prole/etc/init_kerberos_test.sh

#!/usr/bin/env bash

set -euo pipefail

# init_kerberos_test.sh
# Purpose:
# - Run Kerberos authentication checks inside the in-cluster KDC pod

# Initialize SCRIPT_DIR
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)

ORIG_ARGS=("$@")

# Load env
if [[ -n "${PROLE_HOME:-}" && -f "$PROLE_HOME/env.sh" ]]; then
  set --
  # shellcheck disable=SC1090
  source "$PROLE_HOME/env.sh"
  set -- "${ORIG_ARGS[@]}"
elif [[ -f "$HOME/.prole/env.sh" ]]; then
  set --
  # shellcheck disable=SC1090
  source "$HOME/.prole/env.sh"
  set -- "${ORIG_ARGS[@]}"
fi

# Load config values from prole.cfg before applying defaults/CLI overrides.
# shellcheck disable=SC1090
source "$SCRIPT_DIR/prole_cfg.sh"

if [[ "${1:-}" == "--mode" || "${1:-}" == "-m" ]]; then
  prole_set_mode "${2:-}"
  shift 2
elif [[ "${1:-}" == --mode=* || "${1:-}" == -m=* ]]; then
  prole_set_mode "${1#*=}"
  shift
fi

ACTION=${1:-test}

NAMESPACE=${NAMESPACE:-default}
SERVICE_NAMESPACE=${SERVICE_NAMESPACE:-${NAMESPACE}}
KRB5_REALM=${KRB5_REALM:-${REALM:-}}
KRB5_KDC=${KRB5_KDC:-}
KRB5_USER=${KRB5_USER:-${KRB5_USERNAME:-}}
KRB5_PASSWORD=${KRB5_PASSWORD:-}
PROLE_KDC_NAME=${PROLE_KDC_NAME:-auth}
PROLE_KDC_SERVICE=${PROLE_KDC_SERVICE:-auth}
SAMBA_ADMIN_USER=${SAMBA_ADMIN_USER:-}
SAMBA_ADMIN_PASSWORD=${SAMBA_ADMIN_PASSWORD:-}
SAMBA_DNS_SERVER=${SAMBA_DNS_SERVER:-}
KDC_POD_READY_TIMEOUT=${KDC_POD_READY_TIMEOUT:-60}
KDC_POD_READY_RETRIES=${KDC_POD_READY_RETRIES:-5}

ensure_tools() {
  for t in kubectl curl jq; do
    command -v "$t" >/dev/null || { echo "Missing required tool: $t" >&2; exit 1; }
  done
}

ensure_namespace() {
  if ! kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
    echo "Creating namespace '$NAMESPACE' ..."
    kubectl create namespace "$NAMESPACE" >/dev/null 2>&1 || true
  fi
}

get_ready_kdc_pod() {
  local kdc_ns="$1"
  kubectl -n "$kdc_ns" wait --for=condition=Ready pod -l "app=${PROLE_KDC_NAME}" --timeout="${KDC_POD_READY_TIMEOUT}s" >/dev/null 2>&1 || true
  kubectl -n "$kdc_ns" get pod -l "app=${PROLE_KDC_NAME}" --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true
}

wait_for_kdc_pod() {
  local kdc_ns="$1"
  local attempt pod
  attempt=1
  while [[ $attempt -le $KDC_POD_READY_RETRIES ]]; do
    pod=$(get_ready_kdc_pod "$kdc_ns")
    if [[ -n "$pod" ]]; then
      printf '%s' "$pod"
      return 0
    fi
    echo "Waiting for KDC pod '${PROLE_KDC_NAME}' to be ready... (${attempt}/${KDC_POD_READY_RETRIES})"
    sleep 2
    attempt=$((attempt + 1))
  done
  return 1
}

