Initial commit

scripts/verify-gitlab-oidc.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# verify-gitlab-oidc.sh
+# Verify GitLab OIDC configuration and connectivity to Authentik
+
+set -euo pipefail
+
+echo "=== GitLab OIDC Configuration Verification ==="
+echo ""
+
+# Check if GitLab pods are running
+echo "1. Checking GitLab pods status..."
+kubectl get pods -n gitlab -l app=webservice
+echo ""
+
+# Check hostAliases in webservice pods
+echo "2. Verifying hostAliases in GitLab webservice..."
+WEBSERVICE_POD=$(kubectl get pod -n gitlab -l app=webservice -o jsonpath='{.items[0].metadata.name}')
+echo "Using pod: $WEBSERVICE_POD"
+kubectl get pod -n gitlab "$WEBSERVICE_POD" -o jsonpath='{.spec.hostAliases}' | jq .
+echo ""
+
+# Test DNS resolution from inside GitLab pod
+echo "3. Testing DNS resolution for auth.kube.huskypup.net from GitLab pod..."
+kubectl exec -n gitlab "$WEBSERVICE_POD" -c webservice -- getent hosts auth.kube.huskypup.net || echo "getent not available, trying nslookup..."
+echo ""
+
+# Test HTTPS connectivity to Authentik
+echo "4. Testing HTTPS connectivity to Authentik..."
+kubectl exec -n gitlab "$WEBSERVICE_POD" -c webservice -- curl -I https://auth.kube.huskypup.net/.well-known/openid-configuration 2>&1 | head -20
+echo ""
+
+# Check OIDC configuration
+echo "5. Checking OIDC discovery endpoint..."
+kubectl exec -n gitlab "$WEBSERVICE_POD" -c webservice -- curl -s https://auth.kube.huskypup.net/application/o/gitlab/.well-known/openid-configuration 2>&1 | head -10
+echo ""
+
+# Check for any SSL errors in logs
+echo "6. Checking recent GitLab logs for SSL errors..."
+kubectl logs -n gitlab "$WEBSERVICE_POD" -c webservice --tail=50 | grep -i "ssl\|certificate\|openid" || echo "No SSL/certificate errors found in recent logs"
+echo ""
+
+echo "=== Verification Complete ==="
+echo ""
+echo "If you see 'HTTP/1.1 200 OK' or 'HTTP/2 200' above, OIDC is working correctly!"
+echo "If you see SSL errors, check the hostAliases configuration."