@dooer/dooer-test-env 1.17.0 → 1.17.2

package/docs/issuing-access.md

@@ -1,22 +1,14 @@
 # Issuing access (admin)
 
-The other side of [getting-access.md](./getting-access.md). Two independent things:
+The other side of [getting-access.md](./getting-access.md). A developer needs **one** thing from you: a
+**VPN tunnel**. You create it and send them the config.
 
-| | Who does it | What you do |
-| --- | --- | --- |
-| **VPN tunnel** | you | create it and send them the config |
-| **kubectl credential** | you | create the certificate, bind permissions, send a kubeconfig |
+They do *not* need a cluster credential. `dooer-test-env` reaches everything through
+`service-dooer-test-env`, authorized by their own admin session — see
+[the specification](../_specification/service-dooer-test-env.md). Issue kubectl credentials only to people
+who operate the cluster itself; that is a separate concern from this tool and is not documented here.
 
-> **Using `dooer-test-env` no longer requires §2.** Developers need the VPN (§1) and an admin session —
-> nothing more. Every cluster read the tool used to do is now behind `service-dooer-test-env`, which
-> exposes a fixed set of admin-gated, audited operations instead of an open-ended kubeconfig
-> ([the specification](../_specification/service-dooer-test-env.md) explains the reasoning).
->
-> Issue a cluster certificate only to people who **operate the cluster** — deploying, editing manifests,
-> restarting pods. That is a much smaller group, and it is the point: a kubeconfig grants arbitrary
-> operations, so the fewer that exist, the smaller the surface.
-
-You need a Robo10 token (§1a), `kubectl` with cluster-admin (`system:masters`), and your own VPN up.
+You need a Robo10 token (§1a) and your own VPN up.
 
 ---
 
@@ -101,180 +93,16 @@ curl -sS -X DELETE -H "Authorization: Bearer $TOKEN" \
 ```
 
 That invalidates the tunnel server-side, so it is the real off-switch for VPN access when someone leaves —
-do it *and* revoke their kubectl permissions (§3).
+That is the real off-switch for this tool's access when someone leaves.
 
 ---
 
-## 2. kubectl — create their credential
-
-The cluster authenticates users with **x509 client certificates** signed by the cluster CA. The username is
-the certificate's **Common Name (CN)**; RBAC is bound to that string.
-
-You do all of it and hand over a finished `kubeconfig`.
-
-> Everything below was verified end to end against the live cluster (2026-09-04) with a throwaway
-> `guidetest-admin`: the resulting kubeconfig read `dooer-production` and `dooer-staging`, including
-> secrets. The test user was then removed.
-
-```bash
-USER_NAME=<firstname>-admin        # becomes their cluster username
-WORKDIR=$(mktemp -d) && cd "$WORKDIR"
-```
-
-Work in a temp directory — it holds their private key until you hand it over, and you delete it at the end.
-
-### 2a. Generate their key and CSR
-
-```bash
-openssl genrsa -out "$USER_NAME.key" 2048
-openssl req -new -key "$USER_NAME.key" -out "$USER_NAME.csr" -subj "/CN=$USER_NAME"
-```
-
-### 2b. Submit it as a CertificateSigningRequest
-
-```bash
-cat <<EOF | kubectl apply -f -
-apiVersion: certificates.k8s.io/v1
-kind: CertificateSigningRequest
-metadata:
-  name: $USER_NAME
-spec:
-  request: $(base64 -i "$USER_NAME.csr" | tr -d '\n')
-  signerName: kubernetes.io/kube-apiserver-client
-  expirationSeconds: 31536000   # 1 year
-  usages:
-  - client auth
-EOF
-```
-
-If the name already exists (a renewal), delete the old object first:
-`kubectl delete csr "$USER_NAME" --ignore-not-found`.
-
-### 2c. Approve and extract the certificate
-
-```bash
-kubectl certificate approve "$USER_NAME"
-
-kubectl get csr "$USER_NAME" -o jsonpath='{.status.certificate}' | base64 -d > "$USER_NAME.crt"
-openssl x509 -in "$USER_NAME.crt" -noout -subject -issuer -dates
-```
-
-Expect `subject=CN=<firstname>-admin`, `issuer=CN=kubernetes`, and a one-year window.
