mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
127 lines
4.8 KiB
Bash
Executable File
127 lines
4.8 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# setup-ceph-saml.sh
|
|
# Configures Ceph Dashboard SAML2 SSO with Authentik
|
|
# This script should be run after both Ceph and Authentik are deployed
|
|
|
|
CEPH_NAMESPACE="rook-ceph"
|
|
AUTHENTIK_NAMESPACE="authentik"
|
|
CEPH_BASE_URL="https://ceph.kube.huskypup.net"
|
|
AUTHENTIK_SAML_METADATA="https://auth.kube.huskypup.net/application/saml/ceph-dashboard/metadata/"
|
|
USERNAME_ATTRIBUTE="username"
|
|
|
|
echo "=== Setting up Ceph Dashboard SAML2 SSO ==="
|
|
|
|
# Check if Ceph tools pod is available
|
|
echo "Checking for Ceph tools pod..."
|
|
if ! kubectl -n "${CEPH_NAMESPACE}" get deploy rook-ceph-tools >/dev/null 2>&1; then
|
|
echo "ERROR: rook-ceph-tools deployment not found"
|
|
exit 1
|
|
fi
|
|
|
|
# Wait for Ceph tools to be ready
|
|
echo "Waiting for Ceph tools pod to be ready..."
|
|
kubectl -n "${CEPH_NAMESPACE}" wait --for=condition=Available deployment/rook-ceph-tools --timeout=120s || {
|
|
echo "WARNING: Ceph tools pod may not be ready. Continuing anyway..."
|
|
}
|
|
|
|
# Check Ceph cluster health
|
|
echo "Checking Ceph cluster health..."
|
|
CEPH_HEALTH=$(kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- ceph health 2>/dev/null || echo "UNKNOWN")
|
|
echo "Ceph health: ${CEPH_HEALTH}"
|
|
|
|
if [[ "$CEPH_HEALTH" == "UNKNOWN" ]]; then
|
|
echo "ERROR: Cannot communicate with Ceph cluster"
|
|
exit 1
|
|
fi
|
|
|
|
# Check if Authentik SAML metadata is accessible
|
|
echo "Verifying Authentik SAML metadata endpoint..."
|
|
HTTP_CODE=$(curl -sk -o /dev/null -w "%{http_code}" "${AUTHENTIK_SAML_METADATA}" 2>/dev/null || echo "000")
|
|
if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "302" ]]; then
|
|
echo "WARNING: Authentik SAML metadata endpoint returned HTTP ${HTTP_CODE}"
|
|
echo "The Ceph SAML application may not be configured in Authentik yet."
|
|
echo "Ensure the ceph-blueprint.yaml is applied to Authentik."
|
|
fi
|
|
|
|
# Configure SAML2 SSO
|
|
echo "Configuring SAML2 SSO..."
|
|
SAML_CONFIG=$(kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- \
|
|
ceph dashboard sso setup saml2 \
|
|
"${CEPH_BASE_URL}" \
|
|
"${AUTHENTIK_SAML_METADATA}" \
|
|
"${USERNAME_ATTRIBUTE}" 2>&1) || {
|
|
echo "ERROR: Failed to configure SAML2 SSO"
|
|
echo "$SAML_CONFIG"
|
|
exit 1
|
|
}
|
|
|
|
echo "SAML2 configuration applied successfully"
|
|
|
|
# Enable SSO
|
|
echo "Enabling SAML2 SSO..."
|
|
kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- \
|
|
ceph dashboard sso enable saml2
|
|
|
|
# Verify SSO status
|
|
SSO_STATUS=$(kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- \
|
|
ceph dashboard sso status 2>/dev/null)
|
|
echo "SSO Status: ${SSO_STATUS}"
|
|
|
|
# Create SSO users from Authentik
|
|
echo ""
|
|
echo "Creating SSO users in Ceph Dashboard..."
|
|
|
|
# Get active users from Authentik database
|
|
CNPG_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l cnpg.io/cluster=pg-authentik -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
|
|
|
|
if [ -n "$CNPG_POD" ]; then
|
|
# Get password from secret
|
|
DB_PASSWORD=$(kubectl -n "${AUTHENTIK_NAMESPACE}" get secret pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)
|
|
|
|
# Query for active non-service users
|
|
USERS=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${CNPG_POD}" -c postgres -- \
|
|
sh -c "PGPASSWORD='${DB_PASSWORD}' psql -h localhost -U app -d app -t -c \"SELECT username FROM authentik_core_user WHERE is_active = true AND username NOT LIKE 'ak-%' AND username != 'AnonymousUser';\"" 2>/dev/null | tr -d ' ' | grep -v '^$' || echo "")
|
|
|
|
if [ -n "$USERS" ]; then
|
|
echo "Found users in Authentik: $(echo $USERS | tr '\n' ' ')"
|
|
|
|
# Get existing Ceph users
|
|
EXISTING_USERS=$(kubectl -n "${CEPH_NAMESPACE}" exec deploy/rook-ceph-tools -- \
|
|
ceph dashboard ac-user-show 2>/dev/null | tr -d '[]"' | tr ',' '\n' | tr -d ' ')
|
|
|
|
for USER in $USERS; do
|
|
if echo "$EXISTING_USERS" | grep -q "^${USER}$"; then
|
|
echo " User '${USER}' already exists in Ceph"
|
|
else
|
|
echo " Creating user '${USER}' with administrator role..."
|
|
# Create user with a temporary password (SSO will bypass password auth)
|
|
echo "sso-managed-password-$(date +%s)" | kubectl -n "${CEPH_NAMESPACE}" exec -i deploy/rook-ceph-tools -- \
|
|
ceph dashboard ac-user-create "${USER}" -i - administrator 2>/dev/null && \
|
|
echo " Created user '${USER}'" || \
|
|
echo " WARNING: Failed to create user '${USER}'"
|
|
fi
|
|
done
|
|
else
|
|
echo "No users found in Authentik to sync"
|
|
fi
|
|
else
|
|
echo "WARNING: Could not find Authentik PostgreSQL pod. Skipping user sync."
|
|
echo "You may need to manually create Ceph users matching your Authentik usernames."
|
|
fi
|
|
|
|
echo ""
|
|
echo "=== Ceph Dashboard SAML2 SSO Setup Complete ==="
|
|
echo ""
|
|
echo "Configuration:"
|
|
echo " Base URL: ${CEPH_BASE_URL}"
|
|
echo " IdP Metadata: ${AUTHENTIK_SAML_METADATA}"
|
|
echo " Username Attribute: ${USERNAME_ATTRIBUTE}"
|
|
echo ""
|
|
echo "To login:"
|
|
echo " 1. Navigate to ${CEPH_BASE_URL}/auth/saml2/login"
|
|
echo " 2. Authenticate with Authentik"
|
|
echo " 3. You will be redirected to Ceph Dashboard"
|
|
echo ""
|