ai cooking
Pmiller/updateprodwithgemenikey (#486)
* prod gem key and key dry run
* for real
* stop erroring when we know we have problem
---------
Co-authored-by: paul miller <paul.miller>
authored by
Paul Miller
paul miller
and committed by
GitHub
5863de16
62d5408d
+18
-1
+16
cmd/kage/main.go
+16
cmd/kage/main.go
···
36
36
path := flag.String("secret-file", "secrets/envtest", "encrypted file to apply to k8s namespace")
37
37
namespace := flag.String("ns", "", "k8s namespace")
38
38
check := flag.Bool("check", false, "dump secret names")
39
+
forreal := flag.Bool("apply", false, "don't actually apply secrets just print what would be done")
39
40
flag.Parse()
40
41
ctx := context.Background()
42
+
43
+
if *forreal {
44
+
log.Printf("THIS IS NOT A DRILL")
45
+
}
41
46
42
47
identities, err := loadSSHIdentities()
43
48
if err != nil {
···
73
78
return
74
79
}
75
80
81
+
if namespace == nil || *namespace == "" {
82
+
log.Fatal("namespace is required")
83
+
}
84
+
76
85
secretsK8s := toK8s(secrets)
77
86
78
87
cfg, err := clientcmd.BuildConfigFromFlags(
···
101
110
if !secretNeedsUpdate(current, secret) {
102
111
continue
103
112
}
113
+
if !*forreal {
114
+
log.Printf("would update %s/%s\n", *namespace, secret.Name)
115
+
continue
116
+
}
104
117
secret.ResourceVersion = current.ResourceVersion
105
118
_, err = secretapi.Update(ctx, secret, metav1.UpdateOptions{})
106
119
if err != nil {
···
113
126
114
127
func secretNeedsUpdate(current, desired *corev1.Secret) bool {
115
128
if current.Annotations[managedByAnnotationKey] != desired.Annotations[managedByAnnotationKey] {
129
+
log.Printf("secret %s unmanged", desired.Name)
116
130
return true
117
131
}
118
132
if len(current.Data) != len(desired.StringData) {
133
+
log.Printf("secret %s key count mismatch", desired.Name)
119
134
return true
120
135
}
121
136
for key, value := range desired.StringData {
122
137
if !bytes.Equal(current.Data[key], []byte(value)) {
138
+
log.Printf("secret %s key %s needs update", desired.Name, key)
123
139
return true
124
140
}
125
141
}
+2
-1
internal/recipes/admin_page.go
+2
-1
internal/recipes/admin_page.go
···
142
142
143
143
recipe, err := rio.SingleFromCache(ctx, hash)
144
144
if err != nil {
145
-
slog.ErrorContext(ctx, "failed to load recipe for admin critiques page", "hash", hash, "error", err)
145
+
// make this an error after we don't load all critiques or purge ones where we didn't discart
146
+
slog.InfoContext(ctx, "failed to load recipe for admin critiques page", "hash", hash, "error", err)
146
147
view.RecipeTitle = "Unknown recipe"
147
148
} else {
148
149
view.RecipeTitle = recipe.Title
secrets/envprod
secrets/envprod
This is a binary file and will not be displayed.