-
-If `.status.certificate` is empty the signer has not run yet — wait a couple of seconds and repeat. If it
-stays empty, check `kubectl describe csr "$USER_NAME"`.
-
-### 2d. Extract the cluster CA
-
-```bash
-kubectl config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ca.crt
-```
-
-### 2e. Bind permissions
-
-This is what makes the certificate useful — without it they authenticate but can do nothing. These are the
-same five ClusterRoles the existing admins (`jimmy-admin`, `sam-admin`, `trajko-admin`) hold:
-
-```bash
-for r in admin gateway-creator namespace-service-role clusterissuer-admin network-admin; do
-  kubectl create clusterrolebinding "${r}-user-${USER_NAME}" --clusterrole="$r" --user="$USER_NAME"
-done
-```
-
-| ClusterRole | Grants |
-| --- | --- |
-| `admin` | full read/write inside namespaces (the built-in Kubernetes role) |
-| `gateway-creator` | Gateway API resources |
-| `namespace-service-role` | namespace-scoped service management |
-| `clusterissuer-admin` | cert-manager ClusterIssuers (cluster-scoped) |
-| `network-admin` | NetworkAttachmentDefinitions (Multus), cluster-wide |
-
-The declarative equivalent lives in
-`rosopr7102-roboten-hosting-services/clusterrole-admin.yaml`. Creating the bindings with `kubectl` as above
-is enough for the cluster, but that file is the record of who has access — **add the new user there and
-commit it**, or the next person reading it will get a false picture.
-
-On a renewal, skip this step: the bindings are attached to the username, not to the certificate.
-
-### 2f. Assemble the kubeconfig
-
-`--embed-certs=true` inlines the key and certificates, so the file you hand over is self-contained:
-
-```bash
-SERVER=https://k8s.roboten-infra.com:64430
-KC="$WORKDIR/$USER_NAME.kubeconfig"
-
-KUBECONFIG="$KC" kubectl config set-cluster kubernetes \
-  --server="$SERVER" --certificate-authority=ca.crt --embed-certs=true
-
-KUBECONFIG="$KC" kubectl config set-credentials "$USER_NAME" \
-  --client-certificate="$USER_NAME.crt" --client-key="$USER_NAME.key" --embed-certs=true
-
-KUBECONFIG="$KC" kubectl config set-context "$USER_NAME@kubernetes" \
-  --cluster=kubernetes --user="$USER_NAME"
-
-KUBECONFIG="$KC" kubectl config use-context "$USER_NAME@kubernetes"
-```
-
-### 2g. Verify it before handing it over
-
-Test the actual file, not just the RBAC — with your own VPN up:
-
-```bash
-KUBECONFIG="$KC" kubectl auth whoami                                  # Username: <firstname>-admin
-KUBECONFIG="$KC" kubectl get pods -n dooer-staging | head -3
-KUBECONFIG="$KC" kubectl get pods -n dooer-production | head -3
-KUBECONFIG="$KC" kubectl auth can-i get secrets -n dooer-staging      # yes
-```
-
-If `whoami` works but the reads say `Forbidden`, step 2e did not take.
-
-### 2h. Hand it over, then clean up
-
-> **The kubeconfig contains their private key.** Send it the same way as the VPN config — a shared vault
-> entry or an expiring secure link, never email, Slack or a ticket.
-
-Tell them the context name (`<firstname>-admin@kubernetes`) and point them at
-[getting-access.md § 2](./getting-access.md#2-kubectl-access).
-
-Once they confirm it works, destroy your copy — you are holding their key until you do:
-
-```bash
-rm -rf "$WORKDIR"
-```
-
 ---
 
-## 3. Revoking access
-
-```bash
-for r in admin gateway-creator namespace-service-role clusterissuer-admin network-admin; do
-  kubectl delete clusterrolebinding "${r}-user-${USER_NAME}"
-done
-kubectl delete csr "$USER_NAME"     # tidiness only; the CSR object is just a record
-```
-
-Also remove them from `clusterrole-admin.yaml` and commit.