kdc_exec() {
  local kdc_ns="$1"
  local pod_name="$2"
  shift 2
  local output=""
  if output=$(kubectl -n "$kdc_ns" exec "$pod_name" -- "$@" 2>&1); then
    printf '%s' "$output"
    return 0
  fi
  if echo "$output" | grep -qi "completed pod"; then
    return 2
  fi
  if echo "$output" | grep -qi "not found"; then
    return 2
  fi
  echo "$output" >&2
  return 1
}

run_samba_join() {
  local kdc_ns="$1"
  local pod_name="$2"
  local domain="$3"
  local output=""
  if output=$(kubectl -n "$kdc_ns" exec "$pod_name" -- \
    env SAMBA_ADMIN_USER="$SAMBA_ADMIN_USER" SAMBA_ADMIN_PASSWORD="$SAMBA_ADMIN_PASSWORD" \
    SAMBA_DNS_SERVER="$SAMBA_DNS_SERVER" SAMBA_REALM="${KRB5_REALM:-}" \
    /bin/sh -c 'realm_flag=""; [ -n "${SAMBA_REALM}" ] && realm_flag="--realm=${SAMBA_REALM}"; samba-tool domain join "'"$domain"'" MEMBER -U"${SAMBA_ADMIN_USER}%${SAMBA_ADMIN_PASSWORD}" --server="${SAMBA_DNS_SERVER}" ${realm_flag}' 2>&1); then
    printf '%s' "$output"
    return 0
  fi
  if echo "$output" | grep -qi "completed pod"; then
    return 2
  fi
  if echo "$output" | grep -qi "not found"; then
    return 2
  fi
  if [[ -n "$output" ]]; then
    echo "$output" >&2
  else
    echo "samba-tool produced no output." >&2
  fi
  return 1
}

run_kinit() {
  local kdc_ns="$1"
  local pod_name="$2"
  local output=""

  # Prefer /etc/krb5.conf if it exists, otherwise fallback to /opt/prole-kdc/krb5.conf
  local krb5_config="/etc/krb5.conf"
  if ! kubectl -n "$kdc_ns" exec "$pod_name" -- ls /etc/krb5.conf >/dev/null 2>&1; then
    krb5_config="/opt/prole-kdc/krb5.conf"
  fi

  echo "Running kinit for ${KRB5_USER}@${KRB5_REALM} inside ${PROLE_KDC_NAME} (${pod_name}) using ${krb5_config} ..."
  if output=$(printf '%s\n' "$KRB5_PASSWORD" | kubectl -n "$kdc_ns" exec -i "$pod_name" -- \
      env KRB5_CONFIG="$krb5_config" kinit "${KRB5_USER}@${KRB5_REALM}" 2>&1); then
    printf '%s' "$output"
    return 0
  fi
  if echo "$output" | grep -qi "completed pod"; then
    return 2
  fi
  if echo "$output" | grep -qi "not found"; then
    return 2
  fi
  if [[ -n "$output" ]]; then
    echo "$output" >&2
  else
    echo "kinit produced no output." >&2
  fi
  return 1
}

check_samba_connectivity() {
  local kdc_ns="$1"
  local pod_name="$2"
  if [[ -z "$SAMBA_DNS_SERVER" ]]; then
    return 0
  fi

  echo "Checking connectivity from ${PROLE_KDC_NAME} to ${SAMBA_DNS_SERVER} ..."
  local ports="88 389 445 464"
  local port
  for port in $ports; do
    local out=""
    out=$(kubectl -n "$kdc_ns" exec "$pod_name" -- /bin/sh -c "timeout 3 bash -c '</dev/tcp/${SAMBA_DNS_SERVER}/${port}'" 2>&1) || true
    if [[ -z "$out" ]]; then
      echo "OK: ${SAMBA_DNS_SERVER}:${port}"
    else
      echo "WARN: ${SAMBA_DNS_SERVER}:${port} unreachable: ${out}"
    fi
  done
}

