deploy/create-secrets.ps1 - master - VVRONGG/backside

deploy/create-secrets.ps1
63 строки3 KB
VVrongg
add kubec deploy
24 май 2026, 20:16
24 май 2026, 20:16db9ffee
<#
.SYNOPSIS
  Generates random credentials and creates the Kubernetes Secrets the deployment needs.
  Real secret values never touch git — they live only in the cluster.

.DESCRIPTION
  Creates two Secrets in the `gtours` namespace:
    mysql-secret    : MYSQL_ROOT_PASSWORD, MYSQL_PASSWORD (app user password)
    backside-secret : JWT_SECRET, ADMIN_USERNAME, ADMIN_PASSWORD, DATABASE_URL

  IMPORTANT: run this ONCE, before the first deploy. The MySQL password is baked into
  the data volume on first init; re-running with fresh passwords would break auth against
  an already-initialized PVC. Use -Force only if you also reset the DB (delete the PVC).

.EXAMPLE
  ./create-secrets.ps1 -AdminUser admin -AdminPassword 'S0me-Strong-Pass'
#>
param(
  [Parameter(Mandatory = $true)][string]$AdminUser,
  [Parameter(Mandatory = $true)][string]$AdminPassword,
  [string]$Namespace = "gtours",
  [switch]$Force
)

$ErrorActionPreference = "Stop"

function New-Secret([int]$bytes = 32) {
  $b = New-Object byte[] $bytes
  [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($b)
  # Strip +/= so the value is safe inside a URL (DATABASE_URL password).
  return ([Convert]::ToBase64String($b) -replace '[+/=]', '')
}

# Namespace (idempotent)
kubectl create namespace $Namespace --dry-run=client -o yaml | kubectl apply -f -

# Guard against clobbering live DB credentials.
$existing = kubectl get secret mysql-secret -n $Namespace --ignore-not-found -o name 2>$null
if ($existing -and -not $Force) {
  Write-Error "mysql-secret already exists in '$Namespace'. Re-running would rotate the DB password and break auth against the existing data volume. Pass -Force only if you also reset the PVC."
}

$dbPass   = New-Secret 24
$rootPass = New-Secret 24
$jwt      = New-Secret 48
$dbUrl    = "mysql://backside:$dbPass@mysql:3306/backside"

kubectl create secret generic mysql-secret -n $Namespace `
  --from-literal=MYSQL_ROOT_PASSWORD=$rootPass `
  --from-literal=MYSQL_PASSWORD=$dbPass `
  --dry-run=client -o yaml | kubectl apply -f -

kubectl create secret generic backside-secret -n $Namespace `
  --from-literal=JWT_SECRET=$jwt `
  --from-literal=ADMIN_USERNAME=$AdminUser `
  --from-literal=ADMIN_PASSWORD=$AdminPassword `
  --from-literal=DATABASE_URL=$dbUrl `
  --dry-run=client -o yaml | kubectl apply -f -

Write-Host ""
Write-Host "Secrets created in namespace '$Namespace'." -ForegroundColor Green
Write-Host "Admin login: $AdminUser / (the password you passed)"
Write-Host "Keep them safe — they are NOT stored anywhere outside the cluster."