mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Initial commit
This commit is contained in:
Scooby Husky
Executable
+177
@@ -0,0 +1,177 @@
|
||||
#!/bin/bash
|
||||
# Verify GitLab Redis password rotation automation is working
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "===================================================================="
|
||||
echo "GitLab Redis Password Rotation Automation - Verification Script"
|
||||
echo "===================================================================="
|
||||
echo ""
|
||||
|
||||
# Colors for output
|
||||
GREEN='\033[0;32m'
|
||||
RED='\033[0;31m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
check_pass() {
|
||||
echo -e "${GREEN}✓${NC} $1"
|
||||
}
|
||||
|
||||
check_fail() {
|
||||
echo -e "${RED}✗${NC} $1"
|
||||
}
|
||||
|
||||
check_warn() {
|
||||
echo -e "${YELLOW}⚠${NC} $1"
|
||||
}
|
||||
|
||||
ERRORS=0
|
||||
|
||||
# Check 1: CronJob exists
|
||||
echo "Checking CronJob deployment..."
|
||||
if kubectl get cronjob -n gitlab redis-secret-monitor >/dev/null 2>&1; then
|
||||
check_pass "CronJob 'redis-secret-monitor' is deployed"
|
||||
|
||||
# Get schedule
|
||||
SCHEDULE=$(kubectl get cronjob -n gitlab redis-secret-monitor -o jsonpath='{.spec.schedule}')
|
||||
echo " Schedule: $SCHEDULE"
|
||||
|
||||
# Get last successful run
|
||||
LAST_SUCCESS=$(kubectl get cronjob -n gitlab redis-secret-monitor -o jsonpath='{.status.lastSuccessfulTime}' 2>/dev/null || echo "Never")
|
||||
echo " Last successful run: $LAST_SUCCESS"
|
||||
else
|
||||
check_fail "CronJob 'redis-secret-monitor' not found"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Check 2: RBAC resources exist
|
||||
echo "Checking RBAC resources..."
|
||||
if kubectl get serviceaccount -n gitlab redis-restart-sa >/dev/null 2>&1; then
|
||||
check_pass "ServiceAccount 'redis-restart-sa' exists"
|
||||
else
|
||||
check_fail "ServiceAccount 'redis-restart-sa' not found"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
|
||||
if kubectl get role -n gitlab redis-restart-role >/dev/null 2>&1; then
|
||||
check_pass "Role 'redis-restart-role' exists"
|
||||
else
|
||||
check_fail "Role 'redis-restart-role' not found"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
|
||||
if kubectl get rolebinding -n gitlab redis-restart-binding >/dev/null 2>&1; then
|
||||
check_pass "RoleBinding 'redis-restart-binding' exists"
|
||||
else
|
||||
check_fail "RoleBinding 'redis-restart-binding' not found"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Check 3: StatefulSet has tracking annotation
|
||||
echo "Checking StatefulSet annotations..."
|
||||
SECRET_VERSION=$(kubectl get statefulset -n gitlab redis-gitlab -o jsonpath='{.spec.template.metadata.annotations.secret-version/redis-password}' 2>/dev/null || echo "")
|
||||
if [ -n "$SECRET_VERSION" ]; then
|
||||
check_pass "StatefulSet has tracking annotation"
|
||||
echo " Tracked secret version: $SECRET_VERSION"
|
||||
else
|
||||
check_warn "StatefulSet missing tracking annotation (will be added on first CronJob run)"
|
||||
fi
|
||||
|
||||
RESTART_TIME=$(kubectl get statefulset -n gitlab redis-gitlab -o jsonpath='{.spec.template.metadata.annotations.restarted-at}' 2>/dev/null || echo "")
|
||||
if [ -n "$RESTART_TIME" ]; then
|
||||
echo " Last restart: $RESTART_TIME"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Check 4: Redis is running
|
||||
echo "Checking Redis pod status..."
|
||||
if kubectl get pod -n gitlab redis-gitlab-0 >/dev/null 2>&1; then
|
||||
REDIS_STATUS=$(kubectl get pod -n gitlab redis-gitlab-0 -o jsonpath='{.status.phase}')
|
||||
if [ "$REDIS_STATUS" = "Running" ]; then
|
||||
check_pass "Redis pod is Running"
|
||||
else
|
||||
check_fail "Redis pod status: $REDIS_STATUS"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
else
|
||||
check_fail "Redis pod 'redis-gitlab-0' not found"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Check 5: Redis authentication works
|
||||
echo "Testing Redis authentication..."