openbao_url() {
  if [[ -n "${PROLE_OPENBAO_URL:-}" ]]; then
    echo "$PROLE_OPENBAO_URL"
  elif curl -sS "http://127.0.0.1:18200/v1/sys/health" >/dev/null 2>&1; then
    echo "http://127.0.0.1:18200"
  else
    echo "http://openbao.${NAMESPACE}.svc.cluster.local:8200"
  fi
}

openbao_token() {
  if [[ -f "$PROLE_SERVICE/secrets/openbao-root-token" ]]; then
    cat "$PROLE_SERVICE/secrets/openbao-root-token"
  else
    echo "${OPENBAO_ROOT_TOKEN:-}"
  fi
}

fetch_openbao_secret() {
  local path="$1"
  local key="$2"
  local token url
  token=$(openbao_token)
  url=$(openbao_url)
  if [[ -z "$token" ]]; then
    echo ""
    return 0
  fi
  curl -sS -H "X-Vault-Token: $token" "$url/v1/kv/data/$path" | jq -r ".data.data.\"$key\"" || echo ""
}

resolve_krb5_password() {
  if [[ -z "${KRB5_PASSWORD}" || "${KRB5_PASSWORD}" == '${OPENBAO:'* || "${KRB5_PASSWORD}" == '${PROLE_SECRET:'* ]]; then
    local path="prole/${NAMESPACE:-default}/kerberos"
    local fetched
    fetched=$(fetch_openbao_secret "$path" "password")
    if [[ -n "$fetched" && "$fetched" != "null" ]]; then
      KRB5_PASSWORD="$fetched"
    fi
  fi
}

resolve_samba_vars() {
  if [[ -n "${SAMBA_ADMIN_USER}" && -n "${SAMBA_ADMIN_PASSWORD}" && -n "${SAMBA_DNS_SERVER}" ]]; then
    return 0
  fi

  # 1. Fallback for DNS server from prole.cfg env (AD_DC_HOST)
  if [[ -z "$SAMBA_DNS_SERVER" && -n "${AD_DC_HOST:-}" ]]; then
    SAMBA_DNS_SERVER="$AD_DC_HOST"
    echo "Using SAMBA_DNS_SERVER=${SAMBA_DNS_SERVER} from AD_DC_HOST"
  fi

  # 2. Try to resolve from Ansible inventory if possible
  local root
  if [[ -n "${PROLE_HOME:-}" && -d "${PROLE_HOME}" ]]; then
    root="${PROLE_HOME}"
  else
    root="${SCRIPT_DIR}/.."
  fi

  local vars_file="${root}/infrastructure/inventory/group_vars/ad_dc/vars.yml"
  if [[ -f "$vars_file" ]]; then
    if [[ -z "$SAMBA_DNS_SERVER" ]]; then
      SAMBA_DNS_SERVER=$(awk -F: '/^[[:space:]]*samba_dns_server[[:space:]]*:/ {sub(/^[^:]+:[[:space:]]*/, "", $0); gsub(/"/, "", $0); print $0; exit}' "$vars_file")
    fi
    if [[ -z "$SAMBA_ADMIN_USER" ]]; then
      SAMBA_ADMIN_USER=$(awk -F: '/^[[:space:]]*samba_dns_admin_user[[:space:]]*:/ {sub(/^[^:]+:[[:space:]]*/, "", $0); gsub(/"/, "", $0); print $0; exit}' "$vars_file")
    fi
  fi

  # 3. Fallback for Admin User
  if [[ -z "$SAMBA_ADMIN_USER" ]]; then
    if [[ -n "${AD_DC_USER:-}" ]]; then
      SAMBA_ADMIN_USER="$AD_DC_USER"
      echo "Using SAMBA_ADMIN_USER=${SAMBA_ADMIN_USER} from AD_DC_USER"
    else
      SAMBA_ADMIN_USER="administrator"
      echo "Defaulting SAMBA_ADMIN_USER to administrator"
    fi
  fi

