deploy: add proxysql secret renderer for 110

ops/110-proxysql/README.md

@@ -32,6 +32,7 @@ selectorless MySQL Services first, then the ProxySQL Deployment and canary
 Service.
 
 ```bash
+./create-config-secret.sh prd ./proxysql.cnf.template /path/to/mysql-password
 kubectl apply -f 00-host-mysql-entrypoints.yaml
 kubectl apply -f 10-proxysql.yaml
 ```

ops/110-proxysql/create-config-secret.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 3 ]]; then
+  echo "usage: $0 <namespace> <proxysql-template> <mysql-password-file>" >&2
+  exit 2
+fi
+
+namespace=$1
+template=$(realpath "$2")
+mysql_password_file=$(realpath "$3")
+
+if [[ ! -s $template || ! -s $mysql_password_file ]]; then
+  echo "template and MySQL password file must both be non-empty" >&2
+  exit 2
+fi
+
+work_dir=$(mktemp -d)
+trap 'rm -rf "$work_dir"' EXIT
+chmod 700 "$work_dir"
+admin_password_file=$work_dir/admin-password
+rendered_config=$work_dir/proxysql.cnf
+
+umask 077
+openssl rand -hex 24 > "$admin_password_file"
+
+python3 - "$template" "$mysql_password_file" "$admin_password_file" "$rendered_config" <<'PY'
+from pathlib import Path
+import sys
+
+template_path, mysql_path, admin_path, output_path = map(Path, sys.argv[1:])
+
+def read_secret(path: Path) -> str:
+    value = path.read_text().rstrip("\r\n")
+    if not value or "\n" in value or "\r" in value:
+        raise SystemExit(f"invalid secret file: {path}")
+    return value.replace("\\", "\\\\").replace('"', '\\"')
+
+config = template_path.read_text()
+config = config.replace("__MYSQL_PASSWORD__", read_secret(mysql_path))
+config = config.replace("__ADMIN_PASSWORD__", read_secret(admin_path))
+if "__MYSQL_PASSWORD__" in config or "__ADMIN_PASSWORD__" in config:
+    raise SystemExit("unresolved password placeholder")
+output_path.write_text(config)
+PY
+
+chmod 600 "$rendered_config"
+kubectl -n "$namespace" create secret generic proxysql-prd-config \
+  --from-file=proxysql.cnf="$rendered_config" \
+  --dry-run=client -o yaml | kubectl apply -f -