
||||
_k3s_sleep_until_poll() {
|
||||
local deadline="$1" next_poll="$2" now delay remaining
|
||||
now="$(_k3s_now_seconds)" || return 1
|
||||
[[ "$now" =~ ^[0-9]+$ ]] || return 1
|
||||
(( now < deadline )) || return 1
|
||||
delay=$((next_poll - now))
|
||||
(( delay > 0 )) || return 0
|
||||
remaining=$((deadline - now))
|
||||
(( delay < remaining )) || delay="$remaining"
|
||||
sleep "$delay"
|
||||
}
|
||||
|
||||
_k3s_read_encryption_status() {
|
||||
local command_timeout="$1"
|
||||
[[ "$command_timeout" =~ ^[1-9]$ ]] || return 1
|
||||
timeout --signal=TERM --kill-after=1s "${command_timeout}s" \
|
||||
sudo --non-interactive k3s secrets-encrypt status --output json 2>/dev/null
|
||||
}
|
||||
|
||||
wait_for_k3s_api() {
|
||||
local attempt started_at deadline next_poll command_timeout
|
||||
started_at="$(_k3s_now_seconds)" || return 1
|
||||
[[ "$started_at" =~ ^[0-9]+$ ]] || return 1
|
||||
deadline=$((started_at + 600))
|
||||
for ((attempt=1; attempt<=60; attempt++)); do
|
||||
command_timeout="$(_k3s_timeout_before_deadline "$deadline")" || return 1
|
||||
if timeout --signal=TERM --kill-after=1s "${command_timeout}s" \
|
||||
sudo --non-interactive k3s kubectl get --raw=/readyz >/dev/null 2>&1; then
|
||||
return 0
|
||||
fi
|
||||
(( attempt < 60 )) || break
|
||||
next_poll=$((started_at + attempt * 10))
|
||||
_k3s_sleep_until_poll "$deadline" "$next_poll" || return 1
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
wait_for_reencrypt_finished() {
|
||||
local rotate_rc="$1"
|
||||
local attempt status_json status_class stage started_at deadline next_poll command_timeout
|
||||
|
||||
# rotate-keys can return non-zero after the server accepted the operation;
|
||||
# a later authoritative finished status is therefore allowed to succeed.
|
||||
[[ "$rotate_rc" =~ ^[0-9]+$ ]] || return 1
|
||||
started_at="$(_k3s_now_seconds)" || return 1
|
||||
[[ "$started_at" =~ ^[0-9]+$ ]] || return 1
|
||||
deadline=$((started_at + 600))
|
||||
for ((attempt=1; attempt<=60; attempt++)); do
|
||||
command_timeout="$(_k3s_timeout_before_deadline "$deadline")" || return 1
|
||||
status_json="$(_k3s_read_encryption_status "$command_timeout")" || return 1
|
||||
status_class="$(classify_encryption_status "$status_json")"
|
||||
[[ "$status_class" != hash_mismatch && "$status_class" != invalid ]] || return 1
|
||||
stage="$(jq -r '.stage' <<<"$status_json" 2>/dev/null)" || return 1
|
||||
[[ "$stage" != start ]] || return 1
|
||||
[[ "$stage" == reencrypt_finished ]] && return 0
|
||||
[[ "$stage" == reencrypt_active ]] || return 1
|
||||
(( attempt < 60 )) || break
|
||||
next_poll=$((started_at + attempt * 10))
|
||||
_k3s_sleep_until_poll "$deadline" "$next_poll" || return 1
|
||||
done
|
||||
return 1
|
||||
}
|
||||
Reference in New Issue
Block a user