Port DEV-1224 installer hardening and cleanup from terraform-oci-red5pro - #31
Open
iolesyk wants to merge 2 commits into
Open
Port DEV-1224 installer hardening and cleanup from terraform-oci-red5pro#31iolesyk wants to merge 2 commits into
iolesyk wants to merge 2 commits into
Conversation
Ports the same batch of fixes/cleanup applied to the Oracle module's
feature/DEV-1224 branch, adapted for GCP:
- Fix SM2.0 as-kafka-init missing dependency on kafka0 with KAFKA_REPLICAS=0
- Merge with-ssl/without-ssl docker-compose files into base + ssl override
- Sync r5p_create_node_group.sh with newer reference version (Mixer role,
CPU-based scaling, DO/OPENSTACK platforms; no Video Packager)
- Remove dead Restreamer/RMQ/Analytics node-group propertyOverrides and
their orphaned Terraform variables (node_group_*_connection_limit,
node_config_restreamer)
- Add Google DNS fallback to installer scripts so apt/curl don't stall
when the cloud provider's default resolver is slow right after boot
- Suppress secret values (SSL keys, Kafka SASL config) from remote-exec
console output
- main.tf cleanup: dedupe connection {} blocks, simplify locals, batch
.env writes where the same duplication existed in this module
- AS_ADMIN_UI_VERSION now sources from stream_manager_version; removed
the now-unused stream_manager_admin_ui_version variable
- Fixed install_google_cloud_ops_agent() to be set -e safe now that
r5p_kafka_install.sh runs under set -euo pipefail
See the CHANGES-installer-hardening.md changelog for the full rationale
behind each change.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
iolesyk
force-pushed
the
feature/DEV-1224
branch
from
August 3, 2026 16:25
0932413 to
5bf654c
Compare
…cope Port the changes from terraform-oci-red5pro. The Let's Encrypt path was broken here: r5p_ssl_check_sm2.sh still looked for autoscaling-with-ssl/docker-compose.yml, a directory that no longer exists since the compose files were merged into a base plus docker-compose.ssl.yml overlay, so the script exited instead of ever enabling TLS. r5p_ssl_check_sm2.sh: - Layer docker-compose.ssl.yml from the installer directory and build COMPOSE_FILE from the value already in .env, preserving any other overlay and staying idempotent. Do not delete the base compose file: it is the first entry of COMPOSE_FILE and the following restart needs it. - Wait for TRAEFIK_HOST, the FQDN Traefik serves and the ACME tls-challenge validates, rather than for the certificate identity, which may be a wildcard that never resolves. - Resolve through the zone's authoritative name server. Polling starts before the operator creates the A record, so the first lookup cached an NXDOMAIN for the SOA negative TTL and hid the record long after it existed. - Replace the fixed five minute sleep with a readiness gate on the admin health endpoint, requiring consecutive successes. Restarting while docker compose was still starting the stack corrupted it. - Report whether the stack actually serves HTTPS after the restart. r5p_ssl_check_install.sh: - Same authoritative name server resolution for the standalone certbot path, where a cached NXDOMAIN also delayed certificate issuance. Installer and terraform: - Gate the Let's Encrypt path on TRAEFIK_HOST instead of SM_SSL_DOMAIN, and stop exporting SM_SSL_DOMAIN, which nothing consumes any more. - Reject https_ssl_certificate=letsencrypt for type=autoscale with a precondition on the load balancer resource - the GCP load balancer only gets an SSL certificate for imported or existing certificates, so the ACME challenge can never complete. Docs: - https_ssl_certificate_domain_name documented for the scenarios where it is actually read. Remove it from the cluster and autoscale examples where it is unused, and drop the wildcard claim where the challenge type cannot issue one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Kafka/Stream Manager 2.0 installer hardening +
main.tfcleanup. No intended behavior change outside the fixes listed below.docker compose upfailing withas-kafka-init is missing dependency kafka0on every "autoscale" deployment (KAFKA_REPLICAS=0).apt/curlinstead of too late to help.r5p_create_node_group.shwith a newer reference script (Mixer role, CPU-based autoscalingmain.tf: deduped repeatedconnection {}/env blocks, dropped dead code, batched.envwrites.Breaking changes
node_group_origins_connection_limit,node_group_edges_connection_limit,node_group_transcoders_connection_limit,node_config_restreamer,stream_manager_admin_ui_version. Remove these from.tfvarsbefore applying, orterraform applywill error.