#!/bin/bash
# verify-gitlab-oidc.sh
# Verify GitLab OIDC configuration and connectivity to Authentik

set -euo pipefail

echo "=== GitLab OIDC Configuration Verification ==="
echo ""

# Check if GitLab pods are running
echo "1. Checking GitLab pods status..."
kubectl get pods -n gitlab -l app=webservice
echo ""

# Check hostAliases in webservice pods
echo "2. Verifying hostAliases in GitLab webservice..."
WEBSERVICE_POD=$(kubectl get pod -n gitlab -l app=webservice -o jsonpath='{.items[0].metadata.name}')
echo "Using pod: $WEBSERVICE_POD"
kubectl get pod -n gitlab "$WEBSERVICE_POD" -o jsonpath='{.spec.hostAliases}' | jq .
echo ""

# Test DNS resolution from inside GitLab pod
echo "3. Testing DNS resolution for auth.kube.huskypup.net from GitLab pod..."
kubectl exec -n gitlab "$WEBSERVICE_POD" -c webservice -- getent hosts auth.kube.huskypup.net || echo "getent not available, trying nslookup..."
echo ""

# Test HTTPS connectivity to Authentik
echo "4. Testing HTTPS connectivity to Authentik..."
kubectl exec -n gitlab "$WEBSERVICE_POD" -c webservice -- curl -I https://auth.kube.huskypup.net/.well-known/openid-configuration 2>&1 | head -20
echo ""

# Check OIDC configuration
echo "5. Checking OIDC discovery endpoint..."
kubectl exec -n gitlab "$WEBSERVICE_POD" -c webservice -- curl -s https://auth.kube.huskypup.net/application/o/gitlab/.well-known/openid-configuration 2>&1 | head -10
echo ""

# Check for any SSL errors in logs
echo "6. Checking recent GitLab logs for SSL errors..."
kubectl logs -n gitlab "$WEBSERVICE_POD" -c webservice --tail=50 | grep -i "ssl\|certificate\|openid" || echo "No SSL/certificate errors found in recent logs"
echo ""

echo "=== Verification Complete ==="
echo ""
echo "If you see 'HTTP/1.1 200 OK' or 'HTTP/2 200' above, OIDC is working correctly!"
echo "If you see SSL errors, check the hostAliases configuration."