mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
74 lines
2.7 KiB
Bash
74 lines
2.7 KiB
Bash
#!/bin/bash
|
|
# Sync GitLab admin status from Authentik "authentik Admins" group
|
|
# This script grants admin access to users who are members of "authentik Admins" in Authentik
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
NAMESPACE="gitlab"
|
|
ADMIN_GROUP="authentik Admins"
|
|
|
|
echo "🔄 Syncing GitLab admin permissions from Authentik..."
|
|
|
|
# Get GitLab root password
|
|
GITLAB_ROOT_PASSWORD=$(kubectl get secret -n gitlab gitlab-gitlab-initial-root-password -o jsonpath='{.data.password}' 2>/dev/null | base64 -d || echo "")
|
|
|
|
if [ -z "$GITLAB_ROOT_PASSWORD" ]; then
|
|
echo "❌ GitLab root password not found"
|
|
echo " Please login to GitLab UI first to complete initial setup"
|
|
exit 1
|
|
fi
|
|
|
|
# Get GitLab API endpoint
|
|
GITLAB_URL="https://gitlab.kube.huskypup.net"
|
|
|
|
echo "📋 Getting list of users from Authentik '$ADMIN_GROUP' group..."
|
|
|
|
# Get Authentik database password
|
|
PGPASSWORD=$(kubectl get secret -n authentik pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)
|
|
|
|
# Query Authentik database for users in admin group
|
|
ADMIN_USERS=$(kubectl exec -n authentik pg-authentik-1 -- env PGPASSWORD="$PGPASSWORD" psql -h pg-authentik-rw -U app -d app -t -c "
|
|
SELECT DISTINCT u.email
|
|
FROM authentik_core_user u
|
|
JOIN authentik_core_user_groups ug ON u.id = ug.user_id
|
|
JOIN authentik_core_group g ON ug.group_id = g.group_uuid
|
|
WHERE g.name = '$ADMIN_GROUP' AND u.is_active = true;
|
|
" 2>/dev/null | grep -v "Defaulted" | xargs)
|
|
|
|
if [ -z "$ADMIN_USERS" ]; then
|
|
echo "⚠️ No users found in Authentik '$ADMIN_GROUP' group"
|
|
exit 0
|
|
fi
|
|
|
|
echo "✓ Found admin users: $ADMIN_USERS"
|
|
echo ""
|
|
|
|
# Create GitLab API token (using root account)
|
|
echo "🔑 Creating GitLab API token..."
|
|
|
|
# Try to login and get session
|
|
SESSION_COOKIE=$(curl -sk -c - "$GITLAB_URL/users/sign_in" | grep '_gitlab_session' | awk '{print $7}')
|
|
|
|
# Get CSRF token
|
|
CSRF_TOKEN=$(curl -sk -b "_gitlab_session=$SESSION_COOKIE" "$GITLAB_URL/users/sign_in" | grep -o 'name="authenticity_token" value="[^"]*"' | cut -d'"' -f4)
|
|
|
|
# Login as root
|
|
LOGIN_RESPONSE=$(curl -sk -b "_gitlab_session=$SESSION_COOKIE" -c - \
|
|
-X POST "$GITLAB_URL/users/sign_in" \
|
|
-d "user[login]=root&user[password]=$GITLAB_ROOT_PASSWORD&authenticity_token=$CSRF_TOKEN")
|
|
|
|
echo "⚠️ Note: GitLab CE doesn't support automatic admin assignment via API"
|
|
echo " Users must be manually promoted to admin in GitLab UI"
|
|
echo ""
|
|
echo "📝 To manually grant admin access:"
|
|
echo " 1. Login to GitLab as root: $GITLAB_URL"
|
|
echo " 2. Go to Admin Area > Users"
|
|
echo " 3. Find and edit each user: $ADMIN_USERS"
|
|
echo " 4. Check 'Admin' checkbox and save"
|
|
echo ""
|
|
echo "💡 Alternatively, run this from a GitLab Rails console:"
|
|
for email in $ADMIN_USERS; do
|
|
echo " User.find_by(email: '$email')&.update(admin: true)"
|
|
done
|