Initial commit

scripts/gitlab-add-hostaliases.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# gitlab-add-hostaliases.sh
+# Add hostAliases to GitLab deployments for Authentik OIDC
+
+set -euo pipefail
+
+echo "=== Adding hostAliases to GitLab deployments ==="
+
+NS=gitlab
+# Route via Istio ingressgateway LoadBalancer (ingress-nginx removed)
+EDGE_IP=$(kubectl get svc -n istio-system istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+
+echo "Istio edge gateway IP: $EDGE_IP"
+
+# Check if webservice deployment already has hostAliases
+if kubectl get deployment gitlab-webservice-default -n "${NS}" -o jsonpath='{.spec.template.spec.hostAliases}' | grep -q "${EDGE_IP}"; then
+  echo "✅ webservice already has hostAliases configured"
+else
+  echo "Adding hostAliases to webservice..."
+  kubectl patch deployment gitlab-webservice-default -n "${NS}" --type='json' -p="[{\"op\": \"add\", \"path\": \"/spec/template/spec/hostAliases\", \"value\": [{\"ip\": \"${EDGE_IP}\", \"hostnames\": [\"auth.kube.huskypup.net\"]}]}]"
+  echo "✅ hostAliases added to webservice"
+fi
+
+# Check if sidekiq deployment already has hostAliases
+if kubectl get deployment gitlab-sidekiq-all-in-1-v2 -n "${NS}" -o jsonpath='{.spec.template.spec.hostAliases}' | grep -q "${EDGE_IP}"; then
+  echo "✅ sidekiq already has hostAliases configured"
+else
+  echo "Adding hostAliases to sidekiq..."
+  kubectl patch deployment gitlab-sidekiq-all-in-1-v2 -n "${NS}" --type='json' -p="[{\"op\": \"add\", \"path\": \"/spec/template/spec/hostAliases\", \"value\": [{\"ip\": \"${EDGE_IP}\", \"hostnames\": [\"auth.kube.huskypup.net\"]}]}]"
+  echo "✅ hostAliases added to sidekiq"
+fi
+
+echo ""
+echo "=== hostAliases configuration complete ==="
+echo "GitLab will now route auth.kube.huskypup.net through Istio edge gateway (${EDGE_IP})"
+echo "This ensures proper SSL certificate validation for Authentik OIDC"