mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
3f96f66a78
Rewrites (updated for knoe namespace, GKE support, and current service configs): init_gitlab.sh, init_kong.sh, init_cnpg_backup.sh, init_monitoring.sh, init_garage_store.sh, init_gitea.sh, init_kdc.sh, init_openbao.sh, init_argocd.sh, init_certmgr.sh, init_common_services.sh, init_db_manager.sh, init_forgejo.sh, init_k3s_registry.sh, init_kerberos.sh, init_nginx_ingress.sh, init_port_forwards.sh, init_registry.sh, init_service_layer.sh Deleted: init_cloudnative_pg.sh (superseded by init_cnpg_gke.sh) New scripts: init_cnpg_gke.sh — CNPG setup for GKE with Workload Identity init_knoe_auth.sh — knoe-auth OIDC service init init_knoe_users.sh — user provisioning init_redis.sh — Redis init init_oauth2_proxy.sh / init_oauth2_proxy_prole.sh — OAuth2 proxy setup init_grafana_oauth.sh / init_grafana_oauth_prole.sh — Grafana OAuth wiring init_1password.sh — 1Password Connect init init_min.sh — minimal bootstrap Co-authored-by: Junie <junie@jetbrains.com>
101 lines
4.0 KiB
Bash
101 lines
4.0 KiB
Bash
#!/usr/bin/env bash
|
|
# init_grafana_oauth_prole.sh
|
|
#
|
|
# Bootstrap the Google-OAuth secret for Grafana on the prole.org k3s homelab
|
|
# cluster. Companion to the knoe.dev version (init_grafana_oauth.sh) but uses
|
|
# prole.org GCP project credentials and targets the k3s kubecontext.
|
|
#
|
|
# Creates the grafana-google-oidc Secret in the monitoring namespace, which
|
|
# kps-grafana mounts via envFromSecret to get GF_AUTH_GOOGLE_CLIENT_ID and
|
|
# GF_AUTH_GOOGLE_CLIENT_SECRET for its auth.google sign-in flow.
|
|
#
|
|
# Auth model (monitoring/kps-values-k3s.yaml):
|
|
# - Kerberos/knoe-auth users auto-login via auth.proxy (X-WEBAUTH-USER).
|
|
# - chrisfu@prole.org (and any future @prole.org Workspace user) signs in
|
|
# with the Google button on the Grafana login page.
|
|
# - chrisfu@prole.org → Admin; all other @prole.org users → Editor.
|
|
#
|
|
# Usage:
|
|
# ./etc/init_grafana_oauth_prole.sh
|
|
#
|
|
# Env vars (resolved from etc/secrets/* if not set in the shell):
|
|
# GRAFANA_GOOGLE_CLIENT_ID ← from etc/secrets/grafana-google-oidc-client-id-prole
|
|
# GRAFANA_GOOGLE_CLIENT_SECRET ← from etc/secrets/grafana-google-oidc-client-secret-prole
|
|
#
|
|
# Optional:
|
|
# K3S_KUBECONTEXT (default: $KUBECONTEXT then ambient)
|
|
# NAMESPACE (default: monitoring)
|
|
#
|
|
# Pre-reqs:
|
|
# - OAuth 2.0 Web Application client created in the prole.org GCP project:
|
|
# Authorized JS origins: https://svc.prole.org
|
|
# Authorized redirect URI: https://svc.prole.org/grafana/login/google
|
|
# Consent screen: Internal (prole.org Workspace)
|
|
# Scopes: openid, email, profile
|
|
# See deploy/gcp/gke/grafana-google-oidc-secret-prole.example.yaml for details.
|
|
# - Client ID and secret saved (chmod 0600) to:
|
|
# etc/secrets/grafana-google-oidc-client-id-prole
|
|
# etc/secrets/grafana-google-oidc-client-secret-prole
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
MANIFEST_DIR="$REPO_ROOT/deploy/gcp/gke"
|
|
|
|
NAMESPACE="${NAMESPACE:-monitoring}"
|
|
KCTX="${K3S_KUBECONTEXT:-${KUBECONTEXT:-}}"
|
|
|
|
if [[ -n "$KCTX" ]]; then
|
|
KCTX_FLAG=(--context="$KCTX")
|
|
else
|
|
KCTX_FLAG=()
|
|
fi
|
|
|
|
log() { printf "[%s] %s\n" "$(date +%H:%M:%S)" "$*"; }
|
|
die() { log "ERROR: $*" >&2; exit 1; }
|
|
|
|
resolve_secret() {
|
|
local var="$1" file="$2" val="${!1:-}"
|
|
if [[ -z "$val" && -f "$REPO_ROOT/etc/secrets/$file" ]]; then
|
|
val="$(cat "$REPO_ROOT/etc/secrets/$file")"
|
|
fi
|
|
if [[ -z "$val" ]]; then
|
|
die "missing $var (set the env var, or save the value into etc/secrets/$file)"
|
|
fi
|
|
printf '%s' "$val"
|
|
}
|
|
|
|
for tool in kubectl envsubst; do
|
|
command -v "$tool" >/dev/null 2>&1 || die "required tool not found: $tool"
|
|
done
|
|
|
|
GRAFANA_GOOGLE_CLIENT_ID="$(resolve_secret GRAFANA_GOOGLE_CLIENT_ID grafana-google-oidc-client-id-prole)"
|
|
GRAFANA_GOOGLE_CLIENT_SECRET="$(resolve_secret GRAFANA_GOOGLE_CLIENT_SECRET grafana-google-oidc-client-secret-prole)"
|
|
export GRAFANA_GOOGLE_CLIENT_ID GRAFANA_GOOGLE_CLIENT_SECRET
|
|
|
|
SECRET_TMPL="$MANIFEST_DIR/grafana-google-oidc-secret-prole.example.yaml"
|
|
[[ -f "$SECRET_TMPL" ]] || die "missing manifest: $SECRET_TMPL"
|
|
|
|
log "==> grafana google-oauth bootstrap (prole.org / k3s)"
|
|
log " namespace : $NAMESPACE"
|
|
log " kubectx : ${KCTX:-<ambient>}"
|
|
|
|
log "Applying grafana-google-oidc Secret ..."
|
|
envsubst '${GRAFANA_GOOGLE_CLIENT_ID} ${GRAFANA_GOOGLE_CLIENT_SECRET}' \
|
|
< "$SECRET_TMPL" \
|
|
| kubectl "${KCTX_FLAG[@]}" -n "$NAMESPACE" apply -f -
|
|
|
|
log "==> grafana google-oauth secret applied."
|
|
echo ""
|
|
echo " Next steps:"
|
|
echo " 1. Helm upgrade kube-prometheus-stack with the k3s values:"
|
|
echo " helm upgrade --reuse-values kps prometheus-community/kube-prometheus-stack \\"
|
|
echo " --namespace $NAMESPACE \\"
|
|
echo " -f $REPO_ROOT/monitoring/kps-values-k3s.yaml"
|
|
echo " 2. Restart grafana-proxy to pick up the updated configmap:"
|
|
echo " kubectl rollout restart deployment/knoe-grafana-proxy -n $NAMESPACE"
|
|
echo " 3. Browser-test: https://svc.prole.org/grafana/login → Google sign-in button"
|
|
echo " present; Kerberos users still auto-login via X-WEBAUTH-USER."
|
|
echo ""
|