From 732c303a4f0420efdc44613510ca148a7957b78c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 31 Jul 2026 08:41:15 +0000 Subject: [PATCH] Update install instructions from guided-setup --- .../guided-setup/cloudscale-decommission.adoc | 131 ++++++++++++------ .../guided-setup/exoscale-decommission.adoc | 112 ++++++--------- 2 files changed, 134 insertions(+), 109 deletions(-) diff --git a/docs/modules/ROOT/partials/guided-setup/cloudscale-decommission.adoc b/docs/modules/ROOT/partials/guided-setup/cloudscale-decommission.adoc index ba31dc88..0400e651 100644 --- a/docs/modules/ROOT/partials/guided-setup/cloudscale-decommission.adoc +++ b/docs/modules/ROOT/partials/guided-setup/cloudscale-decommission.adoc @@ -13,20 +13,21 @@ *   <> *   <> *   <> -* <> -*   <> -*   <> -* <> -*   <> -*   <> -*   <> -*   <> -*   <> -*   <> -* <> -*   <> -*   <> -*   <> +* <> +* <> +*   <> +*   <> +* <> +*   <> +*   <> +*   <> +*   <> +*   <> +*   <> +* <> +*   <> +*   <> +*   <> [[step-1]] === Given I have all prerequisites installed @@ -609,6 +610,34 @@ kubectl get nodes ---- [[step-14]] +=== Then I compile the cluster catalog + +This step compiles the catalog to ensure you have a local checkout of the cluster repository +during decommissioning. + +==== Inputs + +* `commodore_cluster_id` + +==== Script + +[source,bash] +---- +OUTPUT=$(mktemp) + +# export INPUT_commodore_cluster_id= + +set -euo pipefail +commodore catalog compile ${INPUT_commodore_cluster_id} + + +# echo "# Outputs" +# cat "$OUTPUT" +# rm -f "$OUTPUT" + +---- + +[[step-15]] === Then I save the loadbalancer metadata This step gathers metadata on the LoadBalancer instances (such as their icinga zone and backup server), such that they can be properly decommissioned down the line. @@ -730,7 +759,7 @@ popd ---- -[[step-15]] +[[step-16]] === And I downtime the loadbalancers in icinga In this step you have to configure downtimes in Icinga for the cluster's load balancers. @@ -769,7 +798,7 @@ sleep 2 ---- -[[step-16]] +[[step-17]] === And I decommission Terraform resources This step decommissions all Terraform resources for the cluster. @@ -861,7 +890,7 @@ popd ---- -[[step-17]] +[[step-18]] === Then I delete Cloudscale server groups This step cleans up server groups configured for this cluster on Cloudscale. @@ -897,7 +926,7 @@ done ---- -[[step-18]] +[[step-19]] === And I delete all S3 buckets This step deletes the cluster's associated S3 buckets from Cloudscale. @@ -946,7 +975,7 @@ mc rb "${INPUT_commodore_cluster_id}/${INPUT_commodore_cluster_id}-logstore" --f ---- -[[step-19]] +[[step-20]] === And I delete the cluster backup This step deletes the cluster's associated backup bucket from Cloudscale. @@ -1069,7 +1098,7 @@ curl -i -H "Authorization: Bearer ${INPUT_cloudscale_token}" -X DELETE "$(echo " ---- -[[step-20]] +[[step-21]] === And I delete the cluster's API tokens This step deletes the cluster's associated Cloudscale API tokens from Cloudscale. @@ -1119,7 +1148,7 @@ echo " Success." ---- -[[step-21]] +[[step-22]] === And I remove the LoadBalancers from control.vshn.net In this step you need to remove the LoadBalancer servers from control.vshn.net @@ -1128,7 +1157,13 @@ In this step you need to remove the LoadBalancer servers from control.vshn.net * `lb_fqdn_1` * `lb_fqdn_2` -* `control_vshn_api_token` +* `control_vshn_api_token`: Your personal token for the control.vshn.net Servers API. +Be extra careful with the IP allowlist. + +If you can't be bothered to find/make one, put in a bogus value. +The spell will then guide you to manually delete the definitions. + + ==== Script @@ -1141,9 +1176,27 @@ OUTPUT=$(mktemp) # export INPUT_control_vshn_api_token= set -euo pipefail -echo "Deleting server definitions ..." -curl -XDELETE -H"$AUTH" https://control.vshn.net/api/servers/1/appuio/${INPUT_lb_fqdn_1} -curl -XDELETE -H"$AUTH" https://control.vshn.net/api/servers/1/appuio/${INPUT_lb_fqdn_2} + +AUTH="X-AccessToken: ${INPUT_control_vshn_api_token}" + +code="$( curl -H"$AUTH" https://control.vshn.net/api/servers/1/appuio/ -o /dev/null -w"%{http_code}" )" +if [[ "$code" != 200 ]] +then + echo '###################################################################################' + echo '# #' + echo "# Please manually delete the cluster's LoadBalancer servers before proceeding. #" + echo '# #' + echo '###################################################################################' + echo + echo You can go to: + echo https://control.vshn.net/servers/definitions/appuio/${INPUT_lb_fqdn_1}/delete + echo https://control.vshn.net/servers/definitions/appuio/${INPUT_lb_fqdn_2}/delete + sleep 2 + exit 0 +fi + +curl -XDELETE -H"$AUTH" https://control.vshn.net/api/servers/1/_/"${INPUT_lb_fqdn_1}" +curl -XDELETE -H"$AUTH" https://control.vshn.net/api/servers/1/_/"${INPUT_lb_fqdn_2}" echo "Server definitions deleted." @@ -1153,7 +1206,7 @@ echo "Server definitions deleted." ---- -[[step-22]] +[[step-23]] === And I decommission the LoadBalancers This step decommissions resources associated with the Puppet managed LoadBalancers. @@ -1185,9 +1238,9 @@ OUTPUT=$(mktemp) set -euo pipefail echo "# Clearing encdata caches ... #" # shellcheck disable=2029 -ssh nfs1.ch1.puppet.vshn.net "sudo rm /srv/nfs/export/puppetserver-puppetserver-enc-cache-pvc-*/${INPUT_lb_fqdn_1}.yaml" || true +ssh master8.puppet.vshn.net "sudo rm /etc/puppetlabs/code/enc/${INPUT_lb_fqdn_1}.yaml" || true # shellcheck disable=2029 -ssh nfs1.ch1.puppet.vshn.net "sudo rm /srv/nfs/export/puppetserver-puppetserver-enc-cache-pvc-*/${INPUT_lb_fqdn_2}.yaml" || true +ssh master8.puppet.vshn.net "sudo rm /etc/puppetlabs/code/enc/${INPUT_lb_fqdn_2}.yaml" || true echo "# Cleared encdata caches. #" echo echo "# Cleaning up LBs in icinga ... #" @@ -1259,13 +1312,13 @@ for lb in "${INPUT_lb_fqdn_1}" "${INPUT_lb_fqdn_2}" do for backup_server in "${INPUT_lb_backup_1}" "${INPUT_lb_backup_2}" do - # shellcheck disable=2029 - ssh "$backup_server" "sudo rm /var/lib/burp/CA/${lb}.crt" || true - # shellcheck disable=2029 - ssh "$backup_server" "sudo rm /var/lib/burp/CA/${lb}.csr" || true + # shellcheck disable=2029,2015 + ssh "$backup_server" "sudo rm /var/lib/burp/CA/${lb}.crt" && echo "Deleted ${lb}.crt from ${backup_server}." || true + # shellcheck disable=2029,2015 + ssh "$backup_server" "sudo rm /var/lib/burp/CA/${lb}.csr" && echo "Deleted ${lb}.csr from ${backup_server}." || true backup="/var/lib/burp/${lb}" - # shellcheck disable=2029 - ssh "$backup_server" "sudo rm -rf ${backup}" || true + # shellcheck disable=2029,2015 + ssh "$backup_server" "sudo rm -rf ${backup}" && echo "Deleted backup for ${lb} (if it existed) from ${backup_server}." || true done done echo "# Deleted backups from Burp server. #" @@ -1277,7 +1330,7 @@ echo "# Deleted backups from Burp server. #" ---- -[[step-23]] +[[step-24]] === And I remove the cluster's DNS entries In this step, you must manually remove any DNS entries associated with the cluster from https://git.vshn.net/vshn/vshn_zonefiles. @@ -1304,7 +1357,7 @@ sleep 2 ---- -[[step-24]] +[[step-25]] === Then I delete the cluster's Vault secrets This step cleans up all the cluster's Vault secrets. @@ -1376,7 +1429,7 @@ done ---- -[[step-25]] +[[step-26]] === And I delete the cluster's OpsGenie heartbeat This step deletes the cluster's OpsGenie heartbeat. @@ -1415,7 +1468,7 @@ curl "https://api.opsgenie.com/v2/heartbeats/${INPUT_commodore_cluster_id}" \ ---- -[[step-26]] +[[step-27]] === And I delete the cluster from Lieutenant This step deletes the cluster from Lieutenant @@ -1447,7 +1500,7 @@ curl -H "Authorization: Bearer $(commodore fetch-token)" -XDELETE \ ---- -[[step-27]] +[[step-28]] === And I delete the Keycloak service This step deletes the cluster's keycloak service from control.vshn.net diff --git a/docs/modules/ROOT/partials/guided-setup/exoscale-decommission.adoc b/docs/modules/ROOT/partials/guided-setup/exoscale-decommission.adoc index f8568f20..f077672b 100644 --- a/docs/modules/ROOT/partials/guided-setup/exoscale-decommission.adoc +++ b/docs/modules/ROOT/partials/guided-setup/exoscale-decommission.adoc @@ -11,7 +11,7 @@ *   <> *   <> *   <> -*   <> +* <> * <> *   <> *   <> @@ -550,19 +550,14 @@ sleep 2 ---- [[step-12]] -=== And I prepare the cluster repository +=== Then I compile the cluster catalog -This step prepares the local cluster repository by cloning the Commodore hieradata repository -and setting up the necessary configuration for the specified cluster. +This step compiles the catalog to ensure you have a local checkout of the cluster repository +during decommissioning. ==== Inputs -* `commodore_api_url` * `commodore_cluster_id` -* `commodore_tenant_id` -* `cluster_domain` -* `image_major` -* `image_minor` ==== Script @@ -570,57 +565,10 @@ and setting up the necessary configuration for the specified cluster. ---- OUTPUT=$(mktemp) -# export INPUT_commodore_api_url= # export INPUT_commodore_cluster_id= -# export INPUT_commodore_tenant_id= -# export INPUT_cluster_domain= -# export INPUT_image_major= -# export INPUT_image_minor= set -euo pipefail - -export COMMODORE_API_URL="${INPUT_commodore_api_url}" - -rm -rf inventory/classes/ -mkdir -p inventory/classes/ -git clone "$(curl -sH"Authorization: Bearer $(commodore fetch-token)" "${INPUT_commodore_api_url}/tenants/${INPUT_commodore_tenant_id}" | jq -r '.gitRepo.url')" inventory/classes/${INPUT_commodore_tenant_id} - -pushd "inventory/classes/${INPUT_commodore_tenant_id}/" - -yq eval -i ".parameters.openshift.baseDomain = \"${INPUT_cluster_domain}\"" \ - ${INPUT_commodore_cluster_id}.yml - -git diff --exit-code --quiet || git commit -a -m "Configure cluster domain for ${INPUT_commodore_cluster_id}" - -if ls openshift4.y*ml 1>/dev/null 2>&1; then - yq eval -i '.classes += ".openshift4"' ${INPUT_commodore_cluster_id}.yml; - git diff --exit-code --quiet || git commit -a -m "Include openshift4 class for ${INPUT_commodore_cluster_id}" -fi - -yq eval -i '.applications += ["exoscale-cloud-controller-manager"]' ${INPUT_commodore_cluster_id}.yml -yq eval -i '.applications = (.applications | unique)' ${INPUT_commodore_cluster_id}.yml -git diff --exit-code --quiet || git commit -a -m "Deploy Exoscale cloud-controller-manager on ${INPUT_commodore_cluster_id}" - - -yq eval -i '.applications += ["cilium"]' ${INPUT_commodore_cluster_id}.yml -yq eval -i '.applications = (.applications | unique)' ${INPUT_commodore_cluster_id}.yml - -yq eval -i '.parameters.openshift.infraID = "TO_BE_DEFINED"' ${INPUT_commodore_cluster_id}.yml -yq eval -i '.parameters.openshift.clusterID = "TO_BE_DEFINED"' ${INPUT_commodore_cluster_id}.yml - -yq eval -i '.parameters.cilium.olm.generate_olm_deployment = true' ${INPUT_commodore_cluster_id}.yml - -git diff --exit-code --quiet || git commit -a -m "Add Cilium addon to ${INPUT_commodore_cluster_id}" - -git push - -popd - -commodore catalog compile ${INPUT_commodore_cluster_id} --push \ - --dynamic-fact kubernetesVersion.major=1 \ - --dynamic-fact kubernetesVersion.minor="$((INPUT_image_minor+13))" \ - --dynamic-fact openshiftVersion.Major=${INPUT_image_major} \ - --dynamic-fact