donghyeon.kang/platform-core
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Files
main
platform-core/scripts/bootstrap/apply-gitea-oidc.sh
T

674 lines
24 KiB
Bash
Executable File
Raw Permalink Blame History

#!/usr/bin/env bash
set -Eeuo pipefail
# Do not inherit xtrace: redirect headers contain an OIDC state value.
set +x
umask 077
readonly EXPECTED_HELM_VERSION="v3.19.4"
readonly TARGET_NODE="donghyeon-system-product-name"
readonly EXPECTED_NODE_INTERNAL_IP="192.168.0.107"
readonly REPOSITORY_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
readonly GITEA_NAMESPACE="gitea"
readonly GITEA_DEPLOYMENT="gitea"
readonly GITEA_SERVICE="gitea-http"
readonly GITEA_HOST="git.learn.hyeonworks.com"
readonly GITEA_ROOT_URL="https://${GITEA_HOST}"
readonly GITEA_HEALTH_URL="${GITEA_ROOT_URL}/api/healthz"
readonly GITEA_LOGIN_URL="${GITEA_ROOT_URL}/user/login"
readonly GITEA_SIGNUP_URL="${GITEA_ROOT_URL}/user/sign_up"
readonly GITEA_OIDC_START_URL="${GITEA_ROOT_URL}/user/oauth2/keycloak"
readonly GITEA_OIDC_CALLBACK_ENCODED="https%3A%2F%2Fgit.learn.hyeonworks.com%2Fuser%2Foauth2%2Fkeycloak%2Fcallback"
readonly KEYCLOAK_HOST="id.learn.hyeonworks.com"
readonly KEYCLOAK_ISSUER="https://${KEYCLOAK_HOST}/realms/hyeonworks"
readonly KEYCLOAK_DISCOVERY_URL="${KEYCLOAK_ISSUER}/.well-known/openid-configuration"
readonly KEYCLOAK_AUTH_ENDPOINT="${KEYCLOAK_ISSUER}/protocol/openid-connect/auth"
readonly OIDC_SECRET_NAME="gitea-keycloak-oidc"
readonly -a VERIFIED_MANIFEST_NAMES=(
namespaces
ssd-local-pv
cnpg-operator
platform-postgres
gitea
gitea-oidc
)
render_temp_dir=""
runtime_temp_dir=""
gitea_manifest_sha256="not-rendered"
apply_started=0
fail() {
printf 'ERROR: %s\n' "$*" >&2
exit 1
}
usage() {
cat <<'USAGE'
Usage: bash scripts/bootstrap/apply-gitea-oidc.sh --execute
Keycloak 공개 discovery, Gitea OIDC Secret 계약, 현재 Gitea 상태를 먼저
검사합니다. 고정된 Chart SHA를 검증하는 render-phase1.sh의 0600 handoff에서
gitea-oidc.yaml 하나만 적용한 뒤 OIDC, 외부 인증 전용 가입 정책, 브랜딩을 확인합니다.
실패해도 Kubernetes 리소스를 삭제하거나 이전 버전으로 롤백하지 않습니다.
Secret 값, 토큰, OIDC state가 포함된 전체 Location은 출력하지 않습니다.
USAGE
}
cleanup() {
local cleanup_rc=$?
