55 lines
2.1 KiB
Bash
55 lines
2.1 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# k8s/talos-iam/setup_talos_iam.sh
|
||
|
|
# Validates required env vars are set, then delegates to helmfile.
|
||
|
|
# All provisioning logic lives in helmfile hooks + provision_oidc.py.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# vsource .env && bash k8s/talos-iam/setup_talos_iam.sh
|
||
|
|
#
|
||
|
|
# To re-provision OIDC without redeploying Authentik:
|
||
|
|
# vsource .env && helmfile apply -l name=authentik
|
||
|
|
#
|
||
|
|
# To patch existing providers (update redirect URIs, scopes):
|
||
|
|
# vsource .env && helmfile apply -l name=authentik # postsync runs provision_oidc.py --patch implicitly
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
|
KUBECONFIG="${KUBECONFIG:-${SCRIPT_DIR}/../cluster-config/kubeconfig}"
|
||
|
|
export KUBECONFIG
|
||
|
|
|
||
|
|
# ── Validate all required secrets are loaded from Vault ──────────────────────
|
||
|
|
MISSING=()
|
||
|
|
for var in \
|
||
|
|
AUTHENTIK_SECRET_KEY \
|
||
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD \
|
||
|
|
AUTHENTIK_BOOTSTRAP_TOKEN \
|
||
|
|
AUTHENTIK_PG_PASSWORD \
|
||
|
|
GRAFANA_OIDC_CLIENT_SECRET \
|
||
|
|
MINIO_OIDC_CLIENT_SECRET \
|
||
|
|
AUTHENTIK_FORGEJO_CLIENT_SECRET \
|
||
|
|
AUTHENTIK_ARGOCD_CLIENT_SECRET; do
|
||
|
|
[[ -z "${!var:-}" ]] && MISSING+=("$var")
|
||
|
|
done
|
||
|
|
|
||
|
|
if [[ ${#MISSING[@]} -gt 0 ]]; then
|
||
|
|
echo "ERROR: the following vars are not set — run 'vsource .env' first:" >&2
|
||
|
|
printf ' %s\n' "${MISSING[@]}" >&2
|
||
|
|
echo "" >&2
|
||
|
|
echo "If a var is missing from Vault, store it first:" >&2
|
||
|
|
echo " talos put cluster/VAR_NAME VAR_NAME=\"\$(openssl rand -hex 32)\"" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "All required secrets present."
|
||
|
|
echo ""
|
||
|
|
echo "Provider credential mapping (client_id → client_secret):"
|
||
|
|
printf ' %-10s client_id=%-40s secret=%s\n' \
|
||
|
|
"grafana" "${GRAFANA_OIDC_CLIENT_ID:-"grafana (default)"}" "GRAFANA_OIDC_CLIENT_SECRET" \
|
||
|
|
"minio" "${MINIO_OIDC_CLIENT_ID:-"minio (default)"}" "MINIO_OIDC_CLIENT_SECRET" \
|
||
|
|
"forgejo" "${AUTHENTIK_FORGEJO_CLIENT_ID:-"forgejo (default)"}" "AUTHENTIK_FORGEJO_CLIENT_SECRET" \
|
||
|
|
"argocd" "${AUTHENTIK_ARGOCD_CLIENT_ID:-"argocd (default)"}" "AUTHENTIK_ARGOCD_CLIENT_SECRET"
|
||
|
|
echo ""
|
||
|
|
echo "Delegating to helmfile..."
|
||
|
|
cd "${SCRIPT_DIR}/../.."
|
||
|
|
helmfile apply -l name=authentik
|