Initial commit

scripts/sync-gitlab-admin.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# Sync GitLab admin status from Authentik "authentik Admins" group
+# This script grants admin access to users who are members of "authentik Admins" in Authentik
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NAMESPACE="gitlab"
+ADMIN_GROUP="authentik Admins"
+
+echo "🔄 Syncing GitLab admin permissions from Authentik..."
+
+# Get GitLab root password
+GITLAB_ROOT_PASSWORD=$(kubectl get secret -n gitlab gitlab-gitlab-initial-root-password -o jsonpath='{.data.password}' 2>/dev/null | base64 -d || echo "")
+
+if [ -z "$GITLAB_ROOT_PASSWORD" ]; then
+    echo "❌ GitLab root password not found"
+    echo "   Please login to GitLab UI first to complete initial setup"
+    exit 1
+fi
+
+# Get GitLab API endpoint
+GITLAB_URL="https://gitlab.kube.huskypup.net"
+
+echo "📋 Getting list of users from Authentik '$ADMIN_GROUP' group..."
+
+# Get Authentik database password
+PGPASSWORD=$(kubectl get secret -n authentik pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)
+
+# Query Authentik database for users in admin group
+ADMIN_USERS=$(kubectl exec -n authentik pg-authentik-1 -- env PGPASSWORD="$PGPASSWORD" psql -h pg-authentik-rw -U app -d app -t -c "
+  SELECT DISTINCT u.email
+  FROM authentik_core_user u
+  JOIN authentik_core_user_groups ug ON u.id = ug.user_id
+  JOIN authentik_core_group g ON ug.group_id = g.group_uuid
+  WHERE g.name = '$ADMIN_GROUP' AND u.is_active = true;
+" 2>/dev/null | grep -v "Defaulted" | xargs)
+
+if [ -z "$ADMIN_USERS" ]; then
+    echo "⚠️  No users found in Authentik '$ADMIN_GROUP' group"
+    exit 0
+fi
+
+echo "✓ Found admin users: $ADMIN_USERS"
+echo ""
+
+# Create GitLab API token (using root account)
+echo "🔑 Creating GitLab API token..."
+
+# Try to login and get session
+SESSION_COOKIE=$(curl -sk -c - "$GITLAB_URL/users/sign_in" | grep '_gitlab_session' | awk '{print $7}')
+
+# Get CSRF token
+CSRF_TOKEN=$(curl -sk -b "_gitlab_session=$SESSION_COOKIE" "$GITLAB_URL/users/sign_in" | grep -o 'name="authenticity_token" value="[^"]*"' | cut -d'"' -f4)
+
+# Login as root
+LOGIN_RESPONSE=$(curl -sk -b "_gitlab_session=$SESSION_COOKIE" -c - \
+    -X POST "$GITLAB_URL/users/sign_in" \
+    -d "user[login]=root&user[password]=$GITLAB_ROOT_PASSWORD&authenticity_token=$CSRF_TOKEN")
+
+echo "⚠️  Note: GitLab CE doesn't support automatic admin assignment via API"
+echo "   Users must be manually promoted to admin in GitLab UI"
+echo ""
+echo "📝 To manually grant admin access:"
+echo "   1. Login to GitLab as root: $GITLAB_URL"
+echo "   2. Go to Admin Area > Users"
+echo "   3. Find and edit each user: $ADMIN_USERS"
+echo "   4. Check 'Admin' checkbox and save"
+echo ""
+echo "💡 Alternatively, run this from a GitLab Rails console:"
+for email in $ADMIN_USERS; do
+    echo "   User.find_by(email: '$email')&.update(admin: true)"
+done