mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
68 lines
2.1 KiB
Bash
Executable File
68 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# Grant GitLab admin access to users in Authentik "authentik Admins" group
|
|
# Run this after users login via Authentik SSO
|
|
|
|
set -euo pipefail
|
|
|
|
ADMIN_GROUP="authentik Admins"
|
|
|
|
echo "🔄 Granting GitLab admin access to Authentik admin group members..."
|
|
echo ""
|
|
|
|
# Get Authentik database password
|
|
PGPASSWORD=$(kubectl get secret -n authentik pg-authentik-app -o jsonpath='{.data.password}' | base64 -d)
|
|
|
|
# Query Authentik for users in admin group
|
|
echo "📋 Getting users from Authentik '$ADMIN_GROUP' group..."
|
|
ADMIN_EMAILS=$(kubectl exec -n authentik pg-authentik-1 -- env PGPASSWORD="$PGPASSWORD" psql -h pg-authentik-rw -U app -d app -t -c "
|
|
SELECT DISTINCT u.email
|
|
FROM authentik_core_user u
|
|
JOIN authentik_core_user_groups ug ON u.id = ug.user_id
|
|
JOIN authentik_core_group g ON ug.group_id = g.group_uuid
|
|
WHERE g.name = '$ADMIN_GROUP' AND u.is_active = true;
|
|
" 2>&1 | grep -v "Defaulted" | grep '@' | xargs)
|
|
|
|
if [ -z "$ADMIN_EMAILS" ]; then
|
|
echo "⚠️ No users found in Authentik '$ADMIN_GROUP' group"
|
|
exit 0
|
|
fi
|
|
|
|
echo "✓ Found admin users: $ADMIN_EMAILS"
|
|
echo ""
|
|
|
|
# Check if gitlab-toolbox pod exists
|
|
TOOLBOX_POD=$(kubectl get pods -n gitlab -l app=toolbox,release=gitlab -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
|
|
|
|
if [ -z "$TOOLBOX_POD" ]; then
|
|
echo "❌ GitLab toolbox pod not found"
|
|
echo " Toolbox is required to run Rails commands"
|
|
exit 1
|
|
fi
|
|
|
|
echo "🔧 Using toolbox pod: $TOOLBOX_POD"
|
|
echo ""
|
|
|
|
# For each admin user, grant admin access
|
|
for email in $ADMIN_EMAILS; do
|
|
echo "🔐 Processing: $email"
|
|
|
|
kubectl exec -n gitlab "$TOOLBOX_POD" -- gitlab-rails runner "
|
|
user = User.find_by(email: '$email')
|
|
if user
|
|
if user.admin?
|
|
puts ' ✓ Already admin'
|
|
else
|
|
user.update!(admin: true)
|
|
puts ' ✅ Promoted to admin'
|
|
end
|
|
else
|
|
puts ' ⚠️ User not found (needs to login via Authentik SSO first)'
|
|
end
|
|
" 2>&1 | grep -v "^$"
|
|
done
|
|
|
|
echo ""
|
|
echo "✅ Admin sync complete!"
|
|
echo ""
|
|
echo "💡 Note: Users must login via Authentik SSO at least once before they can be promoted"
|