80 lines
3.1 KiB
YAML
80 lines
3.1 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "10"
|
|
name: create-sso-auth-provider
|
|
namespace: stackrox
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest
|
|
env:
|
|
- name: CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sso-secret
|
|
key: client-secret
|
|
- name: PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: central-htpasswd
|
|
key: password
|
|
- name: ISSUER
|
|
value: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift
|
|
- name: DEFAULT_ROLE
|
|
value: Admin
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
#!/usr/bin/env bash
|
|
|
|
# Wait for central to be ready
|
|
attempt_counter=0
|
|
max_attempts=20
|
|
echo "Waiting for central to be available..."
|
|
until $(curl -k --output /dev/null --silent --head --fail https://central); do
|
|
if [ ${attempt_counter} -eq ${max_attempts} ];then
|
|
echo "Max attempts reached"
|
|
exit 1
|
|
fi
|
|
printf '.'
|
|
attempt_counter=$(($attempt_counter+1))
|
|
echo "Made attempt $attempt_counter, waiting..."
|
|
sleep 5
|
|
done
|
|
|
|
echo "Configuring SSO Provider"
|
|
|
|
echo "Test if SSO Provider already exists"
|
|
|
|
response=$(curl -k -u "admin:$PASSWORD" https://central/v1/authProviders?name=OpenShift | python3 -c "import sys, json; print(json.load(sys.stdin)['authProviders'], end = '')")
|
|
|
|
if [[ "$response" != "[]" ]] ; then
|
|
echo "OpenShift Provider already exists, exiting"
|
|
exit 0
|
|
fi
|
|
|
|
export DATA='{"name":"OpenShift","type":"oidc","uiEndpoint":"central-stackrox.apps.home.ocplab.com","enabled":true,"config":{"client_id":"stackrox","client_secret":"'${CLIENT_SECRET}'","issuer":"'$ISSUER'","mode":"post"},"validated":true,"extraUiEndpoints":[],"active":true}'
|
|
|
|
echo "Posting data: ${DATA}"
|
|
|
|
authid=$(curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/authProviders | python3 -c "import sys, json; print(json.load(sys.stdin)['id'], end = '')")
|
|
|
|
echo "Authentication Provider created with id ${authid}"
|
|
echo "Updating minimum role to Admin"
|
|
|
|
export DATA='{"previous_groups":[],"required_groups":[{"props":{"authProviderId":"'${authid}'"},"roleName":"'${DEFAULT_ROLE}'"}]}'
|
|
|
|
curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/groupsbatch
|
|
|
|
imagePullPolicy: Always
|
|
name: create-sso-auth-provider
|
|
dnsPolicy: ClusterFirst
|
|
restartPolicy: Never
|
|
serviceAccount: create-cluster-init
|
|
serviceAccountName: create-cluster-init
|
|
terminationGracePeriodSeconds: 30
|