Initial commit

scripts/teslamate-bootstrap.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Teslamate Bootstrap - Auto-configure PostgreSQL with ESO
+set -euo pipefail
+
+echo "=== Teslamate Bootstrap - Fully Automated ==="
+
+# Change to the apps directory for relative paths
+cd "$(dirname "$0")/../apps" || exit 1
+
+NS=teslamate
+CLUSTER=pg-teslamate
+
+# 1) Ensure namespace
+kubectl get ns "${NS}" >/dev/null 2>&1 || kubectl create ns "${NS}"
+
+# 2) Apply CNPG cluster (auto-generates DB password)
+echo "Applying Teslamate PostgreSQL cluster..."
+kubectl apply -f teslamate/cnpg-cluster.yaml
+
+# 3) Wait for CNPG cluster
+echo "Waiting for CNPG cluster ${CLUSTER}..."
+kubectl -n "${NS}" wait --for=condition=Ready "cluster/${CLUSTER}" --timeout=300s
+
+# 3.5) Set up PostgreSQL extensions and grant superuser
+echo "Setting up PostgreSQL extensions for Teslamate..."
+PRIMARY_POD=$(kubectl get pod -n "${NS}" -l cnpg.io/cluster="${CLUSTER}",role=primary -o jsonpath='{.items[0].metadata.name}')
+
+if [ -n "$PRIMARY_POD" ]; then
+  echo "Granting superuser to teslamate user..."
+  kubectl exec -n "${NS}" "$PRIMARY_POD" -- psql -U postgres -c "ALTER USER teslamate WITH SUPERUSER;" 2>/dev/null || echo "  (user may already have superuser)"
+  
+  echo "Creating required PostgreSQL extensions..."
+  kubectl exec -n "${NS}" "$PRIMARY_POD" -- psql -U postgres -d teslamate -c "CREATE EXTENSION IF NOT EXISTS cube;" 2>/dev/null || echo "  (cube extension may already exist)"
+  kubectl exec -n "${NS}" "$PRIMARY_POD" -- psql -U postgres -d teslamate -c "CREATE EXTENSION IF NOT EXISTS earthdistance;" 2>/dev/null || echo "  (earthdistance extension may already exist)"
+  
+  echo "✅ PostgreSQL extensions configured"
+else
+  echo "⚠️  Warning: Could not find primary pod, skipping extension setup"
+fi
+
+# 4) Apply ESO secrets (auto-rotate DB passwords)
+echo "Applying Teslamate ESO secrets (auto-generates passwords)..."
+kubectl apply -f teslamate/cnpg-secrets.yaml
+
+# 5) Wait for password to be generated
+echo "Waiting for ESO to generate database password..."
+for i in {1..30}; do
+  if kubectl -n "${NS}" get secret pg-teslamate-app >/dev/null 2>&1; then
+    echo "✅ Database password generated"
+    break
+  fi
+  echo "  waiting for secret... (attempt $i/30)"
+  sleep 2
+done
+
+# 6) Initialize encryption key in Vault if it doesn't exist
+echo "Initializing encryption key in Vault..."
+
+# Get Vault root token from secret
+VAULT_ROOT_TOKEN=$(kubectl -n vault get secret vault-init-keys -o jsonpath='{.data.VAULT_ROOT_TOKEN}' 2>/dev/null | base64 -d || echo "")
+
+if [ -z "$VAULT_ROOT_TOKEN" ]; then
+  echo "⚠️  Warning: Could not retrieve Vault root token from secret vault-init-keys"
+  echo "Skipping encryption key creation. You'll need to create it manually."
+  echo ""
+  echo "To create the encryption key manually:"
+  echo "  ENCRYPTION_KEY=\$(openssl rand -base64 32)"
+  echo "  kubectl exec -n vault vault-0 -- vault kv put secret/teslamate/config encryption_key=\"\${ENCRYPTION_KEY}\""
+  echo ""
+  # Continue anyway - the ExternalSecret will show an error if the key doesn't exist
+else
+  # Check if the secret already exists in Vault
+  if kubectl exec -n vault vault-0 -- env VAULT_TOKEN="${VAULT_ROOT_TOKEN}" vault kv get secret/teslamate/config >/dev/null 2>&1; then
+    echo "✅ Encryption key already exists in Vault"
+  else
+    echo "Generating new encryption key..."
+    ENCRYPTION_KEY=$(openssl rand -base64 32)
+    
+    # Write to Vault using root token
+    if kubectl exec -n vault vault-0 -- env VAULT_TOKEN="${VAULT_ROOT_TOKEN}" vault kv put secret/teslamate/config encryption_key="${ENCRYPTION_KEY}"; then
+      echo "✅ Encryption key stored in Vault"
+    else
+      echo "❌ Failed to write to Vault"
+      echo "Please create the encryption key manually:"
+      echo "  kubectl exec -n vault vault-0 -- env VAULT_TOKEN=\"${VAULT_ROOT_TOKEN}\" vault kv put secret/teslamate/config encryption_key=\"${ENCRYPTION_KEY}\""
+      exit 1
+    fi
+  fi
+fi
+
+# 7) Apply Teslamate config ExternalSecret
+echo "Applying Teslamate config ExternalSecret..."
+kubectl apply -f teslamate/external-secret.yaml
+
+# 8) Wait for teslamate-config-secret to be created
+echo "Waiting for teslamate-config-secret to be synced from Vault..."
+SECRET_SYNCED=false
+for i in {1..30}; do
+  if kubectl -n "${NS}" get secret teslamate-config-secret >/dev/null 2>&1; then
+    echo "✅ teslamate-config-secret synced successfully"
+    SECRET_SYNCED=true
+    break
+  fi
+  echo "  waiting for secret... (attempt $i/30)"
+  sleep 2
+done
+
+# 9) If ESO failed to sync, create secret manually as fallback
+if [ "$SECRET_SYNCED" = "false" ]; then
+  echo "⚠️  ExternalSecret failed to sync (ClusterSecretStore issue)"
+  echo "Creating teslamate-config-secret manually from Vault..."
+  
+  if [ -n "$VAULT_ROOT_TOKEN" ]; then
+    ENCRYPTION_KEY=$(kubectl exec -n vault vault-0 -- env VAULT_TOKEN="${VAULT_ROOT_TOKEN}" vault kv get -field=encryption_key secret/teslamate/config 2>/dev/null || echo "")
+    
+    if [ -n "$ENCRYPTION_KEY" ]; then
+      kubectl create secret generic teslamate-config-secret -n "${NS}" \
+        --from-literal=encryption-key="${ENCRYPTION_KEY}" \
+        --dry-run=client -o yaml | kubectl apply -f -
+      echo "✅ Created teslamate-config-secret manually"
+    else
+      echo "❌ Failed to retrieve encryption key from Vault"
+      exit 1
+    fi
+  else
+    echo "❌ Cannot create secret manually - no Vault token"
+    exit 1
+  fi
+fi
+
+echo "✅ Teslamate bootstrap complete - fully automated!"