wangbo
7c142f5960
阿里云 OSS 的 S3 兼容层要求 virtual-hosted addressing，且 boto3 需要使用 Signature V2。本提交为 Barman 的归档、备份、保留与恢复统一挂载 AWS 配置，并将实际 WAL 归档和近期全备设为切换硬门禁。 同时补充 CNPG/etcdutl 固定版本安装、显式主库切换、三节点逐台停机、OSS 快照下载校验与远端临时 Secret 清理。已通过 ShellCheck、Kustomize、服务端 dry-run、迁移测试、发布脚本测试、敏感信息扫描及生产 precutover 验收。
61 lines
2.6 KiB
Bash
Executable File
61 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck source=scripts/cluster/common.sh
|
|
source "$script_dir/common.sh"
|
|
load_cluster_env
|
|
|
|
cluster_scp "$script_dir/oss-object.mjs" \
|
|
"$CLUSTER_NINGBO_HOST:/root/easyai-oss-object.mjs"
|
|
cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
working_directory=$(mktemp -d)
|
|
cleanup() {
|
|
find "$working_directory" -type f -delete
|
|
find "$working_directory" -depth -type d -empty -delete
|
|
[[ ! -e /root/easyai-oss-object.mjs && ! -L /root/easyai-oss-object.mjs ]] ||
|
|
unlink /root/easyai-oss-object.mjs
|
|
}
|
|
trap cleanup EXIT HUP INT TERM
|
|
command -v etcdutl >/dev/null
|
|
command -v unzip >/dev/null
|
|
command -v node >/dev/null
|
|
|
|
snapshot_name=acceptance-$(date -u '+%Y%m%dT%H%M%SZ')
|
|
k3s etcd-snapshot save --name "$snapshot_name" >/dev/null 2>&1
|
|
snapshot=$(find /var/lib/rancher/k3s/server/db/snapshots -maxdepth 1 -type f \
|
|
-name "$snapshot_name-*" -printf '%T@ %p\n' | sort -rn | awk 'NR == 1 { sub(/^[^ ]+ /, ""); print }')
|
|
[[ -n $snapshot && -s $snapshot ]]
|
|
snapshot_file=$(basename "$snapshot")
|
|
s3_location=$(k3s etcd-snapshot ls -o json 2>/dev/null |
|
|
jq -r --arg name "s3-$snapshot_file" \
|
|
'.items[] | select(.metadata.name == $name and .status.readyToUse == true) |
|
|
.spec.location')
|
|
|
|
export ALI_KEY ALI_SECRET ALI_REGION ALI_BUCKET
|
|
ALI_KEY=$(k3s kubectl get secret easyai-etcd-s3 -n kube-system \
|
|
-o jsonpath='{.data.etcd-s3-access-key}' | base64 -d)
|
|
ALI_SECRET=$(k3s kubectl get secret easyai-etcd-s3 -n kube-system \
|
|
-o jsonpath='{.data.etcd-s3-secret-key}' | base64 -d)
|
|
ALI_REGION=$(k3s kubectl get secret easyai-etcd-s3 -n kube-system \
|
|
-o jsonpath='{.data.etcd-s3-region}' | base64 -d)
|
|
ALI_BUCKET=$(k3s kubectl get secret easyai-etcd-s3 -n kube-system \
|
|
-o jsonpath='{.data.etcd-s3-bucket}' | base64 -d)
|
|
[[ $s3_location == \
|
|
"s3://$ALI_BUCKET/easyai-ai-gateway/production/k3s-etcd/$snapshot_file" ]]
|
|
object_key=${s3_location#s3://"$ALI_BUCKET"/}
|
|
node /root/easyai-oss-object.mjs get "$object_key" \
|
|
"$working_directory/s3-snapshot.zip" >/dev/null
|
|
[[ $(sha256sum "$snapshot" | awk '{print $1}') == \
|
|
$(sha256sum "$working_directory/s3-snapshot.zip" | awk '{print $1}') ]]
|
|
|
|
archive_entry=$(unzip -Z1 "$working_directory/s3-snapshot.zip")
|
|
[[ -n $archive_entry && $archive_entry != *$'\n'* ]]
|
|
unzip -p "$working_directory/s3-snapshot.zip" "$archive_entry" \
|
|
>"$working_directory/snapshot.db"
|
|
etcdutl snapshot status "$working_directory/snapshot.db" -w json |
|
|
jq -e '.hash != null and .totalKey > 0 and .totalSize > 0' >/dev/null
|
|
echo "etcd_backup_verification=PASS snapshot=$snapshot_file local=true oss_download=true status=true"
|
|
REMOTE
|