|
||||
if RESULT=$(kubectl exec -n gitlab redis-gitlab-0 -- redis-cli -a "$(kubectl get secret -n gitlab redis-gitlab-secret -o jsonpath='{.data.password}' | base64 -d)" ping 2>&1 | grep PONG); then
|
||||
check_pass "Redis authentication successful (PONG)"
|
||||
else
|
||||
check_fail "Redis authentication failed"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Check 6: GitLab Sidekiq is healthy
|
||||
echo "Checking GitLab Sidekiq status..."
|
||||
SIDEKIQ_READY=$(kubectl get pods -n gitlab -l app=sidekiq -o jsonpath='{.items[*].status.containerStatuses[*].ready}' | grep -o "true" | wc -l)
|
||||
SIDEKIQ_TOTAL=$(kubectl get pods -n gitlab -l app=sidekiq --no-headers | wc -l)
|
||||
|
||||
if [ "$SIDEKIQ_READY" -eq "$SIDEKIQ_TOTAL" ] && [ "$SIDEKIQ_TOTAL" -gt 0 ]; then
|
||||
check_pass "Sidekiq pods are healthy ($SIDEKIQ_READY/$SIDEKIQ_TOTAL ready)"
|
||||
else
|
||||
check_warn "Sidekiq pods: $SIDEKIQ_READY/$SIDEKIQ_TOTAL ready"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Check 7: Recent job executions
|
||||
echo "Checking recent CronJob executions..."
|
||||
JOB_COUNT=$(kubectl get jobs -n gitlab -l app=redis-secret-monitor --no-headers 2>/dev/null | wc -l)
|
||||
if [ "$JOB_COUNT" -gt 0 ]; then
|
||||
check_pass "Found $JOB_COUNT recent job execution(s)"
|
||||
|
||||
# Show last job
|
||||
LAST_JOB=$(kubectl get jobs -n gitlab -l app=redis-secret-monitor --sort-by=.metadata.creationTimestamp -o name 2>/dev/null | tail -1)
|
||||
if [ -n "$LAST_JOB" ]; then
|
||||
echo ""
|
||||
echo " Last job logs:"
|
||||
kubectl logs -n gitlab "$LAST_JOB" 2>/dev/null | sed 's/^/ /'
|
||||
fi
|
||||
else
|
||||
check_warn "No recent job executions (CronJob may not have run yet)"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Check 8: Secret version comparison
|
||||
echo "Checking secret version synchronization..."
|
||||
CURRENT_SECRET_VERSION=$(kubectl get secret -n gitlab redis-gitlab-secret -o jsonpath='{.metadata.resourceVersion}')
|
||||
TRACKED_SECRET_VERSION=$(kubectl get statefulset -n gitlab redis-gitlab -o jsonpath='{.spec.template.metadata.annotations.secret-version/redis-password}' 2>/dev/null || echo "")
|
||||
|
||||
echo " Current secret version: $CURRENT_SECRET_VERSION"
|
||||
echo " Tracked version in StatefulSet: $TRACKED_SECRET_VERSION"
|
||||
|
||||
if [ "$CURRENT_SECRET_VERSION" = "$TRACKED_SECRET_VERSION" ]; then
|
||||
check_pass "Secret versions are synchronized"
|
||||
elif [ -z "$TRACKED_SECRET_VERSION" ]; then
|
||||
check_warn "StatefulSet not yet tracking secret version (first sync pending)"
|
||||
else
|
||||
check_warn "Secret versions differ - restart pending on next CronJob run"
|
||||
echo " Next scheduled run will synchronize versions"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Summary
|
||||
echo "===================================================================="
|
||||
if [ $ERRORS -eq 0 ]; then
|
||||
echo -e "${GREEN}✓ All checks passed!${NC}"
|
||||
echo ""
|
||||
echo "Redis password rotation automation is properly configured."
|
||||
echo "The system will automatically restart Redis when passwords rotate."
|
||||
else
|
||||
echo -e "${RED}✗ $ERRORS check(s) failed${NC}"
|
||||
echo ""
|
||||
echo "Please review the errors above and ensure all automation"
|
||||
echo "components are properly deployed."
|
||||
exit 1
|
||||
fi
|
||||
echo "===================================================================="
|
||||
Reference in New Issue
Block a user