+## Revoking access
 
-> **A signed certificate cannot be revoked.** Kubernetes has no CRL or OCSP: until it expires, that
-> certificate still *authenticates* — deleting the bindings only removes what it is *allowed to do*, which
-> leaves the holder as an authenticated user with no permissions. That is the real control, and it is why
-> certificates are issued for one year rather than indefinitely. If a key is actually compromised, removing
-> the bindings is the immediate mitigation; rotating the cluster CA is the only complete one, and that
-> invalidates **everyone's** certificate at once — do not do it without planning the re-issue for all users.
+Revoke the tunnel (§1e). That is the whole of what this tool's access consists of — there is no
+certificate to delete and no RBAC to unbind.
 
----
-
-## Renewals
-
-A certificate expiring is routine. Repeat **§2a–2d and 2f–2h** and send them a fresh kubeconfig; they
-re-run [getting-access.md § 2](./getting-access.md#2-kubectl-access).
-
-Skip **2e** — ClusterRoleBindings are bound to the username, not to the certificate, so they survive a
-re-issue untouched.
-
-Delete the old CSR object first, or the new one collides on the name:
-
-```bash
-kubectl delete csr "$USER_NAME" --ignore-not-found
-```
+If they also hold a Dooer **admin account**, disabling that account removes their ability to use
+`dooer-test-env` against staging or production, since every operation it performs is admin-gated.

package/lib/bankid.js

@@ -77,49 +77,20 @@ async function pullFromService(envName = 'staging') {
   return values
 }
 
-// Pull the bankid secrets out of the staging k8s secret via kubectl. k8s stores each value base64-encoded
-// in `.data`; we decode to the raw value the staging container would receive (for the PFX that raw value is
-// itself the base64 PFX string, exactly what @dooer/config's `Buffer.from(pfx,'base64')` expects).
-function pullFromStaging({ namespace = DEFAULT_NAMESPACE, secret = DEFAULT_SECRET } = {}) {
-  const r = sh('kubectl', ['-n', namespace, 'get', 'secret', secret, '-o', 'json'])
-  if (r.status !== 0) throw new Error(`kubectl get secret ${namespace}/${secret} failed: ${r.stderr || r.stdout}`)
-  const data = JSON.parse(r.stdout).data || {}
-  const out = {}
-  SECRET_KEYS.forEach((key) => {
-    if (data[key] == null) return // CA cert may be absent in some envs — skip quietly
-    out[key] = Buffer.from(data[key], 'base64').toString('utf8')
-  })
-  if (!out.SECRET_DOOER_BANK_ID_PFX) {
-    throw new Error(`secret ${namespace}/${secret} has no SECRET_DOOER_BANK_ID_PFX — wrong secret?`)
-  }
-  return out
-}
-
 // Pull + store in the keychain. Returns the list of keys stored (never the values).
-// Async because the service path is an HTTP call. The single caller (`bankid pull`) already awaits.
+// Fetch the BankID material from service-dooer-test-env and store it in the keychain. Same values the
+// cluster Secret holds — this used to read that Secret with kubectl, which required a credential that
+// could read every Secret in the namespace.
 async function pullAndStore(opts = {}) {
-  // Service first — the path with no kubectl. The k8s reader stays as the fallback so a developer
-  // mid-migration, or one whose service is unreachable, is not stuck.
