tegwick
1cbe00fd78
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
128 lines
5.5 KiB
Bash
Executable file
128 lines
5.5 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# creds-apply.sh — run all create-secrets.sh scripts in dependency order.
|
|
#
|
|
# Usage:
|
|
# bash sso-mfa/bootstrap/creds-apply.sh [secrets-dir]
|
|
# make creds-apply
|
|
#
|
|
# Dependency order:
|
|
# 1. postgresql (no dependencies)
|
|
# 2. lldap (needs: secrets/lldap/secrets.env)
|
|
# 3. authelia (needs: lldap/secrets.env → LLDAP_LDAP_USER_PASS)
|
|
# 4. privacyidea (needs: secrets/privacyidea/secrets.env)
|
|
# 5. keycape SKIPPED — requires owner-established RPF-WP-0040 factor delivery.
|
|
# create-secrets.sh is first-creation only, never live replacement.
|
|
#
|
|
# After each successful component create/verification, creds-state.yaml is updated.
|
|
# Differing existing values require a separate named rotation; this is not a batch rotation.
|
|
|
|
set +x
|
|
set -euo pipefail
|
|
umask 077
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
|
if (( $# > 1 )); then
|
|
echo "ERROR: expected one private secrets directory." >&2
|
|
exit 1
|
|
fi
|
|
SECRETS_DIR="$(realpath -sm -- "${1:-$SCRIPT_DIR/secrets}")"
|
|
STATE_FILE="$SCRIPT_DIR/creds-state.yaml"
|
|
K8S_DIR="$REPO_ROOT/sso-mfa/k8s"
|
|
|
|
# ── Preflight checks ──────────────────────────────────────────────────────────
|
|
if [[ -z "${KUBECONFIG:-}" && ! -f "$HOME/.kube/config" ]]; then
|
|
echo "ERROR: KUBECONFIG is not set and ~/.kube/config does not exist." >&2
|
|
echo " Set KUBECONFIG or ensure cluster access before running creds-apply." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! kubectl cluster-info &>/dev/null; then
|
|
echo "ERROR: Cannot reach the Kubernetes cluster." >&2
|
|
echo " Ensure the cluster is running and KUBECONFIG points to the right context." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -d "$SECRETS_DIR" ]]; then
|
|
echo "ERROR: secrets directory not found: $SECRETS_DIR" >&2
|
|
echo " Run 'make creds-generate' first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "=== creds-apply — net-kingdom SSO/MFA secrets ==="
|
|
echo "Secrets dir : $SECRETS_DIR"
|
|
echo "Cluster connectivity checked; use only the context admitted by the current procedure."
|
|
echo ""
|
|
|
|
# ── Helper: run a component's create-secrets.sh ───────────────────────────────
|
|
run_component() {
|
|
local component="$1"
|
|
local script_dir="$K8S_DIR/$component"
|
|
local script="$script_dir/create-secrets.sh"
|
|
local state_key="$2"
|
|
|
|
echo "──────────────────────────────────────────────"
|
|
echo "Applying: $component"
|
|
|
|
if [[ ! -f "$script" ]]; then
|
|
echo "ERROR: $script not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! (cd "$script_dir" && bash create-secrets.sh "$SECRETS_DIR") >/dev/null 2>&1; then
|
|
echo "ERROR: component create/verification failed; earlier components may already be applied." >&2
|
|
echo "Use metadata-only reconciliation before retry; no native acceptance is claimed." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Update state file
|
|
if [[ -f "$STATE_FILE" ]]; then
|
|
sed -i "s|^ $state_key: .*| $state_key: true|" "$STATE_FILE"
|
|
echo " [state] secrets_applied.$state_key → true"
|
|
fi
|
|
echo ""
|
|
}
|
|
|
|
# ── Step 1: PostgreSQL ────────────────────────────────────────────────────────
|
|
run_component "postgresql" "postgres"
|
|
|
|
# ── Step 2: LLDAP ────────────────────────────────────────────────────────────
|
|
if [[ ! -f "$SECRETS_DIR/lldap/secrets.env" ]]; then
|
|
echo "ERROR: $SECRETS_DIR/lldap/secrets.env not found — run creds-generate first." >&2
|
|
exit 1
|
|
fi
|
|
run_component "lldap" "lldap"
|
|
|
|
# ── Step 3: Authelia (needs LLDAP bind password from lldap/secrets.env) ───────
|
|
run_component "authelia" "authelia"
|
|
|
|
# ── Step 4: privacyIDEA ───────────────────────────────────────────────────────
|
|
if [[ ! -f "$SECRETS_DIR/privacyidea/secrets.env" ]]; then
|
|
echo "ERROR: $SECRETS_DIR/privacyidea/secrets.env not found." >&2
|
|
exit 1
|
|
fi
|
|
run_component "privacyidea" "privacyidea"
|
|
|
|
# ── Step 5: KeyCape — SKIPPED (requires scoped factor delivery) ──────────────────────
|
|
echo "──────────────────────────────────────────────"
|
|
echo "SKIPPED: keycape (requires RPF-WP-0040 scoped factor delivery)"
|
|
echo ""
|
|
echo " After privacyIDEA is Running and bootstrapped:"
|
|
echo " 1. Export existing keys from the verified Ready privacyIDEA pod:"
|
|
echo " bash $K8S_DIR/privacyidea/enckey-bootstrap.sh $SECRETS_DIR"
|
|
echo ""
|
|
echo " 2. Create the pi-admin user:"
|
|
echo " bash $K8S_DIR/privacyidea/bootstrap-admin.sh"
|
|
echo ""
|
|
echo " 3. Establish scoped factor custody and ESO delivery through railiance-platform RPF-WP-0040."
|
|
echo ""
|
|
echo " 4. Create KeyCape bootstrap secrets only if keycape-config is absent:"
|
|
echo " bash $K8S_DIR/keycape/create-secrets.sh $SECRETS_DIR"
|
|
echo ""
|
|
echo " 5. Update state:"
|
|
echo " make creds-verify"
|
|
echo ""
|
|
|
|
echo "=== creds-apply complete ==="
|
|
echo "Run 'make creds-status' to review state."
|
|
echo "Run 'make creds-verify' to confirm K8s secrets exist."
|