570 lines
21 KiB
Bash
570 lines
21 KiB
Bash
#!/usr/bin/env bash
|
|
# Source-only helpers for k3s Secret-encryption validation. They deliberately
|
|
# return classifications instead of printing service, config, or key material.
|
|
|
|
_k3s_status_schema_valid() {
|
|
jq -e -s '
|
|
length == 1 and
|
|
(.[0] | type == "object" and
|
|
(.stage | type == "string") and
|
|
(.activekey | type == "string") and
|
|
((has("enable") | not) or (.enable | type == "boolean")) and
|
|
((has("hashmatch") | not) or (.hashmatch | type == "boolean")) and
|
|
((has("hasherror") | not) or (.hasherror | type == "string")) and
|
|
((has("inactivekeys") | not) or (.inactivekeys | type == "array")))
|
|
' >/dev/null 2>&1 <<<"$1"
|
|
}
|
|
|
|
classify_encryption_status() {
|
|
local status_json="$1"
|
|
|
|
if ! _k3s_status_schema_valid "$status_json"; then
|
|
printf 'invalid\n'
|
|
return 0
|
|
fi
|
|
|
|
if jq -e '
|
|
(has("enable") | not) and .stage == "" and .activekey == "" and
|
|
(has("hasherror") | not)
|
|
' >/dev/null <<<"$status_json"; then
|
|
printf 'disabled_no_config\n'
|
|
return 0
|
|
fi
|
|
|
|
if jq -e '
|
|
has("enable") and
|
|
((.hashmatch != true) or (has("hasherror") and .hasherror != ""))
|
|
' >/dev/null <<<"$status_json"; then
|
|
printf 'hash_mismatch\n'
|
|
return 0
|
|
fi
|
|
|
|
if jq -e '
|
|
.enable == false and .stage == "start" and .activekey == "" and
|
|
.hashmatch == true and ((has("inactivekeys") | not) or (.inactivekeys | length == 0))
|
|
' >/dev/null <<<"$status_json"; then
|
|
printf 'transition_start\n'
|
|
return 0
|
|
fi
|
|
|
|
if jq -e '
|
|
.enable == true and (.activekey | length > 0) and .hashmatch == true and
|
|
(.stage == "start" or .stage == "reencrypt_finished")
|
|
' >/dev/null <<<"$status_json"; then
|
|
printf 'enabled_stable\n'
|
|
return 0
|
|
fi
|
|
|
|
if jq -e '.enable == true and .hashmatch == true' >/dev/null <<<"$status_json"; then
|
|
printf 'unsafe_transition\n'
|
|
else
|
|
printf 'invalid\n'
|
|
fi
|
|
}
|
|
|
|
classify_encryption_provider() {
|
|
local status_json="$1"
|
|
local active_key
|
|
|
|
if ! _k3s_status_schema_valid "$status_json"; then
|
|
printf 'invalid\n'
|
|
return 0
|
|
fi
|
|
active_key="$(jq -r '.activekey' <<<"$status_json")"
|
|
case "$active_key" in
|
|
'AES-CBC '*)
|
|
[[ "${active_key#AES-CBC }" != "$active_key" && -n "${active_key#AES-CBC }" ]] && printf 'aescbc\n' || printf 'invalid\n'
|
|
;;
|
|
'XSalsa20-POLY1305 '*)
|
|
[[ "${active_key#XSalsa20-POLY1305 }" != "$active_key" && -n "${active_key#XSalsa20-POLY1305 }" ]] && printf 'secretbox\n' || printf 'invalid\n'
|
|
;;
|
|
*)
|
|
printf 'invalid\n'
|
|
;;
|
|
esac
|
|
}
|
|
|
|
version_supports_late_enable() {
|
|
local version="$1"
|
|
local minor patch
|
|
|
|
[[ "$version" =~ ^v1\.([0-9]+)\.([0-9]+)\+k3s[0-9]+$ ]] || return 1
|
|
minor="${BASH_REMATCH[1]}"
|
|
patch="${BASH_REMATCH[2]}"
|
|
case "$minor" in
|
|
33) (( patch >= 10 )) ;;
|
|
34) (( patch >= 6 )) ;;
|
|
35) (( patch >= 3 )) ;;
|
|
*) (( minor >= 36 )) ;;
|
|
esac
|
|
}
|
|
|
|
require_exact_encryption_state() {
|
|
local expected="$1"
|
|
local status_json="$2"
|
|
[[ "$(classify_encryption_status "$status_json")" == "$expected" ]]
|
|
}
|
|
|
|
_k3s_secure_regular_file() {
|
|
local path="$1"
|
|
local metadata
|
|
|
|
[[ -f "$path" && ! -L "$path" ]] || return 1