-  try {
-    const fromService = await pullFromService(opts.env || 'staging')
-    if (fromService && Object.keys(fromService).length) {
-      const storedFromService = []
-      for (const [key, value] of Object.entries(fromService)) {
-        keychainSet(key, value)
-        storedFromService.push(key)
-      }
-      return storedFromService
-    }
-  } catch (_) {
-    /* fall through to the kubectl path */
+  const values = await pullFromService(opts.env || 'staging')
+  if (!values || !Object.keys(values).length) {
+    throw new Error('the service returned no BankID material')
   }
-
-  const values = pullFromStaging(opts)
   const stored = []
-  Object.entries(values).forEach(([key, value]) => {
+  for (const [key, value] of Object.entries(values)) {
     keychainSet(key, value)
     stored.push(key)
-  })
+  }
   return stored
 }
 
@@ -149,7 +120,6 @@ module.exports = {
   SECRET_KEYS,
   DEFAULT_NAMESPACE,
   DEFAULT_SECRET,
-  pullFromStaging,
   pullAndStore,
   status,
   clear,

package/lib/command/customer.js

@@ -1,6 +1,7 @@
 const fs = require('fs')
 const chalk = require('chalk')
-const { purge } = require('../engine/purge')
+const remote = require('../remote')
+const serviceClient = require('../service-client')
 const { createAccount, SUBSCRIPTION_TYPES } = require('../account')
 
 // `copy` now runs through service-dooer-test-env (export in the source, import in the target) instead of
@@ -125,19 +126,36 @@ module.exports = {
         builder: (y2) =>
           y2
             .option('org', { type: 'string', demandOption: true, describe: 'org (companies_pk) to delete' })
-            .option('namespace', { type: 'string', default: 'dooer-staging', describe: 'k8s namespace' })
-            .option('local', { type: 'boolean', describe: 'purge from the LOCAL env instead of a k8s namespace' })
-            .option('skip-files', { type: 'boolean', describe: 'do not delete the org’s S3 objects' })
+            .option('namespace', { type: 'string', default: 'dooer-staging', describe: 'environment to delete from' })
+            .option('local', { type: 'boolean', describe: 'purge from the LOCAL env instead' })
             .option('confirm-production', { type: 'boolean', describe: 'REQUIRED to delete from dooer-production' })
+            .option('reason', { type: 'string', describe: 'recorded in the audit trail' })
             .option('execute', { type: 'boolean', default: false, describe: 'actually delete (default: dry-run)' }),
-        handler: (argv) =>
-          purge({
-            org: argv.org,
-            namespace: argv.local ? 'local' : argv.namespace,
-            skipFiles: argv.skipFiles,
-            confirmProduction: argv.confirmProduction,
-            execute: argv.execute,
-          }),
+        handler: async (argv) => {
+          // Through the service, like copy — no kubeconfig, and the deletion is recorded in that
+          // environment's audit trail rather than happening invisibly.
+          const env = remote.resolveEnv(envFromFlags(argv.local, argv.namespace, 'staging'))
+          if (env.production && !argv.confirmProduction) {
+            throw new Error('refusing to delete from dooer-production without --confirm-production')
+          }
+          const started = await serviceClient.request(env, {
+            method: 'POST',
+            path: '/v1/purges',
+            body: { organizationId: argv.org, execute: !!argv.execute, reason: argv.reason },
+          })
+          const op = await serviceClient.pollOperation(env, 'purges', started.id, {
+            onTick: (o) => process.stdout.write(o.status === 'running' ? '.' : `\n  ${o.status}`),
+          })
+          if (op.status !== 'succeeded') throw new Error(`\npurge failed: ${op.error || 'unknown error'}`)
+          const d = serviceClient.detailOf(op)
+          console.log(
+            (argv.execute ? chalk.green('\ndeleted') : chalk.yellow('\nDRY RUN — nothing deleted')) +
+              `  ${d.rows} rows across ${(d.tables || []).length} tables in ${env.label}`
+          )
+          if (d.note) console.log(chalk.yellow(`  ${d.note}`))
+          if (!argv.execute) console.log('  Re-run with --execute to apply.')
+          console.log(`  audit: ${op.id}\n`)
+        },
       })
       .command({
         command: 'new <name>',

package/lib/command/db.js

@@ -1,5 +1,4 @@
 const os = require('os')
-const fs = require('fs')
 const path = require('path')
 const chalk = require('chalk')
 const dbbuild = require('../engine/dbbuild')
@@ -119,30 +118,19 @@ module.exports = {
             local,
             download: async () => {
               const out = path.join(os.tmpdir(), 'dooer-base-db.pulled.dump')
-              // Service first — no kubectl, no ObjectBucketClaim credentials on this machine, no
-              // rook-ceph ClusterIP lookup. The service streams the artifact from inside the cluster.
