Skip to content

Commit 43bd7d8

Browse files
theo-learnerclaude
theo-learner
and
claude
committed
refactor: use AWS CLI profiles instead of raw keys in install.sh
Replace direct AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY storage in .env.local with standard ~/.aws/credentials via AWS CLI profiles. Interactive mode: detect ~/.aws existence → list profiles or run `aws configure --profile <name>` for first-time setup. Non-interactive mode: migrate env var keys to ~/.aws/credentials automatically. setup_k8s() now uses `--profile` flag instead of env var credentials. Also improve dashboard: activity log score badges with mini progress bars, component card resource bars (CPU/MEM), and component summary header showing total vCPU and running pod count. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 35971df commit 43bd7d8

File tree

2 files changed

+191
-64
lines changed

2 files changed

+191
-64
lines changed

‎scripts/install.sh‎

Lines changed: 77 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,10 @@
1919
# Optional:
2020
# AI_GATEWAY_URL=https://... # AI Gateway (default: official gateway)
2121
# AWS_CLUSTER_NAME=my-cluster # EKS cluster (simulation mode if not set)
22-
# AWS_ACCESS_KEY_ID=AKIAxxxx # AWS credentials (required if AWS_CLUSTER_NAME is set)
23-
# AWS_SECRET_ACCESS_KEY=xxxx # AWS credentials
24-
# AWS_REGION=ap-northeast-2 # AWS region (auto-detect from EC2 IMDS if omitted)
22+
# AWS_PROFILE=my-cluster # AWS CLI profile (default: same as AWS_CLUSTER_NAME)
23+
# AWS_ACCESS_KEY_ID=AKIAxxxx # AWS keys → stored in ~/.aws/credentials, not .env.local
24+
# AWS_SECRET_ACCESS_KEY=xxxx # (only needed if ~/.aws/credentials doesn't exist yet)
25+
# AWS_REGION=ap-northeast-2 # AWS region (auto-detect from profile or EC2 IMDS)
2526
# K8S_NAMESPACE=default # K8s namespace
2627
# K8S_APP_PREFIX=op # K8s pod label prefix
2728
# K8S_STATEFULSET_PREFIX= # StatefulSet name prefix (e.g., sepolia-thanos-stack)
@@ -59,6 +60,16 @@ warn() { echo -e "${YELLOW}[WARNING]${NC} $*"; }
5960
err() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
6061
info() { echo -e "${CYAN}[INFO]${NC} $*"; }
6162

63+
# Store AWS credentials in ~/.aws/credentials using aws CLI (standard location)
64+
store_aws_credentials() {
65+
local profile="$1" key_id="$2" secret="$3" region="${4:-}"
66+
aws configure set aws_access_key_id "${key_id}" --profile "${profile}"
67+
aws configure set aws_secret_access_key "${secret}" --profile "${profile}"
68+
[ -n "${region}" ] && aws configure set region "${region}" --profile "${profile}"
69+
aws configure set output json --profile "${profile}"
70+
log "AWS credentials saved to ~/.aws/credentials (profile: ${profile})"
71+
}
72+
6273
# ============================================================
6374
# OS Detection
6475
# ============================================================
@@ -264,6 +275,14 @@ setup_env() {
264275
# All other vars (AWS_CLUSTER_NAME, L1_RPC_URLS, EOA, etc.)
265276
# are read directly from the environment — no mapping needed.
266277

278+
# Store AWS keys in ~/.aws/credentials (standard location, mounted by Docker)
279+
if [ -n "${AWS_CLUSTER_NAME:-}" ] && [ -n "${AWS_ACCESS_KEY_ID:-}" ] && [ -n "${AWS_SECRET_ACCESS_KEY:-}" ]; then
280+
AWS_PROFILE="${AWS_PROFILE:-${AWS_CLUSTER_NAME}}"
281+
store_aws_credentials "${AWS_PROFILE}" "${AWS_ACCESS_KEY_ID}" "${AWS_SECRET_ACCESS_KEY}" "${AWS_REGION:-}"
282+
elif [ -n "${AWS_CLUSTER_NAME:-}" ]; then
283+
AWS_PROFILE="${AWS_PROFILE:-${AWS_CLUSTER_NAME}}"
284+
fi
285+
267286
# --- Interactive mode ---
268287
else
269288
echo ""
@@ -323,34 +342,53 @@ setup_env() {
323342
warn "AWS_CLUSTER_NAME not set. Running in simulation mode without K8s monitoring."
324343
else
325344
# K8s namespace and pod prefix (only if cluster is set)
326-
read -rp " K8S_NAMESPACE [default]: " K8S_NAMESPACE
327-
K8S_NAMESPACE="${K8S_NAMESPACE:-default}"
345+
read -rp " K8S_NAMESPACE [${AWS_CLUSTER_NAME}]: " K8S_NAMESPACE
346+
K8S_NAMESPACE="${K8S_NAMESPACE:-${AWS_CLUSTER_NAME}}"
328347
read -rp " K8S_APP_PREFIX [op]: " K8S_APP_PREFIX
329348
K8S_APP_PREFIX="${K8S_APP_PREFIX:-op}"
330349
read -rp " K8S_STATEFULSET_PREFIX (e.g., sepolia-thanos-stack, press Enter if none): " K8S_STATEFULSET_PREFIX
331350
K8S_STATEFULSET_PREFIX="${K8S_STATEFULSET_PREFIX:-}"
332351

