Verify railiance01 identity dependencies

sso-mfa/k8s/verify-identity-cutover-dependencies.sh

@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+# Verify that the active identity stack has no runtime dependency on the
+# retired/source host. Secret values are decoded only in process memory and
+# never printed; failures report resource and key locators only.
+set -euo pipefail
+
+KUBECTL="${KUBECTL:-kubectl}"
+SOURCE_HOST_MARKER="${SOURCE_HOST_MARKER:-coulombcore}"
+SOURCE_IP="${SOURCE_IP:-92.205.130.254}"
+NAMESPACES="${NAMESPACES:-sso mfa user-engine databases}"
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+for namespace in $NAMESPACES; do
+    for kind in configmap secret deployment statefulset; do
+        "$KUBECTL" -n "$namespace" get "$kind" -o json \
+            >"$tmp/${namespace}-${kind}.json"
+    done
+done
+
+python3 - "$tmp" "$SOURCE_HOST_MARKER" "$SOURCE_IP" <<'PY'
+import base64
+import json
+import pathlib
+import sys
+
+root = pathlib.Path(sys.argv[1])
+patterns = {
+    "source-host": sys.argv[2].lower(),
+    "source-ip": sys.argv[3].lower(),
+    "public-lldap": "lldap.coulomb.social",
+    "public-privacyidea": "pink.coulomb.social",
+    "public-privacyidea-account": "pink-account.coulomb.social",
+}
+failures = []
+
+for path in sorted(root.glob("*.json")):
+    namespace, kind = path.stem.rsplit("-", 1)
+    for item in json.loads(path.read_text()).get("items", []):
+        name = item["metadata"]["name"]
+        if kind in {"configmap", "secret"}:
+            for key, raw in (item.get("data") or {}).items():
+                try:
+                    value = (
+                        base64.b64decode(raw).decode("utf-8", "replace")
+                        if kind == "secret"
+                        else raw
+                    )
+                except Exception:
+                    continue
+                lowered = value.lower()
+                hits = [label for label, needle in patterns.items() if needle in lowered]
+                if hits:
+                    failures.append(
+                        f"{kind}/{namespace}/{name}:{key} matches={','.join(hits)}"
+                    )
+        else:
+            lowered = json.dumps(item.get("spec", {}), sort_keys=True).lower()
+            hits = [label for label, needle in patterns.items() if needle in lowered]
+            if hits:
+                failures.append(
+                    f"{kind}/{namespace}/{name} matches={','.join(hits)}"
+                )
+
+if failures:
+    print("stale_dependencies=found")
+    for failure in failures:
+        print(failure)
+    raise SystemExit(1)
+print("stale_dependencies=absent")
+PY
+
+keycape_config="$(
+    "$KUBECTL" -n sso get secret keycape-config \
+        -o jsonpath='{.data.config\.yaml}' | base64 -d
+)"
+
+for expected in \
+    lldap.sso.svc.cluster.local \
+    authelia.sso.svc.cluster.local \
+    privacyidea.mfa.svc.cluster.local \
+    user-engine \
+    rapp-qonto
+do
+    if [[ "$keycape_config" != *"$expected"* ]]; then
+        echo "keycape_expected_dependency_missing=$expected" >&2
+        exit 1
+    fi
+done
+unset keycape_config
+echo "keycape_dependencies=cluster-local-and-complete"
+
+pg_pod="$(
+    "$KUBECTL" -n databases get pod \
+        -l 'cnpg.io/cluster=net-kingdom-pg,role=primary' \
+        -o jsonpath='{.items[0].metadata.name}'
+)"
+resolver_class="$(
+    "$KUBECTL" -n databases exec "$pg_pod" -- \
+        psql -X -A -t -U postgres -d privacyidea_db -c \
+        "select case
+           when lower(\"Value\") like '%lldap.sso.svc.cluster.local%'
+             then 'cluster-local'
+           else 'other'
+         end
+         from resolverconfig
+         where \"Key\"='LDAPURI';" 2>/dev/null
+)"
+if [[ "$resolver_class" != "cluster-local" ]]; then
+    echo "privacyidea_lldap_resolver=$resolver_class" >&2
+    exit 1
+fi
+echo "privacyidea_lldap_resolver=cluster-local"
+
+for target in \
+    sso/lldap \
+    sso/authelia \
+    sso/keycape \
+    mfa/privacyidea \
+    user-engine/user-engine
+do
+    namespace="${target%/*}"
+    name="${target#*/}"
+    ready="$(
+        "$KUBECTL" -n "$namespace" get deployment "$name" \
+            -o jsonpath='{.status.readyReplicas}'
+    )"
+    if [[ "${ready:-0}" -lt 1 ]]; then
+        echo "deployment_not_ready=$target" >&2
+        exit 1
+    fi
+done
+echo "identity_deployments=ready"
+echo "identity_cutover_dependencies=PASS"