trap - EXIT
set +e
if (( cleanup_rc != 0 )); then
if (( apply_started == 1 )); then
printf '\nRETAINED STATE: Gitea apply가 시작된 뒤 검증에 실패했습니다.\n' >&2
printf '자동 삭제와 롤백은 수행하지 않았으며 현재 클러스터 상태를 보존했습니다.\n' >&2
printf '적용 대상으로 고정했던 gitea-oidc.yaml SHA-256: %s\n' \
"$gitea_manifest_sha256" >&2
printf '확인: kubectl --namespace gitea get deployment,pod,service,endpointslice,ingress\n' >&2
else
printf '\nNO MUTATION: 사전 검사 또는 렌더링 단계에서 중단되어 Gitea를 적용하지 않았습니다.\n' >&2
fi
fi
if [[ -n "$render_temp_dir" ]]; then
case "$render_temp_dir" in
/tmp/platform-phase1-apply.*)
rm -rf -- "$render_temp_dir"
;;
*)
printf 'WARNING: refusing to remove unexpected render path: %s\n' \
"$render_temp_dir" >&2
;;
esac
fi
if [[ -n "$runtime_temp_dir" ]]; then
case "$runtime_temp_dir" in
/tmp/gitea-oidc-apply.*)
rm -rf -- "$runtime_temp_dir"
;;
*)
printf 'WARNING: refusing to remove unexpected runtime path: %s\n' \
"$runtime_temp_dir" >&2
;;
esac
fi
exit "$cleanup_rc"
}
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM
[[ "${1:-}" == "--execute" && "$#" -eq 1 ]] || {
usage
exit 2
}
[[ -t 0 ]] || fail "an interactive terminal is required"
[[ "$(pwd -P)" == "$REPOSITORY_ROOT" ]] || \
fail "run from ${REPOSITORY_ROOT}"
for command_name in \
kubectl curl jq rg sha256sum stat find wc tr sort mktemp chmod mkdir rm awk; do
command -v "$command_name" >/dev/null 2>&1 || \
fail "${command_name} is required"
done
if [[ -n "${PLATFORM_HELM_BIN:-}" ]]; then
[[ "$PLATFORM_HELM_BIN" == /* ]] || \
fail "PLATFORM_HELM_BIN must be an absolute path"
[[ -f "$PLATFORM_HELM_BIN" && -x "$PLATFORM_HELM_BIN" ]] || \
fail "PLATFORM_HELM_BIN is not executable: ${PLATFORM_HELM_BIN}"
readonly HELM_BIN="$PLATFORM_HELM_BIN"
else
HELM_BIN="$(command -v helm 2>/dev/null)" || \
fail "Helm ${EXPECTED_HELM_VERSION} is required"
readonly HELM_BIN
fi
[[ "$("$HELM_BIN" version --template '{{.Version}}')" == "$EXPECTED_HELM_VERSION" ]] || \
fail "Helm must be exactly ${EXPECTED_HELM_VERSION}"
readonly CURRENT_CONTEXT="$(kubectl config current-context)"
readonly API_SERVER="$(
kubectl config view --minify --output=jsonpath='{.clusters[0].cluster.server}'
)"
[[ -n "$CURRENT_CONTEXT" ]] || fail "kubectl current-context is empty"
[[ -n "$API_SERVER" ]] || fail "the selected Kubernetes API server is empty"
https_get() {
local host="$1"
local url="$2"
local output_file="$3"
curl \
--disable \
--silent \
--show-error \
--fail-with-body \
--noproxy '*' \
--resolve "${host}:443:127.0.0.1" \
--connect-timeout 3 \
--max-time 20 \
--header 'Cache-Control: no-cache' \
--output "$output_file" \
"$url"
}
check_target_node() {
local internal_ip
local ready_status
kubectl get node "$TARGET_NODE" >/dev/null 2>&1 || \
fail "target node is missing: ${TARGET_NODE}"
ready_status="$(
kubectl get node "$TARGET_NODE" \
--output=jsonpath='{.status.conditions[?(@.type=="Ready")].status}'
)"
[[ "$ready_status" == "True" ]] || \
fail "target node is not Ready: ${TARGET_NODE}"
internal_ip="$(
kubectl get node "$TARGET_NODE" \
--output=jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}'
)"
[[ "$internal_ip" == "$EXPECTED_NODE_INTERNAL_IP" ]] || \
fail "target node InternalIP is ${internal_ip:-missing}, expected ${EXPECTED_NODE_INTERNAL_IP}"
