mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
119 lines
4.9 KiB
Bash
Executable File
119 lines
4.9 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# sync-gitlab-oauth.sh
|
|
# Retrieves ArgoCD OAuth provider credentials from Authentik and stores them in Vault
|
|
# This script should be run after Authentik is deployed and the ArgoCD blueprint is applied
|
|
|
|
AUTHENTIK_NAMESPACE="authentik"
|
|
VAULT_NAMESPACE="vault"
|
|
VAULT_SECRET_PATH="secret/argocd-oauth"
|
|
|
|
echo "=== Syncing ArgoCD OAuth Credentials from Authentik to Vault ==="
|
|
|
|
# Check if Authentik is running
|
|
# if ! kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server --no-headers 2>/dev/null | grep -q Running; then
|
|
# echo "ERROR: Authentik is not running. Please deploy Authentik first."
|
|
# exit 1
|
|
# fi
|
|
|
|
# Wait for Authentik to be fully ready
|
|
echo "Waiting for Authentik to be ready..."
|
|
kubectl -n "${AUTHENTIK_NAMESPACE}" wait --for=condition=Ready pod -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server --timeout=60s || {
|
|
echo "WARNING: Authentik may not be fully ready yet. Continuing anyway..."
|
|
}
|
|
|
|
# Get Authentik pod name
|
|
AUTHENTIK_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l app.kubernetes.io/name=authentik,app.kubernetes.io/component=server -o jsonpath='{.items[0].metadata.name}')
|
|
|
|
if [ -z "$AUTHENTIK_POD" ]; then
|
|
echo "ERROR: Could not find Authentik server pod"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Found Authentik pod: ${AUTHENTIK_POD}"
|
|
|
|
# Retrieve OAuth2 provider credentials from Authentik
|
|
# Note: This uses the Authentik API via the management interface
|
|
echo "Retrieving ArgoCD OAuth credentials from Authentik..."
|
|
|
|
# Method 1: Try to get credentials directly from Authentik database
|
|
CLIENT_ID=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${AUTHENTIK_POD}" -- ak list_providers --type oauth2 2>/dev/null | grep -A 20 '"name": "ArgoCD"' | grep '"client_id"' | cut -d'"' -f4 || echo "")
|
|
CLIENT_SECRET=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${AUTHENTIK_POD}" -- ak list_providers --type oauth2 2>/dev/null | grep -A 20 '"name": "ArgoCD"' | grep '"client_secret"' | cut -d'"' -f4 || echo "")
|
|
|
|
# If Method 1 fails, try using PostgreSQL directly
|
|
if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
|
|
echo "Attempting to retrieve credentials from Authentik PostgreSQL database..."
|
|
|
|
CNPG_POD=$(kubectl get pods -n "${AUTHENTIK_NAMESPACE}" -l cnpg.io/cluster=pg-authentik,role=primary -o jsonpath='{.items[0].metadata.name}')
|
|
|
|
if [ -z "$CNPG_POD" ]; then
|
|
echo "ERROR: Could not find Authentik PostgreSQL pod"
|
|
exit 1
|
|
fi
|
|
|
|
# Query the database for ArgoCD provider credentials
|
|
PROVIDER_DATA=$(kubectl exec -n "${AUTHENTIK_NAMESPACE}" "${CNPG_POD}" -- psql -U authentik -d authentik -t -c \
|
|
"SELECT client_id, client_secret FROM authentik_providers_oauth2_oauth2provider WHERE name='ArgoCD';" 2>/dev/null || echo "")
|
|
|
|
if [ -n "$PROVIDER_DATA" ]; then
|
|
CLIENT_ID=$(echo "$PROVIDER_DATA" | awk '{print $1}' | tr -d ' ')
|
|
CLIENT_SECRET=$(echo "$PROVIDER_DATA" | awk '{print $3}' | tr -d ' ')
|
|
fi
|
|
fi
|
|
|
|
# Validate credentials were retrieved
|
|
if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
|
|
echo "ERROR: Failed to retrieve ArgoCD OAuth credentials from Authentik"
|
|
echo ""
|
|
echo "Manual steps required:"
|
|
echo "1. Access Authentik admin panel at https://auth.kube.huskypup.net"
|
|
echo "2. Navigate to: Applications > Providers > ArgoCD"
|
|
echo "3. Copy the Client ID and Client Secret"
|
|
echo "4. Store them in Vault manually with:"
|
|
echo " vault kv put ${VAULT_SECRET_PATH} client-id=\"<CLIENT_ID>\" client-secret=\"<CLIENT_SECRET>\""
|
|
exit 1
|
|
fi
|
|
|
|
echo "Successfully retrieved credentials:"
|
|
echo " Client ID: ${CLIENT_ID}"
|
|
echo " Client Secret: ${CLIENT_SECRET:0:10}..." # Only show first 10 chars
|
|
|
|
# Check if Vault is unsealed and ready
|
|
echo "Checking Vault status..."
|
|
VAULT_POD=$(kubectl get pods -n "${VAULT_NAMESPACE}" -l app.kubernetes.io/name=vault -o jsonpath='{.items[0].metadata.name}')
|
|
|
|
if [ -z "$VAULT_POD" ]; then
|
|
echo "ERROR: Vault pod not found"
|
|
exit 1
|
|
fi
|
|
|
|
VAULT_STATUS=$(kubectl exec -n "${VAULT_NAMESPACE}" "${VAULT_POD}" -- vault status -format=json 2>/dev/null || echo "{}")
|
|
SEALED=$(echo "$VAULT_STATUS" | grep -o '"sealed":[^,}]*' | cut -d':' -f2 | tr -d ' ')
|
|
|
|
if [ "$SEALED" = "true" ]; then
|
|
echo "ERROR: Vault is sealed. Please unseal Vault first."
|
|
exit 1
|
|
fi
|
|
|
|
# Store credentials in Vault
|
|
echo "Storing ArgoCD OAuth credentials in Vault at ${VAULT_SECRET_PATH}..."
|
|
kubectl exec -n "${VAULT_NAMESPACE}" "${VAULT_POD}" -- vault kv put "${VAULT_SECRET_PATH}" \
|
|
client-id="${CLIENT_ID}" \
|
|
client-secret="${CLIENT_SECRET}"
|
|
|
|
if [ $? -eq 0 ]; then
|
|
echo "✓ Successfully stored ArgoCD OAuth credentials in Vault"
|
|
echo ""
|
|
echo "The External Secret Operator will now sync these credentials to the argocd namespace."
|
|
echo "You can verify with:"
|
|
echo " kubectl get externalsecret -n argocd argocd-oauth"
|
|
echo " kubectl get secret -n argocd argocd-oauth-secret"
|
|
else
|
|
echo "ERROR: Failed to store credentials in Vault"
|
|
exit 1
|
|
fi
|
|
|
|
echo ""
|
|
echo "=== ArgoCD OAuth Sync Complete ==="
|