-              try {
-                const remote = require('../remote')
-                const serviceClient = require('../service-client')
-                const env = remote.resolveEnv(argv.env || 'staging')
-                const list = await serviceClient.request(env, { path: '/v1/base-db/artifacts' })
-                const newest = (list.artifacts || [])[0]
-                if (!newest) throw new Error('no base-DB artifacts published yet')
-                console.log(`downloading ${newest.id} (${(newest.bytes / 1e6).toFixed(0)} MB) from ${env.label} …`)
-                const bytes = await serviceClient.request(env, {
-                  path: `/v1/base-db/artifacts/${encodeURIComponent(newest.id)}/content`,
-                  raw: true,
-                  timeoutMs: 1800000,
-                })
-                fs.writeFileSync(out, bytes)
-                return out
-              } catch (e) {
-                console.log(chalk.yellow(`service download unavailable (${e.message}); falling back to the OBC`))
-              }
-              const cfg = obc.obcConfig({ namespace: argv.obcNamespace })
-              const { file, key } = await obc.download(cfg, out)
-              console.log(chalk.gray(`downloaded ${cfg.bucket}/${key}`))
-              return file
+              // The service streams the artifact from inside the cluster. This used to read the
+              // ObjectBucketClaim's credentials with kubectl and resolve a rook-ceph ClusterIP; now the
+              // S3 credentials never leave the cluster and this machine needs no kubeconfig.
+              const remote = require('../remote')
+              const serviceClient = require('../service-client')
+              const env = remote.resolveEnv(argv.env || 'staging')
+              const list = await serviceClient.request(env, { path: '/v1/base-db/artifacts' })
+              const newest = (list.artifacts || [])[0]
+              if (!newest) throw new Error(`no base-DB artifacts published in ${env.label} yet`)
+              console.log(`downloading ${newest.id} (${(newest.bytes / 1e6).toFixed(0)} MB) from ${env.label} …`)
+              // Straight to a file: the base DB is ~300 MB and has no business sitting in the heap.
+              await serviceClient.downloadTo(env, `/v1/base-db/artifacts/${encodeURIComponent(newest.id)}/content`, out)
+              return out
             },
             execute: argv.execute,
           })

package/lib/command/remote-environment.js

@@ -235,7 +235,15 @@ module.exports = {
             }
             const exp = remote.expiry(token)
             if (exp && exp.expired) {
-              console.log(`${head}${chalk.yellow(`session EXPIRED ${exp.at.toISOString()}`)}`)
+              // For local an expired session is not a problem — it falls back to a minted service token —
+              // so saying EXPIRED there reads as breakage when nothing is broken.
+              console.log(
+                `${head}${
+                  name === 'local'
+                    ? 'stale session ignored — uses a minted service token'
+                    : chalk.yellow(`session EXPIRED ${exp.at.toISOString()}`)
+                }`
+              )
               continue
             }
             let me = null

package/lib/obc.js

@@ -1,39 +1,29 @@
 // obc.js — access the base-artifact bucket provisioned by an ObjectBucketClaim (Rook-Ceph). An OBC yields
 // a ConfigMap (BUCKET_NAME/BUCKET_HOST/BUCKET_PORT) and a Secret (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY).
-// In-cluster the Job mounts these as env; a dev `db pull` reads them via kubectl from the OBC's namespace.
-const { execFileSync } = require('child_process')
+// IN-CLUSTER ONLY. It used to fall back to reading the OBC with kubectl so a laptop could `db pull`
+// directly; that path is gone — `db pull` streams the artifact from service-dooer-test-env, and no
+// developer machine holds these credentials. What remains serves the base-DB BUILD, which runs as a
+// CronJob inside the cluster and gets everything from its own environment.
 const { S3Client, PutObjectCommand, GetObjectCommand, ListObjectsV2Command } = require('@aws-sdk/client-s3')
 
-function sh(file, args) {
-  return execFileSync(file, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).trim()
-}
-
-// resolve OBC connection: prefer env (in-cluster), else kubectl-read the OBC ConfigMap+Secret.
-function obcConfig({ obcName = 'dooer-test-env-base', namespace } = {}) {
-  let bucket = process.env.BUCKET_NAME
-  let host = process.env.BUCKET_HOST
-  let port = process.env.BUCKET_PORT
-  let ak = process.env.AWS_ACCESS_KEY_ID
-  let sk = process.env.AWS_SECRET_ACCESS_KEY
+// Resolve the OBC connection from the environment the Job runs with.