|
|
metadata="$(stat --format='%u:%a:%F' -- "$path" 2>/dev/null)" || return 1
|
|
[[ "$metadata" == '0:600:regular file' ]]
|
|
}
|
|
|
|
_k3s_read_file() {
|
|
local path="$1"
|
|
[[ -f "$path" && ! -L "$path" ]] || return 1
|
|
command cat -- "$path"
|
|
}
|
|
|
|
_k3s_list_yaml_files() {
|
|
local config="$1" file
|
|
[[ -f "$config" && ! -L "$config" ]] && printf '%s\n' "$config"
|
|
if [[ -d "${config}.d" && ! -L "${config}.d" ]]; then
|
|
while IFS= read -r file; do printf '%s\n' "$file"; done < <(
|
|
find "${config}.d" -maxdepth 1 -type f -name '*.yaml' -print | sort
|
|
)
|
|
fi
|
|
}
|
|
|
|
verify_local_encryption_config_integrity() {
|
|
local config_path="$1"
|
|
local state_path="$2"
|
|
local annotation_value="$3"
|
|
local status_stage="$4"
|
|
local state_value config_hash config_metadata state_metadata
|
|
|
|
if ! _k3s_secure_regular_file "$config_path" || ! _k3s_secure_regular_file "$state_path"; then
|
|
printf 'mismatch\n'
|
|
return 1
|
|
fi
|
|
[[ "$status_stage" =~ ^[a-z_]+$ ]] || {
|
|
printf 'mismatch\n'
|
|
return 1
|
|
}
|
|
state_value="$(<"$state_path")"
|
|
[[ "$(wc -c <"$state_path" | tr -d '[:space:]')" == "${#state_value}" ]] || {
|
|
printf 'mismatch\n'
|
|
return 1
|
|
}
|
|
[[ "$state_value" =~ ^([a-z_]+)-([0-9a-f]{64})$ ]] || {
|
|
printf 'mismatch\n'
|
|
return 1
|
|
}
|
|
config_hash="$(sha256sum -- "$config_path" | awk '{print $1}')" || {
|
|
printf 'mismatch\n'
|
|
return 1
|
|
}
|
|
config_metadata="$(stat --format='%u:%a:%F' -- "$config_path" 2>/dev/null)" || config_metadata=''
|
|
state_metadata="$(stat --format='%u:%a:%F' -- "$state_path" 2>/dev/null)" || state_metadata=''
|
|
verify_local_encryption_config_integrity_evidence \
|
|
"$config_metadata" "$state_metadata" "$config_hash" "$state_value" \
|
|
"$annotation_value" "$status_stage"
|
|
}
|
|
|
|
verify_local_encryption_config_integrity_evidence() {
|
|
local config_metadata="$1" state_metadata="$2" config_hash="$3"
|
|
local state_value="$4" annotation_value="$5" status_stage="$6" expected
|
|
|
|
if [[ "$config_metadata" != '0:600:regular file' ||
|
|
"$state_metadata" != '0:600:regular file' ||
|
|
! "$config_hash" =~ ^[0-9a-f]{64}$ ||
|
|
! "$status_stage" =~ ^[a-z_]+$ ||
|
|
! "$state_value" =~ ^[a-z_]+-[0-9a-f]{64}$ ]]; then
|
|
printf 'mismatch\n'
|
|
return 1
|
|
fi
|
|
expected="${status_stage}-${config_hash}"
|
|
if [[ "$state_value" == "$expected" && "$annotation_value" == "$expected" ]]; then
|
|
printf 'match\n'
|
|
return 0
|
|
fi
|
|
printf 'mismatch\n'
|
|
return 1
|
|
}
|
|
|
|
_k3s_systemctl_show() {
|
|
systemctl show k3s \
|
|
--property=ExecStart \
|
|
--property=Environment \
|
|
--property=EnvironmentFiles 2>/dev/null
|
|
}
|
|
|
|
_k3s_systemd_dropin_lines() {
|
|
local dropin_dir="${K3S_SYSTEMD_DROPIN_DIR:-/etc/systemd/system/k3s.service.d}"
|
|
local file
|
|
|
|
[[ -e "$dropin_dir" ]] || return 0
|
|
[[ -d "$dropin_dir" && ! -L "$dropin_dir" ]] || return 1
|
|
while IFS= read -r file; do
|
|
[[ -r "$file" && ! -L "$file" ]] || return 1
|
|
sed -n -E '/^[[:space:]]*(Environment|EnvironmentFile)=/p' "$file"
|
|
done < <(find "$dropin_dir" -maxdepth 1 -type f -name '*.conf' -print | sort)
|
|
}
|
|
|
|
_k3s_is_dynamic_value() {
|
|
local value="$1"
|
|
[[ "$value" == *'$'* || "$value" == *'`'* || "$value" == *'\\'* ]]