  # 4. Try to resolve password from Ansible Vault
  if [[ -z "$SAMBA_ADMIN_PASSWORD" ]]; then
    local vault_file="${root}/infrastructure/inventory/group_vars/ad_dc/vault.yml"
    local vault_pass_file=""
    if [[ -n "${ANSIBLE_VAULT_PASSWORD_FILE:-}" && -f "${ANSIBLE_VAULT_PASSWORD_FILE}" ]]; then
      vault_pass_file="${ANSIBLE_VAULT_PASSWORD_FILE}"
    elif [[ -n "${PROLE_HOME:-}" && -f "${PROLE_HOME}/.vault_pass" ]]; then
      vault_pass_file="${PROLE_HOME}/.vault_pass"
    elif [[ -f "${root}/.vault_pass" ]]; then
      vault_pass_file="${root}/.vault_pass"
    fi

    if [[ -f "$vault_file" && -n "$vault_pass_file" && -x "$(command -v ansible-vault)" ]]; then
      local vault_out
      vault_out=$(ansible-vault view "$vault_file" --vault-password-file "$vault_pass_file" 2>/dev/null || true)
      if [[ -n "$vault_out" ]]; then
        SAMBA_ADMIN_PASSWORD=$(printf '%s\n' "$vault_out" | awk -F: '/^[[:space:]]*vault_samba_dns_admin_pass[[:space:]]*:/ {sub(/^[^:]+:[[:space:]]*/, "", $0); gsub(/"/, "", $0); print $0; exit}')
      fi
    fi
  fi

  # 5. Fallback for Password from OpenBao
  if [[ -z "$SAMBA_ADMIN_PASSWORD" ]]; then
    local path="prole/${NAMESPACE:-default}/ad_dc"
    local fetched
    fetched=$(fetch_openbao_secret "$path" "password")
    if [[ -n "$fetched" && "$fetched" != "null" ]]; then
      SAMBA_ADMIN_PASSWORD="$fetched"
      echo "Fetched SAMBA_ADMIN_PASSWORD from OpenBao (${path})"
    else
        # Try kerberos path as fallback
        path="prole/${NAMESPACE:-default}/kerberos"
        fetched=$(fetch_openbao_secret "$path" "samba_password")
        if [[ -n "$fetched" && "$fetched" != "null" ]]; then
          SAMBA_ADMIN_PASSWORD="$fetched"
          echo "Fetched SAMBA_ADMIN_PASSWORD from OpenBao (${path}#samba_password)"
        fi
    fi
  fi
}

join_samba_realm_if_needed() {
  local kdc_ns="$1"
  local pod_name="$2"
  local domain=""

  resolve_samba_vars

  if [[ -z "$SAMBA_ADMIN_USER" || -z "$SAMBA_ADMIN_PASSWORD" || -z "$SAMBA_DNS_SERVER" ]]; then
    echo "WARN: Missing Samba join info; skipping samba-tool realm join."
    return 0
  fi

  check_samba_connectivity "$kdc_ns" "$pod_name"

  if [[ -n "$KRB5_REALM" ]]; then
    domain=$(printf '%s' "$KRB5_REALM" | tr '[:upper:]' '[:lower:]')
  fi
  if [[ -z "$domain" ]]; then
    domain="$SAMBA_DNS_SERVER"
  fi

  if kubectl -n "$kdc_ns" exec "$pod_name" -- test -f /var/lib/samba/private/secrets.tdb >/dev/null 2>&1; then
    echo "Samba already joined; skipping join."
    return 0
  fi

