fix(keycloak): use supported admin bootstrap env
This commit is contained in:
Codex Agent
@@ -37,87 +37,66 @@ spec:
|
||||
set -eu
|
||||
KC=http://keycloak.keycloak.svc.cluster.local:8080
|
||||
for i in $(seq 1 60); do
|
||||
if curl -sf $KC/realms/master > /dev/null; then
|
||||
code=$(curl -s -o /dev/null -w '%{http_code}' $KC/realms/master || true)
|
||||
code=${code:-000}
|
||||
if [ "$code" = "200" ]; then
|
||||
echo keycloak-ready
|
||||
exit 0
|
||||
fi
|
||||
echo waiting-for-keycloak
|
||||
echo "waiting-for-keycloak status=$code"
|
||||
sleep 5
|
||||
done
|
||||
echo keycloak-not-ready
|
||||
exit 1
|
||||
- name: get-admin-token
|
||||
containers:
|
||||
- name: bootstrap
|
||||
image: curlimages/curl:8.10.1
|
||||
env:
|
||||
- name: ADMIN_PASSWORD_FILE
|
||||
value: /tmp/admin-password
|
||||
- name: PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: keycloak-admin
|
||||
key: password
|
||||
- name: CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hwlab-cloud-web-client
|
||||
key: client-secret
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
ADMIN_PASSWORD=$(cat $ADMIN_PASSWORD_FILE/password)
|
||||
curl -sf -X POST http://keycloak.keycloak.svc.cluster.local:8080/realms/master/protocol/openid-connect/token \
|
||||
KC=http://keycloak.keycloak.svc.cluster.local:8080
|
||||
REALM=hwlab
|
||||
echo fetching-admin-token
|
||||
curl -sf -X POST $KC/realms/master/protocol/openid-connect/token \
|
||||
-H 'content-type: application/x-www-form-urlencoded' \
|
||||
--data-urlencode 'username=admin' \
|
||||
--data-urlencode "password=$ADMIN_PASSWORD" \
|
||||
--data-urlencode "password=$PASSWORD" \
|
||||
--data-urlencode 'grant_type=password' \
|
||||
--data-urlencode 'client_id=admin-cli' > /tmp/token.json
|
||||
if grep -q access_token /tmp/token.json; then
|
||||
echo token-ok
|
||||
else
|
||||
echo token-failed
|
||||
TOKEN=$(grep -oE '"access_token":"[^"]+' /tmp/token.json | head -1 | cut -d'"' -f4)
|
||||
if [ -z "$TOKEN" ]; then
|
||||
echo no-token
|
||||
cat /tmp/token.json
|
||||
exit 1
|
||||
fi
|
||||
volumeMounts:
|
||||
- name: admin-password
|
||||
mountPath: /tmp/admin-password
|
||||
readOnly: true
|
||||
- name: create-realm
|
||||
image: curlimages/curl:8.10.1
|
||||
env:
|
||||
- name: CLIENT_SECRET_FILE
|
||||
value: /tmp/client-secret
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
TOKEN=$(grep -oE 'access_token":"[^"]+' /tmp/token.json | head -1 | cut -d'"' -f3)
|
||||
if [ -z "$TOKEN" ]; then
|
||||
echo no-token
|
||||
exit 1
|
||||
fi
|
||||
KC=http://keycloak.keycloak.svc.cluster.local:8080
|
||||
REALM=hwlab
|
||||
if curl -sf -H "Authorization: Bearer $TOKEN" $KC/admin/realms/$REALM > /dev/null; then
|
||||
echo token-ok
|
||||
code=$(curl -s -o /tmp/realm.json -w '%{http_code}' -H "Authorization: Bearer $TOKEN" $KC/admin/realms/$REALM)
|
||||
if [ "$code" = "200" ]; then
|
||||
echo realm-already-exists
|
||||
exit 0
|
||||
else
|
||||
echo creating-realm
|
||||
curl -sf -X POST $KC/admin/realms -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{"realm":"hwlab","enabled":true,"registrationAllowed":true,"verifyEmail":false,"loginWithEmailAllowed":true,"duplicateEmailsAllowed":false,"resetPasswordAllowed":false,"editUsernameAllowed":false,"bruteForceProtected":false,"accessTokenLifespan":1440,"ssoSessionIdleTimeout":86400,"ssoSessionMaxLifespan":86400}'
|
||||
echo realm-created
|
||||
fi
|
||||
client_code=$(curl -s -o /tmp/clients.json -w '%{http_code}' -H "Authorization: Bearer $TOKEN" "$KC/admin/realms/$REALM/clients?clientId=hwlab-cloud-web")
|
||||
if [ "$client_code" = "200" ] && grep -q '"clientId":"hwlab-cloud-web"' /tmp/clients.json; then
|
||||
echo client-already-exists
|
||||
else
|
||||
echo creating-client
|
||||
curl -sf -X POST $KC/admin/realms/$REALM/clients -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d "{\"clientId\":\"hwlab-cloud-web\",\"secret\":\"$CLIENT_SECRET\",\"redirectUris\":[\"http://74.48.78.17:19667/auth/oidc/callback\",\"https://auth.74-48-78-17.nip.io/auth/oidc/callback\"],\"webOrigins\":[\"+\"],\"standardFlowEnabled\":true,\"directAccessGrantsEnabled\":true}"
|
||||
echo client-created
|
||||
fi
|
||||
echo creating-realm
|
||||
curl -sf -X POST $KC/admin/realms -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{"realm":"hwlab","enabled":true,"registrationAllowed":true,"verifyEmail":false,"loginWithEmailAllowed":true,"duplicateEmailsAllowed":false,"resetPasswordAllowed":false,"editUsernameAllowed":false,"bruteForceProtected":false,"accessTokenLifespan":1440,"ssoSessionIdleTimeout":86400,"ssoSessionMaxLifespan":86400}'
|
||||
echo realm-created
|
||||
CLIENT_SECRET=$(cat $CLIENT_SECRET_FILE/client-secret)
|
||||
curl -sf -X POST $KC/admin/realms/$REALM/clients -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d "{\"clientId\":\"hwlab-cloud-web\",\"secret\":\"$CLIENT_SECRET\",\"redirectUris\":[\"http://74.48.78.17:19667/auth/oidc/callback\",\"https://auth.74-48-78-17.nip.io/auth/oidc/callback\"],\"webOrigins\":[\"+\"],\"standardFlowEnabled\":true,\"directAccessGrantsEnabled\":true}"
|
||||
echo client-created
|
||||
volumeMounts:
|
||||
- name: client-secret
|
||||
mountPath: /tmp/client-secret
|
||||
readOnly: true
|
||||
containers:
|
||||
- name: done
|
||||
image: curlimages/curl:8.10.1
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
echo keycloak-bootstrap-complete
|
||||
sleep 30
|
||||
volumes:
|
||||
- name: admin-password
|
||||
secret:
|
||||
secretName: keycloak-admin
|
||||
- name: client-secret
|
||||
secret:
|
||||
secretName: hwlab-cloud-web-client
|
||||
|
||||
@@ -61,9 +61,9 @@ items:
|
||||
- name: management
|
||||
containerPort: 9000
|
||||
env:
|
||||
- name: KC_BOOTSTRAP_ADMIN_USERNAME
|
||||
- name: KEYCLOAK_ADMIN
|
||||
value: admin
|
||||
- name: KC_BOOTSTRAP_ADMIN_PASSWORD
|
||||
- name: KEYCLOAK_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: keycloak-admin
|
||||
|
||||
Reference in New Issue
Block a user