openshiftVersion.Minor=${INPUT_image_minor} +commodore catalog compile ${INPUT_commodore_cluster_id} # echo "# Outputs" @@ -1036,7 +984,7 @@ then fi # proceed with deleting the backup bucket -exo storage rb -r -f "${INPUT_commodore_cluster_id}-backup" || true +exo storage rb -r -f "${INPUT_commodore_cluster_id}-cluster-backup" || true # echo "# Outputs" @@ -1095,7 +1043,13 @@ In this step you need to remove the LoadBalancer servers from control.vshn.net * `lb_fqdn_1` * `lb_fqdn_2` -* `control_vshn_api_token` +* `control_vshn_api_token`: Your personal token for the control.vshn.net Servers API. +Be extra careful with the IP allowlist. + +If you can't be bothered to find/make one, put in a bogus value. +The spell will then guide you to manually delete the definitions. + + ==== Script @@ -1108,9 +1062,27 @@ OUTPUT=$(mktemp) # export INPUT_control_vshn_api_token= set -euo pipefail -echo "Deleting server definitions ..." -curl -XDELETE -H"$AUTH" https://control.vshn.net/api/servers/1/appuio/${INPUT_lb_fqdn_1} -curl -XDELETE -H"$AUTH" https://control.vshn.net/api/servers/1/appuio/${INPUT_lb_fqdn_2} + +AUTH="X-AccessToken: ${INPUT_control_vshn_api_token}" + +code="$( curl -H"$AUTH" https://control.vshn.net/api/servers/1/appuio/ -o /dev/null -w"%{http_code}" )" +if [[ "$code" != 200 ]] +then + echo '###################################################################################' + echo '# #' + echo "# Please manually delete the cluster's LoadBalancer servers before proceeding. #" + echo '# #' + echo '###################################################################################' + echo + echo You can go to: + echo https://control.vshn.net/servers/definitions/appuio/${INPUT_lb_fqdn_1}/delete + echo https://control.vshn.net/servers/definitions/appuio/${INPUT_lb_fqdn_2}/delete + sleep 2 + exit 0 +fi + +curl -XDELETE -H"$AUTH" https://control.vshn.net/api/servers/1/_/"${INPUT_lb_fqdn_1}" +curl -XDELETE -H"$AUTH" https://control.vshn.net/api/servers/1/_/"${INPUT_lb_fqdn_2}" echo "Server definitions deleted." @@ -1152,9 +1124,9 @@ OUTPUT=$(mktemp) set -euo pipefail echo "# Clearing encdata caches ... #" # shellcheck disable=2029 -ssh nfs1.ch1.puppet.vshn.net "sudo rm /srv/nfs/export/puppetserver-puppetserver-enc-cache-pvc-*/${INPUT_lb_fqdn_1}.yaml" || true +ssh master8.puppet.vshn.net "sudo rm /etc/puppetlabs/code/enc/${INPUT_lb_fqdn_1}.yaml" || true # shellcheck disable=2029 -ssh nfs1.ch1.puppet.vshn.net "sudo rm /srv/nfs/export/puppetserver-puppetserver-enc-cache-pvc-*/${INPUT_lb_fqdn_2}.yaml" || true +ssh master8.puppet.vshn.net "sudo rm /etc/puppetlabs/code/enc/${INPUT_lb_fqdn_2}.yaml" || true echo "# Cleared encdata caches. #" echo echo "# Cleaning up LBs in icinga ... #" @@ -1226,13 +1198,13 @@ for lb in "${INPUT_lb_fqdn_1}" "${INPUT_lb_fqdn_2}" do for backup_server in "${INPUT_lb_backup_1}" "${INPUT_lb_backup_2}" do - # shellcheck disable=2029 - ssh "$backup_server" "sudo rm /var/lib/burp/CA/${lb}.crt" || true - # shellcheck disable=2029 - ssh "$backup_server" "sudo rm /var/lib/burp/CA/${lb}.csr" || true + # shellcheck disable=2029,2015 + ssh "$backup_server" "sudo rm /var/lib/burp/CA/${lb}.crt" && echo "Deleted ${lb}.crt from ${backup_server}." || true + # shellcheck disable=2029,2015 + ssh "$backup_server" "sudo rm /var/lib/burp/CA/${lb}.csr" && echo "Deleted ${lb}.csr from ${backup_server}." || true backup="/var/lib/burp/${lb}" - # shellcheck disable=2029 - ssh "$backup_server" "sudo rm -rf ${backup}" || true + # shellcheck disable=2029,2015 + ssh "$backup_server" "sudo rm -rf ${backup}" && echo "Deleted backup for ${lb} (if it existed) from ${backup_server}." || true done done echo "# Deleted backups from Burp server. #"