+function obcConfig({ obcName = 'dooer-test-env-base' } = {}) {
+  const bucket = process.env.BUCKET_NAME
+  const host = process.env.BUCKET_HOST
+  const port = process.env.BUCKET_PORT
+  const ak = process.env.AWS_ACCESS_KEY_ID
+  const sk = process.env.AWS_SECRET_ACCESS_KEY
   if (!(bucket && host && ak && sk)) {
-    if (!namespace) throw new Error('OBC not in env; pass --obc-namespace to read the OBC via kubectl')
-    const cm = JSON.parse(sh('kubectl', ['get', 'configmap', obcName, '-n', namespace, '-o', 'json']))
-    const sec = JSON.parse(sh('kubectl', ['get', 'secret', obcName, '-n', namespace, '-o', 'json']))
-    bucket = cm.data.BUCKET_NAME
-    host = cm.data.BUCKET_HOST
-    port = cm.data.BUCKET_PORT || '80'
-    ak = Buffer.from(sec.data.AWS_ACCESS_KEY_ID, 'base64').toString('utf8')
-    sk = Buffer.from(sec.data.AWS_SECRET_ACCESS_KEY, 'base64').toString('utf8')
-  }
-  // BUCKET_HOST is a k8s service name in-cluster; over VPN a dev resolves it to the rook-ceph ClusterIP
-  let endpoint = `http://${host}:${port || 80}`
-  if (namespace && !process.env.BUCKET_HOST) {
-    const svc = host.split('.')[0]
-    const ip = sh('kubectl', ['get', 'svc', svc, '-n', 'rook-ceph', '-o', 'jsonpath={.spec.clusterIP}'])
-    if (ip) endpoint = `http://${ip}:${port || 80}`
+    throw new Error(
+      `OBC ${obcName} is not in this environment (needs BUCKET_NAME/BUCKET_HOST/AWS_ACCESS_KEY_ID/` +
+        'AWS_SECRET_ACCESS_KEY). This path runs in-cluster only; from a laptop use `dooer-test-env db ' +
+        'pull`, which streams the artifact through the service.'
+    )
   }
+  // In-cluster BUCKET_HOST is a Service name and DNS resolves it. (Reaching this from outside used to
+  // need a rook-ceph ClusterIP lookup; nothing calls it from outside any more.)
   const client = new S3Client({
-    endpoint,
+    endpoint: `http://${host}:${port || 80}`,
     region: 'us-east-1',
     forcePathStyle: true,
     credentials: { accessKeyId: ak, secretAccessKey: sk },

package/lib/registry.js

@@ -1,151 +1,65 @@
-// registry.js — make `docker pull` work for the two private registries WITHOUT any manual steps. The
-// cluster already holds pull secrets (imagePullSecrets); we read them via kubectl, decode the
-// dockerconfigjson, and `docker login` each registry. If kubectl/the secret isn't available we fall back
-// to env vars and, on a TTY, an interactive prompt — so a dev is only ever asked when creds truly can't
-// be found. Used by `setup` and implicitly by `up`.
-const { execFileSync, spawnSync } = require('child_process')
-const readline = require('readline')
+// registry.js — make `docker pull` work for the two private registries without any manual steps.
+//
+// The credentials come from service-dooer-test-env's `/v1/bootstrap/registry-credentials`, authorized by
+// your admin session. This used to read the cluster's imagePullSecrets with kubectl, which meant every
+// developer held a credential that could read EVERY Secret in the namespace to obtain two of them.
+//
+// Env vars remain as an escape hatch for a machine with no session (CI, a first run while the service is
+// being deployed); the interactive prompt is gone with the kubectl path, since there is nothing left that
+// can half-work and leave you guessing.
+const { spawnSync } = require('child_process')
 
-// the imagePullSecrets the s-e032 manifests reference
-const PULL_SECRETS = ['aws-ecr-secret', 'push-secret-robo10']
-
-function sh(file, args, opts = {}) {
-  return execFileSync(file, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, ...opts }).trim()
+function dockerLogin(host, username, password) {
+  const r = spawnSync('docker', ['login', host, '-u', username, '--password-stdin'], {
+    input: password,
+    encoding: 'utf8',
+  })
+  return r.status === 0
 }
 
-// is the binary on PATH? "ran at all" (no ENOENT), regardless of exit code — `kubectl --version` is an
-// invalid flag but still proves kubectl is installed.