333-
# AWS credentials for EKS access
334-
echo ""
335-
echo -e " ${BOLD}AWS Credentials${NC} (for EKS cluster access):"
336-
read -rp " AWS Access Key ID: " AWS_ACCESS_KEY_ID
337-
read -rsp " AWS Secret Access Key: " AWS_SECRET_ACCESS_KEY
352+
# AWS Authentication — credentials stored in ~/.aws/ (standard, mounted by Docker)
338353
echo ""
339-
[[ -z "${AWS_ACCESS_KEY_ID}" || -z "${AWS_SECRET_ACCESS_KEY}" ]] \
340-
&& err "AWS credentials are required when AWS_CLUSTER_NAME is set."
354+
echo -e " ${BOLD}AWS Authentication${NC}"
355+
if [ -f "$HOME/.aws/credentials" ] && command -v aws &>/dev/null; then
356+
echo " Existing AWS profiles found:"
357+
aws configure list-profiles 2>/dev/null | sed 's/^/ /'
358+
read -rp " AWS Profile [${AWS_CLUSTER_NAME}]: " _profile_input
359+
AWS_PROFILE="${_profile_input:-${AWS_CLUSTER_NAME}}"
360+
# Create profile if it doesn't exist
361+
if ! aws configure list-profiles 2>/dev/null | grep -qx "${AWS_PROFILE}"; then
362+
warn "Profile '${AWS_PROFILE}' not found. Creating with 'aws configure'..."
363+
aws configure --profile "${AWS_PROFILE}"
364+
fi
365+
else
366+
echo " No AWS credentials found (~/.aws/credentials)."
367+
echo " Setting up AWS CLI profile: ${AWS_CLUSTER_NAME}"
368+
echo ""
369+
AWS_PROFILE="${AWS_CLUSTER_NAME}"
370+
aws configure --profile "${AWS_PROFILE}"
371+
fi
341372

342-
# AWS region (auto-detect from IMDS or manual)
343-
local _imds_region=""
344-
local _imds_tok
345-
_imds_tok=$(curl -sf -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 30" \
346-
--connect-timeout 1 http://169.254.169.254/latest/api/token 2>/dev/null || echo "")
347-
if [ -n "${_imds_tok}" ]; then
348-
_imds_region=$(curl -sf -H "X-aws-ec2-metadata-token: ${_imds_tok}" \
349-
--connect-timeout 2 http://169.254.169.254/latest/meta-data/placement/region 2>/dev/null || echo "")
373+
# Region auto-detect from profile
374+
local _profile_region
375+
_profile_region=$(aws configure get region --profile "${AWS_PROFILE}" 2>/dev/null || echo "")
376+
if [ -n "${_profile_region}" ]; then
377+
AWS_REGION="${_profile_region}"
378+
info "Region: ${AWS_REGION} (from profile: ${AWS_PROFILE})"
379+
else
380+
# Fallback to EC2 IMDS
381+
local _imds_region="" _imds_tok
382+
_imds_tok=$(curl -sf -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 30" \
383+
--connect-timeout 1 http://169.254.169.254/latest/api/token 2>/dev/null || echo "")
384+
if [ -n "${_imds_tok}" ]; then
385+
_imds_region=$(curl -sf -H "X-aws-ec2-metadata-token: ${_imds_tok}" \
386+
--connect-timeout 2 http://169.254.169.254/latest/meta-data/placement/region 2>/dev/null || echo "")
387+
fi
388+
local region_default="${_imds_region:-ap-northeast-2}"
389+
read -rp " AWS Region [${region_default}]: " AWS_REGION
390+
AWS_REGION="${AWS_REGION:-${region_default}}"
350391
fi
351-
local region_default="${_imds_region:-ap-northeast-2}"
352-
read -rp " AWS Region [${region_default}]: " AWS_REGION
353-
AWS_REGION="${AWS_REGION:-${region_default}}"
354392
fi
355393

