jakman85andClaude Opus 4.8
f089adf261
Two dev.sh gaps surfaced while running bootstrap/sops/install-age-key.sh:
- kubectl defaulted to localhost:8080 (connection refused) because KUBECONFIG
was never set in the toolbox. Set KUBECONFIG=/work/infra/ansible/.cache/dev.kubeconfig
(override via DEV_KUBECONFIG); --network host already reaches 10.73.0.11:6443.
- age-keygen.sh writes the PRIVATE key to ~/.config/sops/age/keys.txt, but that
path was not mounted in the --rm container, so the key was lost on exit. Mount
${HOME}/.config/sops -> /root/.config/sops (created first) so the key persists
on the host and SOPS_AGE_KEY_FILE resolves to it.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
57 lines
2.2 KiB
Bash
Executable File
57 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# infra/devcontainer/dev.sh — build & enter the pinned dev toolbox.
|
|
#
|
|
# Mounts the host libvirt socket and the repo so OpenTofu (dmacvicar/libvirt) and Ansible
|
|
# drive the local KVM cluster from inside the container. Rootless podman by default
|
|
# (ENGINE=docker to switch). SELinux label is disabled for the run so the container can
|
|
# use the host libvirt socket without relabeling it.
|
|
#
|
|
# ./dev.sh build # build the image only
|
|
# ./dev.sh # build (if needed) + open a shell
|
|
# ./dev.sh run tofu -version # run one command in the toolbox
|
|
set -euo pipefail
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${HERE}/../.." && pwd)"
|
|
IMAGE="${IMAGE:-home-k3s-dev:local}"
|
|
ENGINE="${ENGINE:-podman}"
|
|
# shellcheck disable=SC1091
|
|
source "${HERE}/versions.env"
|
|
|
|
build() {
|
|
"$ENGINE" build \
|
|
--build-arg FEDORA_VERSION="$FEDORA_VERSION" \
|
|
--build-arg OPENTOFU_VERSION="$OPENTOFU_VERSION" \
|
|
--build-arg AGE_VERSION="$AGE_VERSION" \
|
|
--build-arg SOPS_VERSION="$SOPS_VERSION" \
|
|
--build-arg FLUX_VERSION="$FLUX_VERSION" \
|
|
--build-arg KUBECTL_VERSION="$KUBECTL_VERSION" \
|
|
--build-arg HELM_VERSION="$HELM_VERSION" \
|
|
-t "$IMAGE" -f "${HERE}/Containerfile" "${HERE}"
|
|
}
|
|
|
|
run() {
|
|
# Persist the SOPS age keyring on the HOST so the age PRIVATE key generated by
|
|
# bootstrap/sops/age-keygen.sh survives this --rm container (otherwise it lives only
|
|
# in the ephemeral container fs and is lost on exit — you'd be locked out of every
|
|
# SOPS-encrypted secret). SOPS_AGE_KEY_FILE defaults to ~/.config/sops/age/keys.txt,
|
|
# which is this mount. Create it first so the bind source exists.
|
|
mkdir -p "${HOME}/.config/sops/age"
|
|
"$ENGINE" run --rm -it \
|
|
--network host \
|
|
--security-opt label=disable \
|
|
-v /run/libvirt:/run/libvirt \
|
|
-v "${REPO_ROOT}:/work" -w /work \
|
|
-v "${HOME}/.ssh:/root/.ssh:ro" \
|
|
-v "${HOME}/.config/sops:/root/.config/sops" \
|
|
-e LIBVIRT_DEFAULT_URI=qemu:///system \
|
|
-e KUBECONFIG="${DEV_KUBECONFIG:-/work/infra/ansible/.cache/dev.kubeconfig}" \
|
|
"$IMAGE" "$@"
|
|
}
|
|
|
|
case "${1:-shell}" in
|
|
build) build ;;
|
|
run) shift; run "$@" ;;
|
|
shell) build; shift 2>/dev/null || true; run ;;
|
|
*) build; run "$@" ;;
|
|
esac
|