}
check_oidc_secret_contract() {
local secret_type
local secret_keys
# These output expressions inspect only the Secret type and data key names.
# They never select, decode, compare, or print either data value.
secret_type="$(
kubectl --namespace "$GITEA_NAMESPACE" get secret "$OIDC_SECRET_NAME" \
--output=jsonpath='{.type}'
)"
secret_keys="$(
kubectl --namespace "$GITEA_NAMESPACE" get secret "$OIDC_SECRET_NAME" \
--output=go-template='{{range $key, $_ := .data}}{{$key}}{{"\n"}}{{end}}' \
| LC_ALL=C sort
)"
[[ "$secret_type" == "Opaque" ]] || \
fail "${GITEA_NAMESPACE}/${OIDC_SECRET_NAME} type must be Opaque"
[[ "$secret_keys" == $'key\nsecret' ]] || \
fail "${GITEA_NAMESPACE}/${OIDC_SECRET_NAME} must contain exactly key and secret"
}
check_public_discovery() {
local discovery_file="$1"
https_get "$KEYCLOAK_HOST" "$KEYCLOAK_DISCOVERY_URL" "$discovery_file"
jq --exit-status \
--arg issuer "$KEYCLOAK_ISSUER" \
--arg authorization_endpoint "$KEYCLOAK_AUTH_ENDPOINT" \
'type == "object" and
.issuer == $issuer and
.authorization_endpoint == $authorization_endpoint and
(.token_endpoint | type == "string" and startswith($issuer + "/"))' \
"$discovery_file" >/dev/null 2>&1 || \
fail "local-SNI Keycloak discovery is not the expected JSON issuer"
}
check_gitea_health() {
local health_file="$1"
kubectl --namespace "$GITEA_NAMESPACE" wait \
--for=condition=Available "deployment/${GITEA_DEPLOYMENT}" \
--timeout=30s >/dev/null
kubectl --namespace "$GITEA_NAMESPACE" wait \
--for=jsonpath='{.endpoints[0].conditions.ready}'=true \
endpointslice \
--selector="kubernetes.io/service-name=${GITEA_SERVICE}" \
--timeout=30s >/dev/null
https_get "$GITEA_HOST" "$GITEA_HEALTH_URL" "$health_file"
jq --exit-status '.status == "pass"' "$health_file" >/dev/null || \
fail "Gitea public health response is not status=pass JSON"
}
verify_rendered_manifest_unchanged() {
local manifest_path="${render_temp_dir}/gitea-oidc.yaml"
local checksum_output
local actual_sha256
[[ -f "$manifest_path" && ! -L "$manifest_path" && -O "$manifest_path" && -s "$manifest_path" ]] || \
fail "verified Gitea manifest is missing or unsafe"
[[ "$(stat --format='%a' -- "$manifest_path")" == "600" ]] || \
fail "verified Gitea manifest must have mode 0600"
checksum_output="$(sha256sum -- "$manifest_path")"
actual_sha256="${checksum_output%% *}"
[[ "$actual_sha256" == "$gitea_manifest_sha256" ]] || \
fail "verified gitea-oidc.yaml changed after confirmation"
}
check_auth_source() {
local auth_list_file="$1"
local auth_error_file="$2"
local keycloak_count
local active_oauth2_count
if ! kubectl --namespace "$GITEA_NAMESPACE" exec \
"deployment/${GITEA_DEPLOYMENT}" \
--container gitea \
-- gitea admin auth list \
--vertical-bars \
--min-width 1 \
--tab-width 1 \
--padding 0 \
--pad-char ' ' \
>"$auth_list_file" 2>"$auth_error_file"; then
fail "gitea admin auth list failed; its output was retained only in the private temp directory"
fi
read -r keycloak_count active_oauth2_count < <(
awk -F '|' '
function trim(value) {
gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
return value
}
NF == 4 {
name = trim($2)
type = trim($3)
enabled = trim($4)
if (name == "keycloak") {
keycloak_count++
if (type == "OAuth2" && enabled == "true") {
active_oauth2_count++
}
}
}
END {
print keycloak_count + 0, active_oauth2_count + 0
}
' "$auth_list_file"
)
