Erich Blume
19a82373d5
## Summary - Step 0.1: Update Pulumi ACLs with tag:registry - Step 0.3: Create Zot registry ansible role with mcquack LaunchAgent - Step 0.4: Add Zot to Tailscale Serve configuration - Step 0.5: Create Zot metrics role for Prometheus scraping - Step 0.6: Add Zot log collection to Alloy - Step 0.7: Update indri-services-check with zot checks - Step 0.8: Add podman role for container runtime - Step 0.9: Add minikube role for Kubernetes cluster - Step 0.10: Configure remote kubectl access with 1Password credentials ## Remaining Steps - [ ] Step 0.11: Add minikube to indri-services-check - [ ] Step 0.12: Create zettelkasten documentation - [ ] Step 0.13: Verify main playbook (already done - roles added) ## Deployment and Testing - [x] Zot registry deployed and accessible at https://registry.tail8d86e.ts.net - [x] Podman machine running on indri - [x] Minikube cluster running on indri - [x] kubectl access from gilbert working with 1Password credentials - [ ] indri-services-check passes all checks 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/26
31 lines
966 B
Bash
Executable file
31 lines
966 B
Bash
Executable file
#!/bin/bash
|
|
# kubectl exec credential plugin for 1Password
|
|
# Usage: kubectl-credential-1password <vault-id> <item-id> <cert-field> <key-field>
|
|
#
|
|
# Fetches client certificate and key from 1Password and outputs
|
|
# ExecCredential JSON for kubectl authentication.
|
|
|
|
set -euo pipefail
|
|
|
|
VAULT_ID="$1"
|
|
ITEM_ID="$2"
|
|
CERT_FIELD="$3"
|
|
KEY_FIELD="$4"
|
|
|
|
# Fetch credentials from 1Password (strips surrounding quotes from text fields)
|
|
CLIENT_CERT=$(op --vault "$VAULT_ID" item get "$ITEM_ID" --fields "$CERT_FIELD" | sed 's/^"//; s/"$//')
|
|
CLIENT_KEY=$(op --vault "$VAULT_ID" item get "$ITEM_ID" --fields "$KEY_FIELD" | sed 's/^"//; s/"$//')
|
|
|
|
# Output ExecCredential JSON
|
|
# Note: jq is used to properly escape the PEM data for JSON
|
|
jq -n \
|
|
--arg cert "$CLIENT_CERT" \
|
|
--arg key "$CLIENT_KEY" \
|
|
'{
|
|
"apiVersion": "client.authentication.k8s.io/v1beta1",
|
|
"kind": "ExecCredential",
|
|
"status": {
|
|
"clientCertificateData": $cert,
|
|
"clientKeyData": $key
|
|
}
|
|
}'
|