356394
# L1 RPC Failover (optional)
@@ -433,8 +471,7 @@ setup_env() {
433471
: "${K8S_NAMESPACE:=default}"
434472
: "${K8S_APP_PREFIX:=op}"
435473
: "${K8S_STATEFULSET_PREFIX:=}"
436-
: "${AWS_ACCESS_KEY_ID:=}"
437-
: "${AWS_SECRET_ACCESS_KEY:=}"
474+
: "${AWS_PROFILE:=}"
438475
: "${AWS_REGION:=}"
439476
: "${L1_RPC_URLS:=}"
440477
: "${L1_PROXYD_ENABLED:=}"
@@ -480,12 +517,12 @@ ENVEOF
480517

481518
printf '\n# === K8s Monitoring ===\n'
482519
printf 'AWS_CLUSTER_NAME=%s\n' "${AWS_CLUSTER_NAME:-}"
520+
[ -n "${AWS_PROFILE}" ] && printf 'AWS_PROFILE=%s\n' "${AWS_PROFILE}"
483521
printf 'K8S_NAMESPACE=%s\n' "${K8S_NAMESPACE}"
484522
printf 'K8S_APP_PREFIX=%s\n' "${K8S_APP_PREFIX}"
485523
[ -n "${K8S_STATEFULSET_PREFIX}" ] && printf 'K8S_STATEFULSET_PREFIX=%s\n' "${K8S_STATEFULSET_PREFIX}"
486-
[ -n "${AWS_ACCESS_KEY_ID}" ] && printf 'AWS_ACCESS_KEY_ID=%s\n' "${AWS_ACCESS_KEY_ID}"
487-
[ -n "${AWS_SECRET_ACCESS_KEY}" ] && printf 'AWS_SECRET_ACCESS_KEY=%s\n' "${AWS_SECRET_ACCESS_KEY}"
488524
[ -n "${AWS_REGION}" ] && printf 'AWS_REGION=%s\n' "${AWS_REGION}"
525+
# AWS credentials: stored in ~/.aws/credentials (mounted by Docker)
489526

490527
printf '\n# === Scaling ===\n'
491528
printf 'SCALING_SIMULATION_MODE=%s\n' "${SCALING_SIMULATION_MODE}"
@@ -565,14 +602,17 @@ CADDYEOF
565602
# ============================================================
566603
setup_k8s() {
567604
[ -z "${AWS_CLUSTER_NAME:-}" ] && return
568-
[ -z "${AWS_ACCESS_KEY_ID:-}" ] && {
569-
warn "AWS credentials not set. Skipping K8s cluster setup."
605+
[ -z "${AWS_PROFILE:-}" ] && {
606+
warn "AWS_PROFILE not set. Skipping K8s cluster setup."
570607
return
571608
}
572609

573-
log "Setting up K8s cluster access..."
610+
log "Setting up K8s cluster access (profile: ${AWS_PROFILE})..."
574611

575-
# Auto-detect region from EC2 IMDS if not set
612+
# Auto-detect region from profile, then EC2 IMDS
613+
if [ -z "${AWS_REGION:-}" ]; then
614+
AWS_REGION=$(aws configure get region --profile "${AWS_PROFILE}" 2>/dev/null || echo "")
615+
fi
576616
if [ -z "${AWS_REGION:-}" ]; then
577617
local imds_token
578618
imds_token=$(curl -sf -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 30" \
@@ -589,15 +629,13 @@ setup_k8s() {
589629
return
590630
fi
591631

592-
log "Region: ${AWS_REGION}, Cluster: ${AWS_CLUSTER_NAME}"
632+
log "Region: ${AWS_REGION}, Cluster: ${AWS_CLUSTER_NAME}, Profile: ${AWS_PROFILE}"
593633

594-
# Generate kubeconfig using env var credentials (no --profile needed)
595-
if AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}" \
596-
AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}" \
597-
AWS_DEFAULT_REGION="${AWS_REGION}" \
598-
aws eks update-kubeconfig \
634+
# Generate kubeconfig using named profile
635+
if aws eks update-kubeconfig \
599636
--name "${AWS_CLUSTER_NAME}" \
600-
--region "${AWS_REGION}" 2>&1; then
637+
--region "${AWS_REGION}" \
638+
--profile "${AWS_PROFILE}" 2>&1; then
601639
log "kubeconfig generated: ~/.kube/config"
602640
else
603641
warn "Failed to generate kubeconfig. Check credentials and cluster name."
@@ -615,10 +653,7 @@ setup_k8s() {
615653
fi
616654

617655
# Verify cluster access
618-
if AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}" \
619-
AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}" \
620-
AWS_DEFAULT_REGION="${AWS_REGION}" \
621-
kubectl get nodes --no-headers 2>/dev/null | head -3; then
656+
if kubectl get nodes --no-headers 2>/dev/null | head -3; then
622657
log "K8s cluster access verified."
623658
else
624659
warn "K8s cluster verification failed. Container may still work with mounted credentials."

0 commit comments

Comments
 (0)