[[ "$keycloak_count" == "1" && "$active_oauth2_count" == "1" ]] || \
fail "exactly one active OAuth2 auth source named keycloak was not found"
}
check_app_ini_policy() {
local app_ini_error_file="$1"
if ! kubectl --namespace "$GITEA_NAMESPACE" exec \
"deployment/${GITEA_DEPLOYMENT}" \
--container gitea \
-- awk '
function trim(value) {
gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
return value
}
/^[[:space:]]*\[/ {
section = $0
gsub(/^[[:space:]]*\[|\][[:space:]]*$/, "", section)
section = tolower(section)
next
}
/^[[:space:]]*[#;]/ || /^[[:space:]]*$/ {
next
}
{
split($0, pair, "=")
key = toupper(trim(pair[1]))
value = $0
sub(/^[^=]*=/, "", value)
value = trim(value)
if (section == "service" && key == "DISABLE_REGISTRATION" && tolower(value) == "false") disabled++
if (section == "service" && key == "ALLOW_ONLY_EXTERNAL_REGISTRATION" && tolower(value) == "true") external_only++
if (section == "service" && key == "SHOW_REGISTRATION_BUTTON" && tolower(value) == "false") button_hidden++
if (section == "service" && key == "ENABLE_PASSWORD_SIGNIN_FORM" && tolower(value) == "true") password_signin++
if (section == "oauth2_client" && key == "ENABLE_AUTO_REGISTRATION" && tolower(value) == "true") oidc_jit++
if (section == "oauth2_client" && key == "USERNAME" && value == "preferred_username") username_claim++
if (section == "oauth2_client" && key == "ACCOUNT_LINKING" && value == "login") account_linking++
if (section == "oauth2_client" && key == "OPENID_CONNECT_SCOPES" && value == "profile email") oidc_scopes++
}
END {
exit !(disabled == 1 &&
external_only == 1 &&
button_hidden == 1 &&
password_signin == 1 &&
oidc_jit == 1 &&
username_claim == 1 &&
account_linking == 1 &&
oidc_scopes == 1)
}
' /data/gitea/conf/app.ini >/dev/null 2>"$app_ini_error_file"; then
fail "live app.ini does not satisfy the external-registration-only OIDC policy"
fi
}
check_login_html() {
local login_html_file="$1"
local signup_html_file="$2"
local signup_headers_file="$3"
local signup_status
local header_line
local field_name
local signup_location=""
local signup_location_count=0
https_get "$GITEA_HOST" "$GITEA_LOGIN_URL" "$login_html_file"
rg --quiet --fixed-strings 'href="/user/oauth2/keycloak"' "$login_html_file" || \
fail "Gitea login HTML does not contain the Keycloak OIDC link"
rg --quiet --fixed-strings 'href="/assets/css/hyeonworks.css"' "$login_html_file" || \
fail "Gitea login HTML does not contain the Hyeonworks stylesheet"
rg --quiet --fixed-strings 'name="theme-color" content="#0f172a"' "$login_html_file" || \
fail "Gitea login HTML does not contain the Hyeonworks theme marker"
rg --quiet --fixed-strings 'hw-brand-link' "$login_html_file" || \
fail "Gitea login HTML does not contain the Hyeonworks navigation marker"
if rg --quiet --fixed-strings 'href="/user/sign_up"' "$login_html_file"; then
fail "Gitea login HTML still exposes a local sign-up link"
fi
if ! signup_status="$(
curl \
--disable \
--silent \
--show-error \
--noproxy '*' \
--resolve "${GITEA_HOST}:443:127.0.0.1" \
--connect-timeout 3 \
--max-time 20 \
--header 'Cache-Control: no-cache' \
--output "$signup_html_file" \
--dump-header "$signup_headers_file" \
--write-out '%{http_code}' \
"$GITEA_SIGNUP_URL"
)"; then
fail "Gitea sign-up endpoint transport check failed"
fi
case "$signup_status" in
200)
for field_name in user_name email password retype; do
