Initial commit

scripts/setup-netbird-api-token.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# setup-netbird-api-token.sh - Bootstrap Netbird API token for operator + exporter
+#
+# Creates a service user in Netbird and generates a long-lived PAT (Personal Access Token)
+# for automation. Stores the token in Vault for ExternalSecret consumption.
+#
+# Usage:
+#   ./scripts/setup-netbird-api-token.sh <admin-pat>
+#
+# Prerequisites:
+#   - Netbird management server running and accessible
+#   - Admin PAT from Netbird dashboard (Settings → Personal Access Tokens)
+#   - Vault initialized and unsealed
+#   - kubectl configured for the cluster
+
+set -euo pipefail
+
+ADMIN_PAT="${1:?Usage: $0 <admin-pat>}"
+NETBIRD_API="https://netbird.kube.huskypup.net"
+SERVICE_USER_NAME="k8s-operator"
+PAT_NAME="operator-automation"
+
+echo "=== Netbird API Token Bootstrap ==="
+
+# Check for existing service user
+echo "Checking for existing service user '${SERVICE_USER_NAME}'..."
+USERS=$(curl -sf -H "Authorization: Token ${ADMIN_PAT}" \
+  "${NETBIRD_API}/api/users" 2>/dev/null || echo "[]")
+
+SERVICE_USER_ID=$(echo "${USERS}" | jq -r \
+  ".[] | select(.name == \"${SERVICE_USER_NAME}\" and .is_service_user == true) | .id" 2>/dev/null || echo "")
+
+if [ -z "${SERVICE_USER_ID}" ]; then
+  echo "Creating service user '${SERVICE_USER_NAME}'..."
+  RESPONSE=$(curl -sf -X POST \
+    -H "Authorization: Token ${ADMIN_PAT}" \
+    -H "Content-Type: application/json" \
+    -d "{\"name\": \"${SERVICE_USER_NAME}\", \"role\": \"admin\", \"is_service_user\": true, \"auto_groups\": []}" \
+    "${NETBIRD_API}/api/users")
+  SERVICE_USER_ID=$(echo "${RESPONSE}" | jq -r '.id')
+  echo "  Created service user: ${SERVICE_USER_ID}"
+else
+  echo "  Service user already exists: ${SERVICE_USER_ID}"
+fi
+
+# Create PAT for the service user
+echo "Creating Personal Access Token '${PAT_NAME}'..."
+# Set expiration to 365 days from now
+EXPIRES=$(date -u -d "+365 days" "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || \
+  date -u -v+365d "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null)
+
+PAT_RESPONSE=$(curl -sf -X POST \
+  -H "Authorization: Token ${ADMIN_PAT}" \
+  -H "Content-Type: application/json" \
+  -d "{\"name\": \"${PAT_NAME}\", \"expires_in\": 365}" \
+  "${NETBIRD_API}/api/users/${SERVICE_USER_ID}/tokens")
+
+API_TOKEN=$(echo "${PAT_RESPONSE}" | jq -r '.plain_token')
+
+if [ -z "${API_TOKEN}" ] || [ "${API_TOKEN}" = "null" ]; then
+  echo "ERROR: Failed to create PAT. Response:"
+  echo "${PAT_RESPONSE}" | jq . 2>/dev/null || echo "${PAT_RESPONSE}"
+  exit 1
+fi
+
+echo "  PAT created successfully"
+
+# Store in Vault
+echo "Storing API token in Vault at secret/netbird-api-token..."
+ROOT_TOKEN=$(kubectl -n vault get secret vault-init-keys -o jsonpath='{.data.VAULT_ROOT_TOKEN}' | base64 -d)
+kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
+  vault kv put secret/netbird-api-token api-token="${API_TOKEN}"
+
+echo ""
+echo "=== Netbird API Token Bootstrap Complete ==="
+echo "  Service User: ${SERVICE_USER_NAME} (${SERVICE_USER_ID})"
+echo "  Vault Path:   secret/netbird-api-token"
+echo "  Expires:      ~365 days"
+echo ""
+echo "Next steps:"
+echo "  1. Run: helmfile apply  (deploys operator + exporter with the token)"
+echo "  2. Annotate services:   kubectl annotate svc <name> -n <ns> netbird.io/expose=true"