  echo "Joining Samba realm '${domain}' (server ${SAMBA_DNS_SERVER}) ..."
  local attempt=1
  while true; do
    if run_samba_join "$kdc_ns" "$pod_name" "$domain"; then
      return 0
    fi
    if [[ $? -eq 2 ]]; then
      if [[ $attempt -ge $KDC_POD_READY_RETRIES ]]; then
        echo "WARN: KDC pod completed before join could run; skipping samba-tool join." >&2
        return 0
      fi
      pod_name=$(wait_for_kdc_pod "$kdc_ns" || true)
      if [[ -z "$pod_name" ]]; then
        echo "WARN: KDC pod unavailable for samba-tool join." >&2
        return 0
      fi
      attempt=$((attempt + 1))
      continue
    fi
    echo "WARN: samba-tool domain join failed; continuing to Kerberos test." >&2
    return 0
  done
}

run_test() {
  ensure_tools
  ensure_namespace
  resolve_krb5_password

  # Support both names for the toggle from prole.cfg
  local enabled="${KERBEROS_ENABLED:-${ENABLED:-false}}"
  if [[ "$enabled" == "false" || "$enabled" == "0" || "$enabled" == "False" ]]; then
    echo "Kerberos is disabled (KERBEROS_ENABLED=$enabled). Skipping test."
    return 0
  fi

  if [[ -z "$KRB5_REALM" || -z "$KRB5_USER" || -z "$KRB5_PASSWORD" || -z "$KRB5_KDC" ]]; then
    echo "ERROR: Missing Kerberos configuration. Ensure KRB5_REALM, KRB5_KDC, KRB5_USER, KRB5_PASSWORD are set." >&2
    exit 1
  fi

  if [[ -x "$SCRIPT_DIR/init_kdc.sh" ]]; then
    SERVICE_NAMESPACE="$SERVICE_NAMESPACE" KRB5_REALM="$KRB5_REALM" KRB5_KDC="$KRB5_KDC" \
      KRB5_ADMIN="$KRB5_KDC" KRB5_USER="$KRB5_USER" KRB5_PASSWORD="$KRB5_PASSWORD" \
      "$SCRIPT_DIR/init_kdc.sh" update || true
  fi

  local kdc_ns pod_name
  kdc_ns="${SERVICE_NAMESPACE:-${NAMESPACE:-default}}"
  pod_name=$(wait_for_kdc_pod "$kdc_ns" || true)
  if [[ -z "$pod_name" ]]; then
    echo "ERROR: KDC pod '${PROLE_KDC_NAME}' not found in namespace '$kdc_ns'. Run init_kdc.sh update first." >&2
    exit 1
  fi

  join_samba_realm_if_needed "$kdc_ns" "$pod_name"

  echo "Running kinit for ${KRB5_USER}@${KRB5_REALM} inside ${PROLE_KDC_NAME} (${pod_name}) ..."
  local attempt=1
  while true; do
    if run_kinit "$kdc_ns" "$pod_name"; then
      break
    fi
    if [[ $? -eq 2 ]] || kubectl -n "$kdc_ns" get pod "$pod_name" -o jsonpath='{.status.phase}' 2>/dev/null | grep -qi "Succeeded"; then
      if [[ $attempt -ge $KDC_POD_READY_RETRIES ]]; then
        echo "ERROR: KDC pod completed before kinit could run." >&2
        exit 1
      fi
      pod_name=$(wait_for_kdc_pod "$kdc_ns" || true)
      if [[ -z "$pod_name" ]]; then
        echo "ERROR: KDC pod unavailable for kinit." >&2
        exit 1
      fi
      attempt=$((attempt + 1))
      continue
    fi
    echo "ERROR: kinit failed for ${KRB5_USER}@${KRB5_REALM}." >&2
    exit 1
  done

  echo "Kerberos ticket cache:"
  kubectl -n "$kdc_ns" exec "$pod_name" -- env KRB5_CONFIG=/opt/prole-kdc/krb5.conf klist || true
}

case "$ACTION" in
  test)
    run_test
    ;;
  cleanup)
    echo "No test pods to cleanup (KDC-based test)."
    ;;
  *)
    echo "Usage: $0 {test|cleanup}" >&2
    exit 2
    ;;
esac