mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
83 lines
3.1 KiB
Bash
Executable File
83 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# setup-netbird-api-token.sh - Bootstrap Netbird API token for operator + exporter
|
|
#
|
|
# Creates a service user in Netbird and generates a long-lived PAT (Personal Access Token)
|
|
# for automation. Stores the token in Vault for ExternalSecret consumption.
|
|
#
|
|
# Usage:
|
|
# ./scripts/setup-netbird-api-token.sh <admin-pat>
|
|
#
|
|
# Prerequisites:
|
|
# - Netbird management server running and accessible
|
|
# - Admin PAT from Netbird dashboard (Settings → Personal Access Tokens)
|
|
# - Vault initialized and unsealed
|
|
# - kubectl configured for the cluster
|
|
|
|
set -euo pipefail
|
|
|
|
ADMIN_PAT="${1:?Usage: $0 <admin-pat>}"
|
|
NETBIRD_API="https://netbird.kube.huskypup.net"
|
|
SERVICE_USER_NAME="k8s-operator"
|
|
PAT_NAME="operator-automation"
|
|
|
|
echo "=== Netbird API Token Bootstrap ==="
|
|
|
|
# Check for existing service user
|
|
echo "Checking for existing service user '${SERVICE_USER_NAME}'..."
|
|
USERS=$(curl -sf -H "Authorization: Token ${ADMIN_PAT}" \
|
|
"${NETBIRD_API}/api/users" 2>/dev/null || echo "[]")
|
|
|
|
SERVICE_USER_ID=$(echo "${USERS}" | jq -r \
|
|
".[] | select(.name == \"${SERVICE_USER_NAME}\" and .is_service_user == true) | .id" 2>/dev/null || echo "")
|
|
|
|
if [ -z "${SERVICE_USER_ID}" ]; then
|
|
echo "Creating service user '${SERVICE_USER_NAME}'..."
|
|
RESPONSE=$(curl -sf -X POST \
|
|
-H "Authorization: Token ${ADMIN_PAT}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"name\": \"${SERVICE_USER_NAME}\", \"role\": \"admin\", \"is_service_user\": true, \"auto_groups\": []}" \
|
|
"${NETBIRD_API}/api/users")
|
|
SERVICE_USER_ID=$(echo "${RESPONSE}" | jq -r '.id')
|
|
echo " Created service user: ${SERVICE_USER_ID}"
|
|
else
|
|
echo " Service user already exists: ${SERVICE_USER_ID}"
|
|
fi
|
|
|
|
# Create PAT for the service user
|
|
echo "Creating Personal Access Token '${PAT_NAME}'..."
|
|
# Set expiration to 365 days from now
|
|
EXPIRES=$(date -u -d "+365 days" "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || \
|
|
date -u -v+365d "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null)
|
|
|
|
PAT_RESPONSE=$(curl -sf -X POST \
|
|
-H "Authorization: Token ${ADMIN_PAT}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"name\": \"${PAT_NAME}\", \"expires_in\": 365}" \
|
|
"${NETBIRD_API}/api/users/${SERVICE_USER_ID}/tokens")
|
|
|
|
API_TOKEN=$(echo "${PAT_RESPONSE}" | jq -r '.plain_token')
|
|
|
|
if [ -z "${API_TOKEN}" ] || [ "${API_TOKEN}" = "null" ]; then
|
|
echo "ERROR: Failed to create PAT. Response:"
|
|
echo "${PAT_RESPONSE}" | jq . 2>/dev/null || echo "${PAT_RESPONSE}"
|
|
exit 1
|
|
fi
|
|
|
|
echo " PAT created successfully"
|
|
|
|
# Store in Vault
|
|
echo "Storing API token in Vault at secret/netbird-api-token..."
|
|
ROOT_TOKEN=$(kubectl -n vault get secret vault-init-keys -o jsonpath='{.data.VAULT_ROOT_TOKEN}' | base64 -d)
|
|
kubectl exec -n vault vault-0 -- env "VAULT_TOKEN=${ROOT_TOKEN}" \
|
|
vault kv put secret/netbird-api-token api-token="${API_TOKEN}"
|
|
|
|
echo ""
|
|
echo "=== Netbird API Token Bootstrap Complete ==="
|
|
echo " Service User: ${SERVICE_USER_NAME} (${SERVICE_USER_ID})"
|
|
echo " Vault Path: secret/netbird-api-token"
|
|
echo " Expires: ~365 days"
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " 1. Run: helmfile apply (deploys operator + exporter with the token)"
|
|
echo " 2. Annotate services: kubectl annotate svc <name> -n <ns> netbird.io/expose=true"
|