if rg --quiet --fixed-strings "name=\"${field_name}\"" "$signup_html_file"; then
fail "Gitea sign-up HTML still exposes a local registration input"
fi
done
;;
404)
;;
301|302|303|307|308)
while IFS= read -r header_line; do
header_line="${header_line%$'\r'}"
case "$header_line" in
[Ll][Oo][Cc][Aa][Tt][Ii][Oo][Nn]:*)
signup_location="${header_line#*:}"
signup_location="${signup_location#"${signup_location%%[![:space:]]*}"}"
((signup_location_count += 1))
;;
esac
done <"$signup_headers_file"
[[ "$signup_location_count" == "1" ]] || \
fail "Gitea sign-up redirect must contain exactly one Location header"
case "$signup_location" in
/user/login|"${GITEA_ROOT_URL}/user/login")
;;
*)
fail "Gitea sign-up redirect does not target the same-origin login page"
;;
esac
;;
*)
fail "Gitea sign-up endpoint returned an unexpected HTTP status: ${signup_status}"
;;
esac
}
check_oidc_redirect() {
local headers_file="$1"
local status
local header_line
local location=""
local location_count=0
local query
local parameter
local parameter_name
local parameter_value
local -a query_parameters=()
local client_id_count=0
local response_type_count=0
local redirect_uri_count=0
local state_count=0
status="$(
curl \
--disable \
--silent \
--show-error \
--noproxy '*' \
--resolve "${GITEA_HOST}:443:127.0.0.1" \
--connect-timeout 3 \
--max-time 20 \
--output /dev/null \
--dump-header "$headers_file" \
--write-out '%{http_code}' \
"$GITEA_OIDC_START_URL"
)"
case "$status" in
302|303|307)
;;
*)
fail "Gitea OIDC start returned HTTP ${status}, expected 302, 303, or 307"
;;
esac
while IFS= read -r header_line; do
header_line="${header_line%$'\r'}"
case "$header_line" in
[Ll][Oo][Cc][Aa][Tt][Ii][Oo][Nn]:*)
location="${header_line#*:}"
location="${location#"${location%%[![:space:]]*}"}"
((location_count += 1))
;;
esac
done <"$headers_file"
[[ "$location_count" == "1" && -n "$location" ]] || \
fail "Gitea OIDC start did not return exactly one non-empty Location header"
[[ "$location" != *'#'* ]] || \
fail "Gitea OIDC Location unexpectedly contains a fragment"
case "$location" in
"${KEYCLOAK_AUTH_ENDPOINT}"\?*)
;;
*)
fail "Gitea OIDC Location does not target the expected Keycloak authorization endpoint"
;;
esac
query="${location#*\?}"
IFS='&' read -r -a query_parameters <<<"$query"
for parameter in "${query_parameters[@]}"; do
[[ "$parameter" == *=* ]] || continue
parameter_name="${parameter%%=*}"
parameter_value="${parameter#*=}"
case "$parameter_name" in
client_id)
((client_id_count += 1))
[[ "$parameter_value" == "gitea" ]] || \
fail "OIDC Location client_id is not gitea"
;;
response_type)
((response_type_count += 1))
[[ "$parameter_value" == "code" ]] || \
fail "OIDC Location response_type is not code"
;;
redirect_uri)
((redirect_uri_count += 1))
[[ "$parameter_value" == "$GITEA_OIDC_CALLBACK_ENCODED" ]] || \
fail "OIDC Location callback is not the exact public Gitea callback"
;;
state)
((state_count += 1))
[[ -n "$parameter_value" ]] || fail "OIDC Location state is empty"
;;
esac
done
[[ "$client_id_count" == "1" ]] || fail "OIDC Location must contain one client_id"
[[ "$response_type_count" == "1" ]] || fail "OIDC Location must contain one response_type"
[[ "$redirect_uri_count" == "1" ]] || fail "OIDC Location must contain one redirect_uri"
[[ "$state_count" == "1" ]] || fail "OIDC Location must contain one non-empty state"
