init: core project files

2026-06-30 15:42:25 +04:00
commit eb2db782f3
5 changed files with 466 additions and 0 deletions
@@ -0,0 +1,127 @@
+# DevOps Runbook: Provider Build Pipeline
+
+This repo root contains the 4 scripts for the full provider build pipeline.
+
+## Overview
+
+1) Generate YAML specs from API
+2) Generate Go resources + documentation files from YAML
+3) Build and upload provider binaries for 3 OS targets
+4) Build and publish documentation site
+
+## Prerequisites
+
+- Go 1.22+
+- `python3`
+- `gpg`
+- `mc` (MinIO/S3 client)
+- Docker (for mkdocs build)
+
+## Shared settings
+
+S3 environment:
+- `S3_ENDPOINT` (example: `https://s3.msk-1.ngcloud.ru`)
+- `S3_ACCESS_KEY`
+- `S3_SECRET_KEY`
+
+Provider naming defaults:
+- `REGISTRY_HOSTNAME`: `terra.k8c.ru`
+- `NAMESPACE`: `nubes`
+- `NAME`: `nubes`
+
+## Step 1: Generate YAMLs from API
+
+Script: `01_generate_yamls.sh`
+
+Input list of services:
+- `services_list.txt` (service_id only)
+
+Token options:
+- `TOKEN_FILE=/home/naeel/terra/HH-MM-SS.token`, or
+- `NUBES_API_TOKEN` directly
+
+Example:
+```bash
+export TOKEN_FILE=/home/naeel/terra/08-33-41.token
+./01_generate_yamls.sh
+```
+
+## Step 2: Generate Go resources and docs
+
+Script: `02_generate_resources_and_docs.sh`
+
+Example:
+```bash
+./02_generate_resources_and_docs.sh
+```
+
+Outputs:
+- Go files in `universal_rebuild/internal/resources_gen`
+- Docs in `docs/30_registry/resources`
+
+## Step 3: Build and upload provider
+
+Script: `03_build_and_upload_provider.sh`
+
+Uses `registry-server-build/build-provider.sh` and signs with:
+- `secrets/private_key.asc` (ignored by git)
+
+Example:
+```bash
+export S3_ENDPOINT=https://s3.msk-1.ngcloud.ru
+export S3_ACCESS_KEY=...
+export S3_SECRET_KEY=...
+./03_build_and_upload_provider.sh 2.0.2
+```
+
+## Step 4: Build and publish docs
+
+Script: `04_build_and_publish_docs.sh`
+
+Example:
+```bash
+export S3_ENDPOINT=https://s3.msk-1.ngcloud.ru
+export S3_ACCESS_KEY=...
+export S3_SECRET_KEY=...
+./04_build_and_publish_docs.sh 2.0.2
+```
+
+## Notes
+
+- The GPG private key must remain stable across releases. Do not regenerate per build.
+- If the key is regenerated, the registry server must be updated to serve the new public key.
+- Terraform will fail with `authentication signature from unknown issuer` if the registry public key does not match the signing key.
+- `services_list.txt` is the source of truth for which services are generated.
+- If the provider version changes, update `universal_rebuild/main.go`.
+
+## One-time GPG bootstrap (do this once, keep the key stable)
+
+1) Generate and export keys (no passphrase):
+```bash
+GPG_DIR=${ROOT_DIR}/secrets
+GNUPGHOME=$(mktemp -d)
+cat > /tmp/gpg_batch <<'EOF'
+%no-protection
+Key-Type: RSA
+Key-Length: 4096
+Subkey-Type: RSA
+Subkey-Length: 4096
+Name-Real: tazet@narod.ru
+Name-Email: tazet@narod.ru
+Expire-Date: 0
+EOF
+gpg --batch --homedir "$GNUPGHOME" --gen-key /tmp/gpg_batch
+gpg --batch --homedir "$GNUPGHOME" --armor --export-secret-keys > "$GPG_DIR/private_key.asc"
+gpg --batch --homedir "$GNUPGHOME" --armor --export > "$GPG_DIR/public_key.asc"
+rm -rf "$GNUPGHOME" /tmp/gpg_batch
+```
+
+2) Update registry server public key (ASCII Armor) in:
+- `registry-server-build/main.go`
+- `operator/cmd/registry/main.go`
+
+3) Rebuild and redeploy the registry server (see `docs/50_history/00_system_mechanics.md`).
+
+4) Build and upload provider artifacts as usual.
+
+# check string