|
|
}
|
|
|
|
# Strict, non-evaluating readers for systemd's already-resolved show output and
|
|
# EnvironmentFile syntax. Unsupported quoting, resets, or expansions fail
|
|
# closed instead of being interpreted by a shell.
|
|
_k3s_plain_value() {
|
|
local value="$1" quote="'"
|
|
[[ -n "$value" && "$value" != *' '* && "$value" != *'"'* && "$value" != *"$quote"* && "$value" != *'$'* && "$value" != *'`'* && "$value" != *'\\'* ]]
|
|
}
|
|
|
|
_k3s_safe_payload() {
|
|
local value="$1" quote="'"
|
|
[[ -n "$value" && "$value" != *'"'* && "$value" != *"$quote"* && "$value" != *'$'* && "$value" != *'`'* && "$value" != *'\\'* ]]
|
|
}
|
|
|
|
_k3s_effective_service_show() {
|
|
local show dropins line has_environment=false
|
|
show="$(_k3s_systemctl_show)" || return 2
|
|
while IFS= read -r line; do
|
|
[[ "$line" == Environment=* || "$line" == EnvironmentFiles=* ]] || continue
|
|
[[ -n "${line#*=}" ]] && has_environment=true
|
|
done <<<"$show"
|
|
if ! "$has_environment"; then
|
|
dropins="$(_k3s_systemd_dropin_lines)" || return 2
|
|
[[ -z "$dropins" ]] || show+=$'\n'"$dropins"
|
|
fi
|
|
printf '%s\n' "$show"
|
|
}
|
|
|
|
_k3s_envfile_values() {
|
|
local file="$1" key="$2" line trimmed name value text char quote='' content
|
|
local in_record=false target_record=false continued=false
|
|
local index length
|
|
content="$(_k3s_read_file "$file")" || return 2
|
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
|
if ! "$in_record"; then
|
|
trimmed="${line#"${line%%[![:space:]]*}"}"
|
|
[[ -z "$trimmed" || "$trimmed" == \#* || "$trimmed" == \;* ]] && continue
|
|
[[ "$trimmed" == *=* ]] || { [[ "$trimmed" == "$key" ]] && return 2; continue; }
|
|
name="${trimmed%%=*}"
|
|
value="${trimmed#*=}"
|
|
target_record=false
|
|
[[ "$name" == "$key" ]] && target_record=true
|
|
text="$value"
|
|
quote=''
|
|
else
|
|
text="$line"
|
|
fi
|
|
|
|
continued=false
|
|
length=${#text}
|
|
for ((index=0; index<length; index++)); do
|
|
char="${text:index:1}"
|
|
case "$quote" in
|
|
"'")
|
|
[[ "$char" == "'" ]] && quote=''
|
|
;;
|
|
'"')
|
|
if [[ "$char" == "\\" ]]; then
|
|
if (( index + 1 < length )); then ((index++)); else continued=true; fi
|
|
elif [[ "$char" == '"' ]]; then
|
|
quote=''
|
|
fi
|
|
;;
|
|
'')
|
|
if [[ "$char" == "\\" ]]; then
|
|
if (( index + 1 < length )); then ((index++)); else continued=true; fi
|
|
elif [[ "$char" == "'" || "$char" == '"' ]]; then
|
|
quote="$char"
|
|
fi
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [[ -n "$quote" ]] || "$continued"; then
|
|
in_record=true
|
|
continue
|
|
fi
|
|
|
|
if "$target_record"; then
|
|
_k3s_plain_value "$value" || return 2
|
|
printf '%s\n' "$value"
|
|
fi
|
|
in_record=false
|
|
target_record=false
|
|
done <<<"$content"
|
|
"$in_record" && return 2
|
|
return 0
|
|
}
|
|
|
|
_k3s_service_env_values() {
|
|
local show="$1" key="$2" line payload token name value candidate file result policy
|
|
local index
|
|
local -a words=()
|
|
candidate=''
|
|
while IFS= read -r line; do
|
|
[[ "$line" == Environment=* ]] || continue
|
|
