Initial commit

scripts/sync-netbird-oauth.sh

@@ -0,0 +1,147 @@
+#!/bin/bash
+set -euo pipefail
+
+# sync-netbird-oauth.sh
+# Retrieves Netbird OAuth provider credentials from Authentik and stores them in Vault
+
+AUTHENTIK_NAMESPACE="authentik"
+VAULT_NAMESPACE="vault"
+VAULT_SECRET_PATH="secret/netbird-oauth"
+
+echo "=== Syncing Netbird OAuth Credentials from Authentik to Vault ==="
+
+# Check if Authentik is running
+if ! kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server --no-headers 2>/dev/null | grep -q Running; then
+  echo "ERROR: Authentik is not running. Please deploy Authentik first."
+  exit 1
+fi
+
+# Wait for Authentik to be fully ready
+echo "Waiting for Authentik to be ready..."
+kubectl -n "${AUTHENTIK_NAMESPACE}" wait --for=condition=Ready pod -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server --timeout=60s || {
+  echo "WARNING: Authentik may not be fully ready yet. Continuing anyway..."
+}
+
+# Get Authentik pod name
+AUTHENTIK_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server -o jsonpath='{.items[0].metadata.name}')
+
+if [ -z "$AUTHENTIK_POD" ]; then
+  echo "ERROR: Could not find Authentik server pod"
+  exit 1
+fi
+
+echo "Found Authentik pod: ${AUTHENTIK_POD}"
+
+# Retrieve OAuth2 provider credentials from Authentik
+echo "Retrieving Netbird OAuth credentials from Authentik..."
+
+CLIENT_ID=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${AUTHENTIK_POD}" -- ak list_providers --type oauth2 2>/dev/null | grep -A 20 '"name": "Netbird"' | grep '"client_id"' | cut -d'"' -f4 || echo "")
+CLIENT_SECRET=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${AUTHENTIK_POD}" -- ak list_providers --type oauth2 2>/dev/null | grep -A 20 '"name": "Netbird"' | grep '"client_secret"' | cut -d'"' -f4 || echo "")
+
+# Fallback: query PostgreSQL directly
+if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
+  echo "Attempting to retrieve credentials from Authentik PostgreSQL database..."
+
+  CNPG_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l cnpg.io/cluster=pg-authentik,role=primary -o jsonpath='{.items[0].metadata.name}')
+
+  if [ -z "$CNPG_POD" ]; then
+    echo "ERROR: Could not find Authentik PostgreSQL pod"
+    exit 1
+  fi
+
+  PG_PASS=$(kubectl -n "${AUTHENTIK_NAMESPACE}" get secret pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)
+  PROVIDER_DATA=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${CNPG_POD}" -- env PGPASSWORD="${PG_PASS}" psql -U app -d app -h localhost -t -c \
+    "SELECT o.client_id, o.client_secret FROM authentik_providers_oauth2_oauth2provider o JOIN authentik_core_provider p ON o.provider_ptr_id = p.id WHERE p.name='Netbird';" 2>/dev/null || echo "")
+
+  if [ -n "$PROVIDER_DATA" ]; then
+    CLIENT_ID=$(echo "$PROVIDER_DATA" | awk '{print $1}' | tr -d ' ')
+    CLIENT_SECRET=$(echo "$PROVIDER_DATA" | awk '{print $3}' | tr -d ' ')
+  fi
+fi
+
+# Validate credentials were retrieved
+if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
+  echo "WARNING: Netbird OAuth provider not yet created by blueprint. Will retry on next sync."
+  exit 0
+fi
+
+echo "Successfully retrieved credentials:"
+echo "  Client ID: ${CLIENT_ID}"
+echo "  Client Secret: ${CLIENT_SECRET:0:10}..."
+
+# Check if Vault is unsealed and ready
+echo "Checking Vault status..."
+VAULT_POD=$(kubectl get pods -n "${VAULT_NAMESPACE}" -l app.kubernetes.io/name=vault -o jsonpath='{.items[0].metadata.name}')
+
+if [ -z "$VAULT_POD" ]; then
+  echo "ERROR: Vault pod not found"
+  exit 1
+fi
+
+VAULT_STATUS=$(kubectl exec -n "${VAULT_NAMESPACE}" "${VAULT_POD}" -- vault status -format=json 2>/dev/null || echo "{}")
+SEALED=$(echo "$VAULT_STATUS" | grep -o '"sealed":[^,}]*' | cut -d':' -f2 | tr -d ' ')
+
+if [ "$SEALED" = "true" ]; then
+  echo "ERROR: Vault is sealed. Please unseal Vault first."
+  exit 1
+fi
+
+# Create Authentik service account and API token for Netbird IDP management
+echo "Ensuring Netbird service account and API token exist in Authentik..."
+SA_TOKEN=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${AUTHENTIK_POD}" -- ak shell -c "
+from authentik.core.models import Token, User, Group
+try:
+    user = User.objects.get(username='netbird-service')
+except User.DoesNotExist:
+    user = User.objects.create(
+        username='netbird-service',
+        name='Netbird Service Account',
+        type='service_account',
+        is_active=True,
+        path='goauthentik.io/service-accounts'
+    )
+# Add to authentik Admins group (required for API access)
+try:
+    admins = Group.objects.get(name='authentik Admins')
+    admins.users.add(user)
+except Group.DoesNotExist:
+    pass
+try:
+    token = Token.objects.get(user=user, identifier='netbird-idp-manager')
+except Token.DoesNotExist:
+    token = Token.objects.create(
+        user=user, identifier='netbird-idp-manager', intent='app_password', expiring=False
+    )
+print(token.key)
+" 2>&1 | tail -1)
+
+if [ -z "$SA_TOKEN" ] || [[ "$SA_TOKEN" == *"Error"* ]]; then
+  echo "WARNING: Could not create Netbird service account token. IDP user sync will not work."
+  SA_TOKEN="placeholder"
+  SA_USERNAME="netbird-service"
+else
+  echo "  Service account token: ${SA_TOKEN:0:10}..."
+  SA_USERNAME="netbird-service"
+fi
+
+# Store credentials in Vault
+echo "Storing Netbird OAuth credentials in Vault at ${VAULT_SECRET_PATH}..."
+kubectl exec -n "${VAULT_NAMESPACE}" "${VAULT_POD}" -- env "VAULT_TOKEN=$(kubectl -n vault get secret vault-init-keys -o jsonpath='{.data.VAULT_ROOT_TOKEN}' | base64 -d)" \
+  vault kv put "${VAULT_SECRET_PATH}" \
+  client-id="${CLIENT_ID}" \
+  client-secret="${CLIENT_SECRET}" \
+  service-username="${SA_USERNAME}" \
+  service-password="${SA_TOKEN}"
+
+if [ $? -eq 0 ]; then
+  echo "✓ Successfully stored Netbird OAuth credentials in Vault"
+else
+  echo "ERROR: Failed to store credentials in Vault"
+  exit 1
+fi
+
+echo ""
+echo "=== Netbird OAuth Sync Complete ==="
+echo "NOTE: Netbird IDP user sync (cache warming) may show a 400 error."
+echo "This is a known Netbird/Authentik incompatibility (Netbird uses ROPC grant"
+echo "which Authentik does not support). OIDC login still works correctly."