unkinben
9b3fa83dac
Container entrypoints were rendered as `fmt.Sprintf` shell strings in Go, so every entrypoint fix needed a full operator release, nothing was shellcheckable, and the escaping was a hazard. How: - Add a `kea-init` initContainer that finalises the per-pod config and bounded-waits for HA peer DNS, replacing the in-entrypoint retry. It hardens the shared run dir to 0750, substitutes `this-server-name` from the pod ordinal (`POD_NAME` via the downward API), stages both configs into the shared emptyDir, and gates on `kea-dhcp4 -t` (60x2s) — failing loud after the cap so the kubelet restarts it instead of starting a doomed server. - Run the main kea-dhcp4 / kea-ctrl-agent containers with kea exec'd directly, dropping both wrapper shells. - Replace the two `fmt.Sprintf` entrypoints with a single committed `internal/kea/scripts/init.sh` embedded via `go:embed` and parameterised entirely by env vars — no Go string interpolation. - Add a shellcheck step to the pre-commit pipeline. Test: - Assert the pod shape: one kea-init initContainer, POD_NAME from the downward API, main containers exec kea directly, and the ConfigMap carries init.sh (not the old per-container entrypoints). - Assert init.sh hardens the socket dir, gates on `kea-dhcp4 -t`, fails loud after the cap, and is free of fmt verbs. - shellcheck the embedded script.
42 lines
1.7 KiB
Bash
42 lines
1.7 KiB
Bash
#!/bin/sh
|
|
# kea-operator initContainer.
|
|
#
|
|
# Prepares the shared run dir, finalises this pod's kea-dhcp4 config (the HA
|
|
# this-server-name is derived from the StatefulSet ordinal, known only at pod
|
|
# start), and waits for the HA peer DNS to resolve before the main kea
|
|
# containers start. Every input arrives as an environment variable set by the
|
|
# operator; nothing is interpolated into this file, so it is shellcheck-clean
|
|
# and testable on its own.
|
|
set -eu
|
|
|
|
# StatefulSet pod names are "<sts>-<ordinal>"; the ordinal is this HA peer's id.
|
|
ord="${POD_NAME##*-}"
|
|
|
|
# The run dir is a shared emptyDir. Kea 2.6+ refuses a control socket in a
|
|
# world-accessible directory, so tighten it to 0750.
|
|
mkdir -p "$RUN_DIR"
|
|
chmod 0750 "$RUN_DIR"
|
|
|
|
# Finalise the per-pod dhcp4 config: substitute this pod's HA peer name into the
|
|
# shared (pod-independent) config projected from the ConfigMap.
|
|
sed "s/${THIS_SERVER_PLACEHOLDER}/server${ord}/g" \
|
|
"${CONFIG_DIR}/kea-dhcp4.conf" >"$DHCP4_CONF"
|
|
|
|
# The ctrl-agent config is pod-independent; stage it in the shared run dir so
|
|
# the main container can exec kea directly with no wrapper.
|
|
cp "${CONFIG_DIR}/kea-ctrl-agent.conf" "$CTRL_AGENT_CONF"
|
|
|
|
# The HA hook resolves peer URL hostnames once at load; on a cold start the
|
|
# StatefulSet peer DNS records may not resolve yet and kea exits hard instead of
|
|
# retrying. Wait (bounded) for the config to validate, then fail loud so the
|
|
# kubelet restarts this initContainer rather than starting a doomed server.
|
|
i=0
|
|
until "$DHCP4_BIN" -t "$DHCP4_CONF" >/dev/null 2>&1; do
|
|
i=$((i + 1))
|
|
if [ "$i" -ge "$WAIT_ATTEMPTS" ]; then
|
|
echo "kea-init: config failed to validate after ${WAIT_ATTEMPTS} attempts" >&2
|
|
exit 1
|
|
fi
|
|
sleep "$WAIT_SLEEP"
|
|
done
|