+// is the binary on PATH? "ran at all" (no ENOENT), regardless of exit code.
 function have(cmd) {
   const r = spawnSync(cmd, ['--version'], { encoding: 'utf8' })
   return !r.error
 }
 
-// Pull credentials from service-dooer-test-env — the path that needs no kubectl. Returns the same
-// { host: {username, password} } shape as the kubectl reader below, so the caller cannot tell them apart.
-async function authsFromService(envName = 'staging') {
-  const remote = require('./remote')
-  const serviceClient = require('./service-client')
-  const env = remote.resolveEnv(envName)
-  const { registries } = await serviceClient.request(env, { path: '/v1/bootstrap/registry-credentials' })
-  const out = {}
-  for (const r of registries || [])
-    out[r.host.replace(/^https?:\/\//, '')] = { username: r.username, password: r.password }
-  return Object.keys(out).length ? out : null
+// DOOER_ECR_* override, for a machine that cannot reach the service yet.
+function fromEnv() {
+  const host = process.env.DOOER_ECR_REGISTRY
+  const user = process.env.DOOER_ECR_USERNAME
+  const pass = process.env.DOOER_ECR_PASSWORD
+  if (!(host && user && pass)) return null
+  return [{ host, ok: dockerLogin(host, user, pass), via: 'env' }]
 }
 
-// { host: { username, password } } parsed from a k8s dockerconfigjson secret (or null if unreadable)
-function authsFromSecret(secretName, namespace) {
-  let b64
-  try {
-    b64 = sh('kubectl', ['get', 'secret', secretName, '-n', namespace, '-o', 'jsonpath={.data.\\.dockerconfigjson}'])
-  } catch (_) {
-    return null
-  }
-  if (!b64) return null
-  let cfg
-  try {
-    cfg = JSON.parse(Buffer.from(b64, 'base64').toString('utf8'))
-  } catch (_) {
-    return null
-  }
-  const out = {}
-  for (const [host, entry] of Object.entries(cfg.auths || {})) {
-    let { username, password } = entry
-    if ((!username || !password) && entry.auth) {
-      const [u, ...p] = Buffer.from(entry.auth, 'base64').toString('utf8').split(':')
-      username = username || u
-      password = password || p.join(':')
-    }
-    if (username && password) out[host] = { username, password }
-  }
-  return out
-}
-
-function dockerLogin(host, username, password) {
-  const r = spawnSync('docker', ['login', host, '-u', username, '--password-stdin'], {
-    input: password,
-    encoding: 'utf8',
-  })
-  return r.status === 0
-}
+// Log docker into both private registries. Returns [{ host, ok, via }].
+async function loginAll({ env = 'staging' } = {}) {
+  if (!have('docker')) throw new Error('docker is not installed / not on PATH')
 
-async function prompt(question, { silent } = {}) {
-  if (!process.stdin.isTTY) return null
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true })
-  const answer = await new Promise((resolve) => {
-    if (silent) {
-      // hide typed characters (password)
-      const onData = () => rl.output.write('\r' + question + '*'.repeat(0))
-      rl._writeToOutput = () => rl.output.write('')
-      rl.question(question, (a) => resolve(a))
-      rl.input.on('data', onData)
-    } else {
-      rl.question(question, (a) => resolve(a))
-    }
-  })
-  rl.close()
-  if (silent) process.stdout.write('\n')
-  return answer.trim()
-}
+  const remote = require('./remote')
+  const serviceClient = require('./service-client')
+  const resolved = remote.resolveEnv(env)
 
-// Log docker into both private registries. Returns [{host, ok, via}]. `via` = kubectl | env | prompt.
-async function loginAll({ namespace = 'dooer-staging', interactive = true } = {}) {
-  // Service first — that is the path with no kubectl. Falls back to the Secret reader and then to
-  // env/prompt, so a developer mid-migration (or with the service unreachable) is never stuck.
