buun-stack/k8s/justfile

set fallback := true

export LOCAL_K8S_HOST := env("LOCAL_K8S_HOST", "")
export EXTERNAL_K8S_HOST := env("EXTERNAL_K8S_HOST", "")
export KEYCLOAK_HOST := env("KEYCLOAK_HOST", "")
export KEYCLOAK_REALM := env("KEYCLOAK_REALM", "buunstack")
export K8S_OIDC_CLIENT_ID := env('K8S_OIDC_CLIENT_ID', "k8s")

[private]
default:
    @just --list --unsorted --list-submodules

# Install k3s cluster
install:
    #!/bin/bash
    set -euo pipefail
    just env::check
    username=$(gum input --prompt="SSH username: " --value="${USER}" --width=100)
    kubeconfig=""
    context=""
    if gum confirm "Update KUBECONFIG?"; then
        kubeconfig=$(
            gum input --prompt="KUBECONFIG file: " --value="${HOME}/.kube/config" --width=100
        )
        context=$(
            gum input --prompt="Context name: " --value="${LOCAL_K8S_HOST}" --width=100
        )
    fi
    args=(
        "install"
        "--host" "${LOCAL_K8S_HOST}"
        "--tls-san" "${EXTERNAL_K8S_HOST}"
        "--user" "${username}"
    )
    if [ -n "${context}" ]; then
        args+=("--context" "${context}")
    fi

    if [ -n "${kubeconfig}" ]; then
        mkdir -p "$(dirname "${kubeconfig}")"
        args+=("--local-path" "${kubeconfig}" "--merge")
    fi
    echo "Running: k3sup ${args[*]}"
    k3sup "${args[@]}"
    echo "k3s cluster installed on ${LOCAL_K8S_HOST}."

# Uninstall k3s cluster
uninstall:
    #!/bin/bash
    set -euo pipefail
    if gum confirm "Uninstall k3s from ${LOCAL_K8S_HOST}?"; then
        ssh "${LOCAL_K8S_HOST}" "/usr/local/bin/k3s-uninstall.sh"
        echo "Cleaning up kubeconfig entries..."
        cluster_name=$(kubectl config view -o json | jq -r ".contexts[] | select(.name == \"${LOCAL_K8S_HOST}\") | .context.cluster // empty")
        user_name=$(kubectl config view -o json | jq -r ".contexts[] | select(.name == \"${LOCAL_K8S_HOST}\") | .context.user // empty")
        if kubectl config get-contexts "${LOCAL_K8S_HOST}" &>/dev/null; then
            kubectl config delete-context "${LOCAL_K8S_HOST}"
            echo "Deleted context: ${LOCAL_K8S_HOST}"
        fi
        if [ -n "${cluster_name}" ] && kubectl config get-clusters | grep -q "^${cluster_name}$"; then
            kubectl config delete-cluster "${cluster_name}"
            echo "Deleted cluster: ${cluster_name}"
        fi
        if [ -n "${user_name}" ] && kubectl config get-users | grep -q "^${user_name}$"; then
            kubectl config delete-user "${user_name}"
            echo "Deleted user: ${user_name}"
        fi
        echo "k3s cluster uninstalled from ${LOCAL_K8S_HOST}."
    else
        echo "Uninstallation cancelled." >&2
        exit 1
    fi

# Setup k8s OIDC authentication
setup-oidc-auth:
    just env::check
    gomplate -f ./k3s/config.gomplate.yaml | \
        ssh ${LOCAL_K8S_HOST} "sudo tee /etc/rancher/k3s/config.yaml > /dev/null"
    ssh ${LOCAL_K8S_HOST} "sudo systemctl restart k3s"
    kubectl config set-credentials ${LOCAL_K8S_HOST}-oidc \
        --exec-api-version=client.authentication.k8s.io/v1beta1 \
        --exec-command=kubectl \
        --exec-arg=oidc-login \
        --exec-arg=get-token \
        --exec-arg=--oidc-issuer-url=https://${KEYCLOAK_HOST}/realms/${KEYCLOAK_REALM} \
        --exec-arg=--oidc-client-id=${K8S_OIDC_CLIENT_ID}
    kubectl config set-cluster ${LOCAL_K8S_HOST}-oidc \
        --server=https://${EXTERNAL_K8S_HOST}
    kubectl config set-context ${LOCAL_K8S_HOST}-oidc \
        --cluster=${LOCAL_K8S_HOST}-oidc --user=${LOCAL_K8S_HOST}-oidc
    kubectl config use-context ${LOCAL_K8S_HOST}-oidc

# Create the container registry credentials
create-regcred namespace='default':
    #!/bin/bash
    set -euo pipefail
    while [ -z "${CONTAINER_REGISTRY_SERVER:-}" ]; do
        if ! CONTAINER_REGISTRY_SERVER=$(
            gum input --prompt="Container registry server: " --width=100 \
            --placeholder="e.g., index.docker.io/v1 ghcr.io"
        ); then
            echo "Setup cancelled." >&2
            exit 1
        fi
    done
    while [ -z "${CONTAINER_REGISTRY_USERNAME:-}" ]; do
        if ! CONTAINER_REGISTRY_USERNAME=$(
            gum input --prompt="Container registry username: " --width=100
        ); then
            echo "Setup cancelled." >&2
            exit 1
        fi
    done
    while [ -z "${CONTAINER_REGISTRY_PASSWORD:-}" ]; do
        if ! CONTAINER_REGISTRY_PASSWORD=$(
            gum input --prompt="Container registry password or token: " --password --width=100
        ); then
            echo "Setup cancelled." >&2
            exit 1
        fi
    done
    while [ -z "${CONTAINER_REGISTRY_EMAIL:-}" ]; do
        if ! CONTAINER_REGISTRY_EMAIL=$(
            gum input --prompt="Container registry email: " --width=100
        ); then
            echo "Setup cancelled." >&2
            exit 1
        fi
    done

    kubectl create -n {{ namespace }} secret docker-registry regcred \
        --docker-server="${CONTAINER_REGISTRY_SERVER}" \
        --docker-username="${CONTAINER_REGISTRY_USERNAME}" \
        --docker-password="${CONTAINER_REGISTRY_PASSWORD}" \
        --docker-email="${CONTAINER_REGISTRY_EMAIL}"

# Delete the container registry credentials
delete-regcred namespace='default':
    kubectl delete -n {{ namespace }} secret regcred --ignore-not-found

# Copy the container registry credentials from the default namespace
copy-regcred namespace:
    #!/bin/bash
    set -euo pipefail
    if ! kubectl get -n default secret regcred &>/dev/null; then
        just regcred-create default
    fi
    if kubectl get -n {{ namespace }} secret regcred &>/dev/null; then
        kubectl delete -n {{ namespace }} secret regcred
    fi
    kubectl get -n default secret regcred -o json | \
        sed "s/\"namespace\": \"default\"/\"namespace\": \"{{ namespace }}\"/g" | \
        kubectl apply -n {{ namespace }} -f -