payload="${line#Environment=}"
|
|
[[ -n "$payload" ]] || continue
|
|
_k3s_safe_payload "$payload" || return 2
|
|
for token in $payload; do
|
|
[[ "$token" == *=* ]] || return 2
|
|
name="${token%%=*}"; value="${token#*=}"
|
|
[[ "$name" == "$key" ]] || continue
|
|
[[ -n "$value" ]] || return 2
|
|
candidate="$value"
|
|
done
|
|
done <<<"$show"
|
|
while IFS= read -r line; do
|
|
[[ "$line" == EnvironmentFiles=* ]] || continue
|
|
payload="${line#EnvironmentFiles=}"
|
|
[[ -n "$payload" ]] || continue
|
|
_k3s_safe_payload "$payload" || return 2
|
|
read -r -a words <<<"$payload"
|
|
for ((index=0; index<${#words[@]};)); do
|
|
file="${words[index]}"; ((index++))
|
|
policy=no
|
|
if (( index < ${#words[@]} )) && [[ "${words[index]}" =~ ^\(ignore_errors=(yes|no)\)$ ]]; then
|
|
policy="${BASH_REMATCH[1]}"; ((index++))
|
|
fi
|
|
[[ "$file" != \(* ]] || return 2
|
|
file="${file#-}"
|
|
if [[ ! -r "$file" || -L "$file" ]]; then
|
|
[[ "$policy" == yes ]] && continue
|
|
return 2
|
|
fi
|
|
result="$(_k3s_envfile_values "$file" "$key")" || return $?
|
|
while IFS= read -r token; do [[ -n "$token" ]] && candidate="$token"; done <<<"$result"
|
|
done
|
|
done <<<"$show"
|
|
[[ -n "$candidate" ]] && printf '%s\n' "$candidate"
|
|
return 0
|
|
}
|
|
|
|
_k3s_cli_values() {
|
|
local show="$1" option="$2" line payload option_value exec_count=0
|
|
local serialized_path serialized_argv serialized_body serialized_tail
|
|
local serialized_prefix='{ path=' serialized_separator=' ; argv[]='
|
|
local serialized_short_suffix=' ; ignore_errors=no ; }'
|
|
local serialized_full_marker=' ; ignore_errors=no ; start_time='
|
|
local serialized_full_pattern='^ ; ignore_errors=no ; start_time=\[[^][;={}]+\] ; stop_time=\[[^][;={}]+\] ; pid=[0-9]+ ; code=(\(null\)|exited|killed|dumped) ; status=[0-9]+/[0-9]+ \}$'
|
|
local -a words=()
|
|
local index token
|
|
while IFS= read -r line; do
|
|
[[ "$line" == ExecStart=* ]] || continue
|
|
((exec_count+=1))
|
|
payload="${line#ExecStart=}"
|
|
[[ -n "$payload" ]] || return 2
|
|
_k3s_safe_payload "$payload" || return 2
|
|
if [[ "$payload" == "$serialized_prefix"* ]]; then
|
|
serialized_body="${payload#"$serialized_prefix"}"
|
|
[[ "$serialized_body" == *"$serialized_separator"* ]] || return 2
|
|
serialized_path="${serialized_body%%"$serialized_separator"*}"
|
|
serialized_body="${serialized_body#"${serialized_path}${serialized_separator}"}"
|
|
if [[ "$serialized_body" == *"$serialized_short_suffix" ]]; then
|
|
serialized_argv="${serialized_body%"$serialized_short_suffix"}"
|
|
serialized_tail="$serialized_short_suffix"
|
|
elif [[ "$serialized_body" == *"$serialized_full_marker"* ]]; then
|
|
serialized_argv="${serialized_body%%"$serialized_full_marker"*}"
|
|
serialized_tail="${serialized_body#"$serialized_argv"}"
|
|
[[ "$serialized_tail" =~ $serialized_full_pattern ]] || return 2
|
|
else
|
|
return 2
|
|
fi
|
|
[[ "$payload" == "${serialized_prefix}${serialized_path}${serialized_separator}${serialized_argv}${serialized_tail}" ]] || return 2
|
|
[[ "$serialized_path" == /usr/local/bin/k3s ]] || return 2