# Deliberately do not print $location or any parsed state value.
}
check_branding_hashes() {
local remote_dir="$1"
local index
local source_path
local remote_path
local checksum_output
local local_sha256
local remote_sha256
local -a source_paths=(
"${REPOSITORY_ROOT}/services/gitea/branding/public/assets/css/hyeonworks.css"
"${REPOSITORY_ROOT}/services/gitea/branding/public/assets/img/logo.svg"
"${REPOSITORY_ROOT}/services/gitea/branding/public/assets/img/favicon.svg"
)
local -a public_paths=(
"/assets/css/hyeonworks.css"
"/assets/img/logo.svg"
"/assets/img/favicon.svg"
)
local -a labels=(
"hyeonworks.css"
"logo.svg"
"favicon.svg"
)
for index in "${!source_paths[@]}"; do
source_path="${source_paths[$index]}"
remote_path="${remote_dir}/${labels[$index]}"
[[ -f "$source_path" && ! -L "$source_path" ]] || \
fail "branding source is missing or symlinked: ${source_path}"
https_get \
"$GITEA_HOST" \
"${GITEA_ROOT_URL}${public_paths[$index]}" \
"$remote_path"
checksum_output="$(sha256sum -- "$source_path")"
local_sha256="${checksum_output%% *}"
checksum_output="$(sha256sum -- "$remote_path")"
remote_sha256="${checksum_output%% *}"
[[ "$remote_sha256" == "$local_sha256" ]] || \
fail "public branding hash differs from local source: ${labels[$index]}"
printf '브랜딩 해시 일치: %-16s %s\n' \
"${labels[$index]}" "$local_sha256"
done
}
runtime_temp_dir="$(mktemp -d /tmp/gitea-oidc-apply.XXXXXX)"
chmod 0700 "$runtime_temp_dir"
render_temp_dir="$(mktemp -d /tmp/platform-phase1-apply.XXXXXX)"
chmod 0700 "$render_temp_dir"
readonly DISCOVERY_FILE="${runtime_temp_dir}/keycloak-discovery.json"
readonly HEALTH_FILE="${runtime_temp_dir}/gitea-health.json"
readonly AUTH_LIST_FILE="${runtime_temp_dir}/gitea-auth-list.txt"
readonly AUTH_ERROR_FILE="${runtime_temp_dir}/gitea-auth-list.err"
readonly APP_INI_ERROR_FILE="${runtime_temp_dir}/gitea-app-ini.err"
readonly LOGIN_HTML_FILE="${runtime_temp_dir}/gitea-login.html"
readonly SIGNUP_HTML_FILE="${runtime_temp_dir}/gitea-signup.html"
readonly SIGNUP_HEADERS_FILE="${runtime_temp_dir}/gitea-signup-headers"
readonly OIDC_HEADERS_FILE="${runtime_temp_dir}/gitea-oidc-headers"
readonly BRANDING_REMOTE_DIR="${runtime_temp_dir}/branding-remote"
mkdir -m 0700 -- "$BRANDING_REMOTE_DIR"
printf '[1/8] 현재 context, 노드, Gitea 상태 확인\n'
check_target_node
kubectl --namespace "$GITEA_NAMESPACE" get "deployment/${GITEA_DEPLOYMENT}" >/dev/null
check_gitea_health "$HEALTH_FILE"
printf '[2/8] Host Nginx 로컬 SNI 경로의 Keycloak discovery JSON 확인\n'
check_public_discovery "$DISCOVERY_FILE"
printf '[3/8] Gitea OIDC Secret의 type과 key 이름만 확인\n'
check_oidc_secret_contract
printf '[4/8] 고정 Chart SHA 검증 후 Phase 1 manifest 렌더링\n'
cd -- "$REPOSITORY_ROOT"
PLATFORM_HELM_BIN="$HELM_BIN" \
bash scripts/validate/render-phase1.sh \
--verified-output-dir "$render_temp_dir"
verified_entry_count="$(
find "$render_temp_dir" -mindepth 1 -maxdepth 1 -type f \
-name '*.yaml' | wc -l | tr -d '[:space:]'
)"
[[ "$verified_entry_count" == "${#VERIFIED_MANIFEST_NAMES[@]}" ]] || \
fail "verified handoff must contain exactly ${#VERIFIED_MANIFEST_NAMES[@]} YAML manifests"
