135 lines
4.1 KiB
Bash
Executable file
135 lines
4.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Verify that the active identity stack has no runtime dependency on the
|
|
# retired/source host. Secret values are decoded only in process memory and
|
|
# never printed; failures report resource and key locators only.
|
|
set -euo pipefail
|
|
|
|
KUBECTL="${KUBECTL:-kubectl}"
|
|
SOURCE_HOST_MARKER="${SOURCE_HOST_MARKER:-coulombcore}"
|
|
SOURCE_IP="${SOURCE_IP:-92.205.130.254}"
|
|
NAMESPACES="${NAMESPACES:-sso mfa user-engine databases}"
|
|
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
|
|
for namespace in $NAMESPACES; do
|
|
for kind in configmap secret deployment statefulset; do
|
|
"$KUBECTL" -n "$namespace" get "$kind" -o json \
|
|
>"$tmp/${namespace}-${kind}.json"
|
|
done
|
|
done
|
|
|
|
python3 - "$tmp" "$SOURCE_HOST_MARKER" "$SOURCE_IP" <<'PY'
|
|
import base64
|
|
import json
|
|
import pathlib
|
|
import sys
|
|
|
|
root = pathlib.Path(sys.argv[1])
|
|
patterns = {
|
|
"source-host": sys.argv[2].lower(),
|
|
"source-ip": sys.argv[3].lower(),
|
|
"public-lldap": "lldap.coulomb.social",
|
|
"public-privacyidea": "pink.coulomb.social",
|
|
"public-privacyidea-account": "pink-account.coulomb.social",
|
|
}
|
|
failures = []
|
|
|
|
for path in sorted(root.glob("*.json")):
|
|
namespace, kind = path.stem.rsplit("-", 1)
|
|
for item in json.loads(path.read_text()).get("items", []):
|
|
name = item["metadata"]["name"]
|
|
if kind in {"configmap", "secret"}:
|
|
for key, raw in (item.get("data") or {}).items():
|
|
try:
|
|
value = (
|
|
base64.b64decode(raw).decode("utf-8", "replace")
|
|
if kind == "secret"
|
|
else raw
|
|
)
|
|
except Exception:
|
|
continue
|
|
lowered = value.lower()
|
|
hits = [label for label, needle in patterns.items() if needle in lowered]
|
|
if hits:
|
|
failures.append(
|
|
f"{kind}/{namespace}/{name}:{key} matches={','.join(hits)}"
|
|
)
|
|
else:
|
|
lowered = json.dumps(item.get("spec", {}), sort_keys=True).lower()
|
|
hits = [label for label, needle in patterns.items() if needle in lowered]
|
|
if hits:
|
|
failures.append(
|
|
f"{kind}/{namespace}/{name} matches={','.join(hits)}"
|
|
)
|
|
|
|
if failures:
|
|
print("stale_dependencies=found")
|
|
for failure in failures:
|
|
print(failure)
|
|
raise SystemExit(1)
|
|
print("stale_dependencies=absent")
|
|
PY
|
|
|
|
keycape_config="$(
|
|
"$KUBECTL" -n sso get secret keycape-config \
|
|
-o jsonpath='{.data.config\.yaml}' | base64 -d
|
|
)"
|
|
|
|
for expected in \
|
|
lldap.sso.svc.cluster.local \
|
|
authelia.sso.svc.cluster.local \
|
|
privacyidea.mfa.svc.cluster.local \
|
|
user-engine \
|
|
rapp-qonto
|
|
do
|
|
if [[ "$keycape_config" != *"$expected"* ]]; then
|
|
echo "keycape_expected_dependency_missing=$expected" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
unset keycape_config
|
|
echo "keycape_dependencies=cluster-local-and-complete"
|
|
|
|
pg_pod="$(
|
|
"$KUBECTL" -n databases get pod \
|
|
-l 'cnpg.io/cluster=net-kingdom-pg,role=primary' \
|
|
-o jsonpath='{.items[0].metadata.name}'
|
|
)"
|
|
resolver_class="$(
|
|
"$KUBECTL" -n databases exec "$pg_pod" -- \
|
|
psql -X -A -t -U postgres -d privacyidea_db -c \
|
|
"select case
|
|
when lower(\"Value\") like '%lldap.sso.svc.cluster.local%'
|
|
then 'cluster-local'
|
|
else 'other'
|
|
end
|
|
from resolverconfig
|
|
where \"Key\"='LDAPURI';" 2>/dev/null
|
|
)"
|
|
if [[ "$resolver_class" != "cluster-local" ]]; then
|
|
echo "privacyidea_lldap_resolver=$resolver_class" >&2
|
|
exit 1
|
|
fi
|
|
echo "privacyidea_lldap_resolver=cluster-local"
|
|
|
|
for target in \
|
|
sso/lldap \
|
|
sso/authelia \
|
|
sso/keycape \
|
|
mfa/privacyidea \
|
|
user-engine/user-engine
|
|
do
|
|
namespace="${target%/*}"
|
|
name="${target#*/}"
|
|
ready="$(
|
|
"$KUBECTL" -n "$namespace" get deployment "$name" \
|
|
-o jsonpath='{.status.readyReplicas}'
|
|
)"
|
|
if [[ "${ready:-0}" -lt 1 ]]; then
|
|
echo "deployment_not_ready=$target" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
echo "identity_deployments=ready"
|
|
echo "identity_cutover_dependencies=PASS"
|