|
|
[[ -n "$serialized_argv" && "$serialized_argv" != *'argv[]='* && "$serialized_argv" != *' ; '* && "$serialized_argv" != *'{'* && "$serialized_argv" != *'}'* ]] || return 2
|
|
payload="$serialized_argv"
|
|
elif [[ "$payload" == *'argv[]='* || "$payload" == *'path='* || "$payload" == *'ignore_errors='* || "$payload" == *'{'* || "$payload" == *'}'* || "$payload" == *';'* ]]; then
|
|
return 2
|
|
fi
|
|
read -r -a words <<<"$payload"
|
|
(( ${#words[@]} >= 2 )) || return 2
|
|
[[ "${words[0]##*/}" == k3s && "${words[1]}" == server ]] || return 2
|
|
for ((index=0; index<${#words[@]}; index++)); do
|
|
token="${words[index]}"
|
|
case "$token" in
|
|
"${option}" )
|
|
if [[ "$option" == '--secrets-encryption' ]]; then printf 'true\n';
|
|
elif (( index + 1 < ${#words[@]} )); then option_value="${words[index + 1]}"; _k3s_plain_value "$option_value" || return 2; printf '%s\n' "$option_value"; else return 2; fi
|
|
;;
|
|
"${option}"=*) option_value="${token#*=}"; _k3s_plain_value "$option_value" || return 2; printf '%s\n' "$option_value" ;;
|
|
esac
|
|
done
|
|
done <<<"$show"
|
|
(( exec_count == 1 )) || return 2
|
|
return 0
|
|
}
|
|
|
|
_k3s_unique_value() {
|
|
local values="$1" value count=0 chosen=''
|
|
while IFS= read -r value; do
|
|
[[ -n "$value" ]] || continue
|
|
((count++)); chosen="$value"
|
|
done <<<"$values"
|
|
(( count <= 1 )) || return 2
|
|
[[ -n "$chosen" ]] && printf '%s\n' "$chosen"
|
|
return 0
|
|
}
|
|
|
|
_k3s_selected_config() {
|
|
local show="$1" cli env default_root raw
|
|
raw="$(_k3s_cli_values "$show" --config)" || return 2
|
|
cli="$(_k3s_unique_value "$raw")" || return 2
|
|
raw="$(_k3s_service_env_values "$show" K3S_CONFIG_FILE)" || return 2
|
|
env="$(_k3s_unique_value "$raw")" || return 2
|
|
if _k3s_is_dynamic_value "$cli" || _k3s_is_dynamic_value "$env"; then
|
|
return 2
|
|
fi
|
|
default_root="${K3S_CONFIG_DIR:-/etc/rancher/k3s}"
|
|
if [[ -n "$cli" ]]; then printf '%s\n' "$cli"; elif [[ -n "$env" ]]; then printf '%s\n' "$env"; else printf '%s\n' "${default_root}/config.yaml"; fi
|
|
}
|
|
|
|
_k3s_yaml_value() {
|
|
local config="$1" key="$2" file line raw value selected='' selected_file='' content files
|
|
files="$(_k3s_list_yaml_files "$config")" || return 2
|
|
while IFS= read -r file; do
|
|
[[ -n "$file" ]] || continue
|
|
content="$(_k3s_read_file "$file")" || return 2
|
|
raw=''
|
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
|
line="${line#"${line%%[![:space:]]*}"}"
|
|
[[ "$line" == "${key}:"* ]] || continue
|
|
value="${line#"${key}:"}"
|
|
value="$(sed -E 's/[[:space:]]+#.*$//; s/^[[:space:]]+//; s/[[:space:]]+$//;' <<<"$value")"
|
|
_k3s_plain_value "$value" || return 2
|
|
[[ -z "$raw" || "$raw" == "$value" ]] || return 2
|
|
raw="$value"
|
|
done <<<"$content"
|
|
if [[ -n "$raw" ]]; then selected="$raw"; selected_file="$file"; fi
|
|
done <<<"$files"
|
|
[[ -n "$selected" ]] && printf '%s|%s\n' "$selected_file" "$selected"
|
|
return 0
|
|
}
|
|
|
|
_k3s_resolve_key() {
|
|
local show="$1" cli_option="$2" env_key="$3" yaml_key="$4" cli env config yaml raw
