Movses AslanyanandClaude Opus 5.5
f721df3063
Add opentelemetry-distro/exporter-otlp (pinned pair) and run opentelemetry-bootstrap at build time; wrap the sanctions command with opentelemetry-instrument and configure the SDK via OTEL_* env (traces only, OTLP/HTTP to otlp.vione.cloud). create-secrets.sh now writes the base64 OTLP auth header into .env.observability. The G10 guard test (no observability libraries in requirements) is expected to fail from here until the guard suite is retired in Phase 3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
67 lines
2.4 KiB
Bash
Executable File
67 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Create the platform's secrets in the cluster. Idempotent: credentials are
|
|
# generated once into k8s/.credentials (gitignored, mode 600) and reused on
|
|
# every later run, so re-running only re-applies the same secrets.
|
|
#
|
|
# ./k8s/create-secrets.sh
|
|
#
|
|
# Creates, in namespace ledgerline-observability:
|
|
# obs-basic-auth htpasswd for the Traefik basic-auth middleware
|
|
# (Prometheus, Alertmanager, Loki, Tempo, Alloy UI, OTLP)
|
|
# grafana-admin Grafana admin user/password
|
|
# and writes .env.observability at the repo root (gitignored) for the czy-side
|
|
# Alloy log agent and the OTLP auth header of instrumented services; copy it to
|
|
# the server after every regeneration (see k8s/README.md).
|
|
#
|
|
# KUBECTL defaults to `kubectl`; e.g. KUBECTL="ssh falken kubectl" to run it on
|
|
# the node when the API server isn't reachable from here.
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")"
|
|
KUBECTL="${KUBECTL:-kubectl}"
|
|
NS=ledgerline-observability
|
|
CREDS=.credentials
|
|
|
|
if [ ! -f "$CREDS" ]; then
|
|
umask 077
|
|
cat > "$CREDS" <<EOF
|
|
OBS_USER=ledgerline
|
|
OBS_PASSWORD=$(openssl rand -hex 24)
|
|
GRAFANA_ADMIN_USER=admin
|
|
GRAFANA_ADMIN_PASSWORD=$(openssl rand -hex 24)
|
|
EOF
|
|
echo "generated $PWD/$CREDS"
|
|
fi
|
|
# shellcheck disable=SC1090
|
|
source "$CREDS"
|
|
|
|
# Secrets are rendered locally (no API access needed) and applied through
|
|
# $KUBECTL, so they never appear on a command line on the remote side.
|
|
$KUBECTL apply -f - < namespace.yaml
|
|
|
|
kubectl create secret generic obs-basic-auth -n "$NS" \
|
|
--from-literal=users="$(htpasswd -nbB "$OBS_USER" "$OBS_PASSWORD")" \
|
|
--dry-run=client -o yaml | $KUBECTL apply -f -
|
|
|
|
kubectl create secret generic grafana-admin -n "$NS" \
|
|
--from-literal=admin-user="$GRAFANA_ADMIN_USER" \
|
|
--from-literal=admin-password="$GRAFANA_ADMIN_PASSWORD" \
|
|
--dry-run=client -o yaml | $KUBECTL apply -f -
|
|
|
|
# OTLP header for instrumented services: URL-encoded (space -> %20), and
|
|
# newlines stripped because GNU base64 wraps at 76 chars and this is ~80.
|
|
OTLP_BASIC=$(printf '%s:%s' "$OBS_USER" "$OBS_PASSWORD" | base64 | tr -d '\n')
|
|
|
|
(
|
|
umask 077
|
|
cat > ../.env.observability <<EOF
|
|
# Credentials for the Alloy log agent and instrumented services on czy.
|
|
# Generated by k8s/create-secrets.sh -- do not commit.
|
|
LOKI_PUSH_URL=https://loki.vione.cloud/loki/api/v1/push
|
|
LOKI_PUSH_USER=$OBS_USER
|
|
LOKI_PUSH_PASSWORD=$OBS_PASSWORD
|
|
OTEL_EXPORTER_OTLP_HEADERS=Authorization=Basic%20$OTLP_BASIC
|
|
EOF
|
|
)
|
|
echo "wrote $(cd .. && pwd)/.env.observability"
|