+  let registries
   try {
-    const fromService = await authsFromService()
-    if (fromService) {
-      const results = []
-      for (const [host, creds] of Object.entries(fromService)) {
-        results.push({ host, ok: dockerLogin(host, creds.username, creds.password), via: 'service' })
-      }
-      if (results.length && results.every((r) => r.ok)) return results
-    }
-  } catch (_) {
-    /* fall through to the kubectl path below */
+    ;({ registries } = await serviceClient.request(resolved, { path: '/v1/bootstrap/registry-credentials' }))
+  } catch (e) {
+    const viaEnv = fromEnv()
+    if (viaEnv) return viaEnv
+    throw new Error(
+      `could not obtain registry credentials from ${resolved.label}: ${e.message}\n` +
+        `  · is the VPN up, and are you logged in? ` +
+        `\`dooer-test-env remote-environment login --env ${resolved.name} --email <admin>\`\n` +
+        `  · or set DOOER_ECR_REGISTRY / DOOER_ECR_USERNAME / DOOER_ECR_PASSWORD`
+    )
   }
 
-  if (!have('docker')) throw new Error('docker is not installed / not on PATH')
-  const results = []
-  const merged = {}
-  for (const s of PULL_SECRETS) {
-    const a = authsFromSecret(s, namespace)
-    if (a) Object.assign(merged, a)
-  }
-  const hosts = Object.keys(merged)
-  if (hosts.length) {
-    for (const host of hosts) {
-      const ok = dockerLogin(host, merged[host].username, merged[host].password)
-      results.push({ host, ok, via: 'kubectl' })
-    }
-    return results
-  }
-  // kubectl/secret unavailable — try env, then prompt
-  const envPairs = [
-    {
-      host: process.env.DOOER_ECR_REGISTRY,
-      user: process.env.DOOER_ECR_USERNAME,
-      pass: process.env.DOOER_ECR_PASSWORD,
-    },
-  ].filter((p) => p.host && p.user && p.pass)
-  if (envPairs.length) {
-    for (const p of envPairs) results.push({ host: p.host, ok: dockerLogin(p.host, p.user, p.pass), via: 'env' })
-    return results
-  }
-  if (interactive && process.stdin.isTTY) {
-    const host = await prompt('Registry host (e.g. …dkr.ecr.eu-west-1.amazonaws.com): ')
-    const user = await prompt('Username: ')
-    const pass = await prompt('Password/token: ', { silent: true })
-    if (host && user && pass) {
-      results.push({ host, ok: dockerLogin(host, user, pass), via: 'prompt' })
-      return results
-    }
-  }
-  throw new Error(
-    'could not obtain registry credentials: kubectl could not read the cluster pull secrets ' +
-      `(${PULL_SECRETS.join(', ')}) in "${namespace}", and no DOOER_ECR_* env vars were set. ` +
-      'Check VPN + kubectl context, or set DOOER_ECR_REGISTRY/USERNAME/PASSWORD.'
-  )
+  return (registries || []).map((r) => {
+    // The service reports hosts as the Secret stores them, sometimes scheme-prefixed; `docker login`
+    // wants a bare host.
+    const host = r.host.replace(/^https?:\/\//, '')
+    return { host, ok: dockerLogin(host, r.username, r.password), via: 'service' }
+  })
 }
 
-module.exports = { loginAll, authsFromSecret, dockerLogin, have, PULL_SECRETS }
+module.exports = { loginAll, dockerLogin, have }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dooer/dooer-test-env",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "description": "Run the whole Dooer backend locally (staging DB minus customers), copy/purge customers between environments, and shred — one CLI.",
   "license": "UNLICENSED",
   "repository": "Dooer/cli-dooer-test-env",

package/readme.md

@@ -29,8 +29,8 @@ You need exactly two things:
 - **[Getting access](./docs/getting-access.md)** — new developer: set up the VPN and log in.
 - **[Logins and user management](./docs/user-management.md)** — signing in as a customer, partner or admin
   user; creating users; partner membership; using the token from scripts.
-- **[Issuing access](./docs/issuing-access.md)** — admin: VPN tunnels, and cluster certificates for the
-  people who actually operate the cluster. **Not needed to use this tool any more.**
+- **[Issuing access](./docs/issuing-access.md)** — admin: how to create and hand over a VPN tunnel. Still
+  required — a new developer cannot reach anything without one.
 
 ## Quick start