|
|
raw="$(_k3s_cli_values "$show" "$cli_option")" || return 2
|
|
cli="$(_k3s_unique_value "$raw")" || return 2
|
|
[[ -z "$cli" ]] || { printf 'command-line|%s\n' "$cli"; return 0; }
|
|
raw="$(_k3s_service_env_values "$show" "$env_key")" || return 2
|
|
env="$(_k3s_unique_value "$raw")" || return 2
|
|
[[ -z "$env" ]] || { printf 'environment|%s\n' "$env"; return 0; }
|
|
config="$(_k3s_selected_config "$show")" || return 2
|
|
yaml="$(_k3s_yaml_value "$config" "$yaml_key")" || return 2
|
|
[[ -z "$yaml" ]] || printf '%s\n' "$yaml"
|
|
}
|
|
|
|
detect_effective_encryption_config_owner() {
|
|
local show enable provider enable_source enable_value provider_source provider_value
|
|
show="$(_k3s_effective_service_show)" || { printf 'ambiguous\n'; return 0; }
|
|
enable="$(_k3s_resolve_key "$show" --secrets-encryption K3S_SECRETS_ENCRYPTION secrets-encryption)" || { printf 'ambiguous\n'; return 0; }
|
|
provider="$(_k3s_resolve_key "$show" --secrets-encryption-provider K3S_SECRETS_ENCRYPTION_PROVIDER secrets-encryption-provider)" || { printf 'ambiguous\n'; return 0; }
|
|
[[ -n "$enable" ]] || { printf 'ambiguous\n'; return 0; }
|
|
IFS='|' read -r enable_source enable_value <<<"$enable"
|
|
[[ "$enable_value" == true ]] || { printf 'ambiguous\n'; return 0; }
|
|
if [[ -n "$provider" ]]; then IFS='|' read -r provider_source provider_value <<<"$provider"; [[ "$provider_value" == aescbc || "$provider_value" == secretbox ]] || { printf 'ambiguous\n'; return 0; }; printf '%s/%s\n' "$provider_value" "$provider_source"; else printf 'aescbc/implicit-default\n'; fi
|
|
}
|
|
|
|
_k3s_datastore_local_evidence() {
|
|
local data_dir="$1"
|
|
local state_db="${data_dir}/server/db/state.db"
|
|
local etcd_dir="${data_dir}/server/db/etcd"
|
|
if [[ -f "$state_db" && -d "$etcd_dir" ]]; then printf 'ambiguous\n';
|
|
elif [[ -f "$state_db" ]]; then printf 'sqlite\n';
|
|
elif [[ -d "$etcd_dir" ]]; then printf 'embedded-etcd\n';
|
|
else printf 'none\n'; fi
|
|
}
|
|
|
|
detect_k3s_datastore() {
|
|
local show data endpoint source value evidence
|
|
show="$(_k3s_effective_service_show)" || { printf 'ambiguous\n'; return 0; }
|
|
data="$(_k3s_resolve_key "$show" --data-dir K3S_DATA_DIR data-dir)" || { printf 'ambiguous\n'; return 0; }
|
|
endpoint="$(_k3s_resolve_key "$show" --datastore-endpoint K3S_DATASTORE_ENDPOINT datastore-endpoint)" || { printf 'ambiguous\n'; return 0; }
|
|
if [[ -n "$data" ]]; then IFS='|' read -r source value <<<"$data"; data="$value"; else source=default; data=/var/lib/rancher/k3s; fi
|
|
_k3s_is_dynamic_value "$data" || [[ "$data" == /* ]] || { printf 'ambiguous\n'; return 0; }
|
|
[[ "$source" == default || "$data" == /var/lib/rancher/k3s ]] || { printf 'ambiguous\n'; return 0; }
|
|
evidence="$(_k3s_datastore_local_evidence "$data")" || { printf 'ambiguous\n'; return 0; }
|
|
if [[ -n "$endpoint" ]]; then [[ "$evidence" == none ]] && printf 'external\n' || printf 'ambiguous\n';
|
|
elif [[ "$evidence" == sqlite || "$evidence" == embedded-etcd ]]; then printf '%s\n' "$evidence";