for manifest_name in "${VERIFIED_MANIFEST_NAMES[@]}"; do
manifest_path="${render_temp_dir}/${manifest_name}.yaml"
[[ -f "$manifest_path" && ! -L "$manifest_path" && -O "$manifest_path" && -s "$manifest_path" ]] || \
fail "verified manifest is missing or unsafe: ${manifest_name}.yaml"
[[ "$(stat --format='%a' -- "$manifest_path")" == "600" ]] || \
fail "verified manifest must have mode 0600: ${manifest_name}.yaml"
done
checksum_output="$(sha256sum -- "${render_temp_dir}/gitea-oidc.yaml")"
gitea_manifest_sha256="${checksum_output%% *}"
readonly gitea_manifest_sha256
rg --quiet --fixed-strings 'gitea-keycloak-oidc' "${render_temp_dir}/gitea-oidc.yaml" || \
fail "rendered Gitea manifest does not reference the OIDC Secret"
rg --quiet --fixed-strings "$KEYCLOAK_DISCOVERY_URL" "${render_temp_dir}/gitea-oidc.yaml" || \
fail "rendered Gitea manifest does not contain the exact discovery URL"
printf '\nKubernetes context: %s\n' "$CURRENT_CONTEXT"
printf 'API server: %s\n' "$API_SERVER"
printf 'Target node: %s\n' "$TARGET_NODE"
printf 'gitea-oidc.yaml SHA-256: %s\n' "$gitea_manifest_sha256"
printf '적용 범위: 검증된 gitea-oidc.yaml 하나\n'
printf 'Type APPLY %s GITEA-OIDC %s to continue: ' \
"$CURRENT_CONTEXT" "$gitea_manifest_sha256"
read -r confirmation
[[ "$confirmation" == "APPLY ${CURRENT_CONTEXT} GITEA-OIDC ${gitea_manifest_sha256}" ]] || \
fail "cancelled"
[[ "$(kubectl config current-context)" == "$CURRENT_CONTEXT" ]] || \
fail "kubectl context changed after confirmation"
[[ "$(
kubectl config view --minify --output=jsonpath='{.clusters[0].cluster.server}'
)" == "$API_SERVER" ]] || \
fail "Kubernetes API server changed after confirmation"
check_target_node
check_public_discovery "$DISCOVERY_FILE"
check_oidc_secret_contract
check_gitea_health "$HEALTH_FILE"
verify_rendered_manifest_unchanged
printf '\n[5/8] 검증된 gitea-oidc.yaml 하나만 적용\n'
apply_started=1
kubectl apply --filename="${render_temp_dir}/gitea-oidc.yaml"
verify_rendered_manifest_unchanged
printf '[6/8] Deployment rollout과 ready EndpointSlice 대기\n'
kubectl --namespace "$GITEA_NAMESPACE" rollout status \
"deployment/${GITEA_DEPLOYMENT}" --timeout=10m
kubectl --namespace "$GITEA_NAMESPACE" wait \
--for=jsonpath='{.endpoints[0].conditions.ready}'=true \
endpointslice \
--selector="kubernetes.io/service-name=${GITEA_SERVICE}" \
--timeout=2m
check_gitea_health "$HEALTH_FILE"
printf '[7/8] 활성 OAuth2 source, app.ini 정책, 로그인/OIDC 흐름 확인\n'
check_auth_source "$AUTH_LIST_FILE" "$AUTH_ERROR_FILE"
check_app_ini_policy "$APP_INI_ERROR_FILE"
check_login_html "$LOGIN_HTML_FILE" "$SIGNUP_HTML_FILE" "$SIGNUP_HEADERS_FILE"
check_oidc_redirect "$OIDC_HEADERS_FILE"
check_public_discovery "$DISCOVERY_FILE"
printf '[8/8] 공개 브랜딩 자산과 로컬 소스 SHA-256 비교\n'
check_branding_hashes "$BRANDING_REMOTE_DIR"
printf '\nGITEA OIDC APPLY SUCCESS\n'
printf '적용 manifest SHA-256: %s\n' "$gitea_manifest_sha256"
printf 'Keycloak discovery, 활성 OAuth2 source, 외부 인증 전용 가입 정책, OIDC redirect를 확인했습니다.\n'
printf 'OIDC Secret 값, 토큰, 전체 Location/state는 출력하지 않았습니다.\n'
printf '실제 realm 사용자 login/callback/logout은 별도 수동 수용 시험으로 남습니다.\n'
Reference in New Issue View Git Blame Copy Permalink