纳管并验收 Nexus OCI 仓库

2026-09-20 20:46:26 +00:00
parent ab985c7979
commit 7bdd152db9
6 changed files with 198 additions and 12 deletions
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="${1:---check}"
+case "$mode" in
+  --check | --apply) ;;
+  *) echo "usage: $0 [--check|--apply]" >&2; exit 2 ;;
+esac
+
+: "${TF_VAR_nexus_url:?set TF_VAR_nexus_url}"
+: "${TF_VAR_nexus_username:?set TF_VAR_nexus_username}"
+: "${TF_VAR_nexus_password:?set TF_VAR_nexus_password}"
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+auth_file="$(mktemp /tmp/nexus-oci-auth.XXXXXX)"
+trap 'rm -f -- "$auth_file"' EXIT
+chmod 0600 "$auth_file"
+printf 'machine %s\nlogin %s\npassword %s\n' \
+  "${TF_VAR_nexus_url#*://}" "$TF_VAR_nexus_username" \
+  "$TF_VAR_nexus_password" >"$auth_file"
+
+drift=0
+for entry in \
+  "hosted:$script_dir/oci/oci-hosted.json" \
+  "proxy:$script_dir/oci/oci-proxy.json" \
+  "group:$script_dir/oci/oci-public.json"; do
+  repository_type="${entry%%:*}"
+  desired_file="${entry#*:}"
+  repository_name="$(jq -er '.name' "$desired_file")"
+  endpoint="$TF_VAR_nexus_url/service/rest/v1/repositories/oci/$repository_type"
+  current_file="$(mktemp /tmp/nexus-oci-current.XXXXXX)"
+
+  status="$(curl --silent --show-error --netrc-file "$auth_file" \
+    --output "$current_file" --write-out '%{http_code}' \
+    "$endpoint/$repository_name")"
+
+  if [[ "$status" == 404 ]]; then
+    drift=1
+    if [[ "$mode" == --apply ]]; then
+      curl --fail --silent --show-error --netrc-file "$auth_file" \
+        --header 'Content-Type: application/json' \
+        --data-binary "@$desired_file" "$endpoint"
+      echo "created $repository_name"
+    else
+      echo "missing $repository_name" >&2
+    fi
+  elif [[ "$status" == 200 ]]; then
+    if jq -e --slurpfile desired "$desired_file" '
+      def subset($actual; $wanted):
+        if ($wanted | type) == "object" then
+          all($wanted | keys[];
+            ($actual[.] != null) and subset($actual[.]; $wanted[.]))
+        else
+          $actual == $wanted
+        end;
+      subset(.; $desired[0])
+    ' "$current_file" >/dev/null; then
+      echo "in sync $repository_name"
+    else
+      drift=1
+      if [[ "$mode" == --apply ]]; then
+        curl --fail --silent --show-error --netrc-file "$auth_file" \
+          --request PUT --header 'Content-Type: application/json' \
+          --data-binary "@$desired_file" "$endpoint/$repository_name"
+        echo "updated $repository_name"
+      else
+        echo "drifted $repository_name" >&2
+      fi
+    fi
+  else
+    cat "$current_file" >&2
+    echo "unexpected HTTP $status for $repository_name" >&2
+    exit 1
+  fi
+  rm -f -- "$current_file"
+done
+
+if [[ "$mode" == --check && "$drift" -ne 0 ]]; then
+  exit 1
+fi