|
|
else printf 'ambiguous\n'; fi
|
|
}
|
|
|
|
_k3s_now_seconds() {
|
|
printf '%s\n' "$SECONDS"
|
|
}
|
|
|
|
_k3s_timeout_before_deadline() {
|
|
local deadline="$1" now remaining command_timeout=9
|
|
now="$(_k3s_now_seconds)" || return 1
|
|
[[ "$now" =~ ^[0-9]+$ ]] || return 1
|
|
remaining=$((deadline - now))
|
|
(( remaining > 1 )) || return 1
|
|
(( command_timeout < remaining )) || command_timeout=$((remaining - 1))
|
|
printf '%s\n' "$command_timeout"
|
|
}
|
|
|
|
_k3s_sleep_until_poll() {
|
|
local deadline="$1" next_poll="$2" now delay remaining
|
|
now="$(_k3s_now_seconds)" || return 1
|
|
[[ "$now" =~ ^[0-9]+$ ]] || return 1
|
|
(( now < deadline )) || return 1
|
|
delay=$((next_poll - now))
|
|
(( delay > 0 )) || return 0
|
|
remaining=$((deadline - now))
|
|
(( delay < remaining )) || delay="$remaining"
|
|
sleep "$delay"
|
|
}
|
|
|
|
_k3s_read_encryption_status() {
|
|
local command_timeout="$1"
|
|
[[ "$command_timeout" =~ ^[1-9]$ ]] || return 1
|
|
timeout --signal=TERM --kill-after=1s "${command_timeout}s" \
|
|
sudo --non-interactive k3s secrets-encrypt status --output json 2>/dev/null
|
|
}
|
|
|
|
wait_for_k3s_api() {
|
|
local attempt started_at deadline next_poll command_timeout
|
|
started_at="$(_k3s_now_seconds)" || return 1
|
|
[[ "$started_at" =~ ^[0-9]+$ ]] || return 1
|
|
deadline=$((started_at + 600))
|
|
for ((attempt=1; attempt<=60; attempt++)); do
|
|
command_timeout="$(_k3s_timeout_before_deadline "$deadline")" || return 1
|
|
if timeout --signal=TERM --kill-after=1s "${command_timeout}s" \
|
|
sudo --non-interactive k3s kubectl get --raw=/readyz >/dev/null 2>&1; then
|
|
return 0
|
|
fi
|
|
(( attempt < 60 )) || break
|
|
next_poll=$((started_at + attempt * 10))
|
|
_k3s_sleep_until_poll "$deadline" "$next_poll" || return 1
|
|
done
|
|
return 1
|
|
}
|
|
|
|
wait_for_reencrypt_finished() {
|
|
local rotate_rc="$1"
|
|
local attempt status_json status_class stage started_at deadline next_poll command_timeout
|
|
|
|
# rotate-keys can return non-zero after the server accepted the operation;
|
|
# a later authoritative finished status is therefore allowed to succeed.
|
|
[[ "$rotate_rc" =~ ^[0-9]+$ ]] || return 1
|
|
started_at="$(_k3s_now_seconds)" || return 1
|
|
[[ "$started_at" =~ ^[0-9]+$ ]] || return 1
|
|
deadline=$((started_at + 600))
|
|
for ((attempt=1; attempt<=60; attempt++)); do
|
|
command_timeout="$(_k3s_timeout_before_deadline "$deadline")" || return 1
|
|
status_json="$(_k3s_read_encryption_status "$command_timeout")" || return 1
|
|
status_class="$(classify_encryption_status "$status_json")"
|
|
[[ "$status_class" != hash_mismatch && "$status_class" != invalid ]] || return 1
|
|
stage="$(jq -r '.stage' <<<"$status_json" 2>/dev/null)" || return 1
|
|
[[ "$stage" != start ]] || return 1
|
|
[[ "$stage" == reencrypt_finished ]] && return 0
|
|
[[ "$stage" == reencrypt_active ]] || return 1
|
|
(( attempt < 60 )) || break
|
|
next_poll=$((started_at + attempt * 10))
|
|
_k3s_sleep_until_poll "$deadline" "$next_poll" || return 1
|
|
done
|
|
return 1
|
|
}
|