mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(hwlab-cli): client auth oidc-login returns Keycloak authorize URL

Browse Source
This commit is contained in:
Codex
2026-06-04 04:28:19 +08:00
committed by Codex Agent
parent 6b93ebd0ef
commit 4d48db9e7c
2 changed files with 70 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/k8s/keycloak/keycloak-bootstrap-job.yaml
+60 -29
View File
@@ -27,12 +27,56 @@ spec:
hwlab.pikastech.local/component: identity
spec:
restartPolicy: OnFailure
containers:
- name: bootstrap
initContainers:
- name: wait-for-keycloak
image: curlimages/curl:8.10.1
command:
- /bin/sh
- -c
- |
set -eu
KC=http://keycloak.keycloak.svc.cluster.local:8080
for i in $(seq 1 60); do
if curl -sf $KC/realms/master > /dev/null; then
echo keycloak-ready
exit 0
fi
echo waiting-for-keycloak
sleep 5
done
echo keycloak-not-ready
exit 1
- name: get-admin-token
image: curlimages/curl:8.10.1
env:
- name: ADMIN_PASSWORD_FILE
value: /tmp/admin-password
command:
- /bin/sh
- -c
- |
set -eu
ADMIN_PASSWORD=$(cat $ADMIN_PASSWORD_FILE/password)
curl -sf -X POST http://keycloak.keycloak.svc.cluster.local:8080/realms/master/protocol/openid-connect/token \
-H 'content-type: application/x-www-form-urlencoded' \
--data-urlencode 'username=admin' \
--data-urlencode "password=$ADMIN_PASSWORD" \
--data-urlencode 'grant_type=password' \
--data-urlencode 'client_id=admin-cli' > /tmp/token.json
if grep -q access_token /tmp/token.json; then
echo token-ok
else
echo token-failed
cat /tmp/token.json
exit 1
fi
volumeMounts:
- name: admin-password
mountPath: /tmp/admin-password
readOnly: true
- name: create-realm
image: curlimages/curl:8.10.1
env:
- name: CLIENT_SECRET_FILE
value: /tmp/client-secret
command:
@@ -40,49 +84,36 @@ spec:
- -c
- |
set -eu
KC=http://keycloak.keycloak.svc.cluster.local:8080
until curl -sf $KC/realms/master > /dev/null; do
echo waiting-for-keycloak
sleep 5
done
ADMIN_PASSWORD=$(cat /tmp/admin-password/password)
CLIENT_SECRET=$(cat /tmp/client-secret/client-secret)
REALM=hwlab
curl -sf -X POST $KC/realms/master/protocol/openid-connect/token \
-H 'content-type: application/x-www-form-urlencoded' \
--data-urlencode 'username=admin' \
--data-urlencode "password=$ADMIN_PASSWORD" \
--data-urlencode 'grant_type=password' \
--data-urlencode 'client_id=admin-cli' \
> /tmp/token.json
cat /tmp/token.json
TOKEN=$(grep -oE 'access_token":"[^"]+' /tmp/token.json | head -1 | cut -d'"' -f3)
if [ -z "$TOKEN" ]; then
echo no-token
exit 1
fi
KC=http://keycloak.keycloak.svc.cluster.local:8080
REALM=hwlab
if curl -sf -H "Authorization: Bearer $TOKEN" $KC/admin/realms/$REALM > /dev/null; then
echo realm-already-exists
exit 0
fi
echo creating-realm
curl -sf -X POST $KC/admin/realms \
-H "Authorization: Bearer $TOKEN" \
-H 'content-type: application/json' \
-d '{"realm":"hwlab","enabled":true,"registrationAllowed":true,"verifyEmail":false,"loginWithEmailAllowed":true,"duplicateEmailsAllowed":false,"resetPasswordAllowed":false,"editUsernameAllowed":false,"bruteForceProtected":false,"accessTokenLifespan":1440,"ssoSessionIdleTimeout":86400,"ssoSessionMaxLifespan":86400}'
curl -sf -X POST $KC/admin/realms -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{"realm":"hwlab","enabled":true,"registrationAllowed":true,"verifyEmail":false,"loginWithEmailAllowed":true,"duplicateEmailsAllowed":false,"resetPasswordAllowed":false,"editUsernameAllowed":false,"bruteForceProtected":false,"accessTokenLifespan":1440,"ssoSessionIdleTimeout":86400,"ssoSessionMaxLifespan":86400}'
echo realm-created
curl -sf -X POST $KC/admin/realms/$REALM/clients \
-H "Authorization: Bearer $TOKEN" \
-H 'content-type: application/json' \
-d '{"clientId":"hwlab-cloud-web","secret":"'"$CLIENT_SECRET"'","redirectUris":["http://74.48.78.17:19667/auth/oidc/callback","https://auth.74-48-78-17.nip.io/auth/oidc/callback"],"webOrigins":["+"],"standardFlowEnabled":true,"directAccessGrantsEnabled":true}'
CLIENT_SECRET=$(cat $CLIENT_SECRET_FILE/client-secret)
curl -sf -X POST $KC/admin/realms/$REALM/clients -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d "{\"clientId\":\"hwlab-cloud-web\",\"secret\":\"$CLIENT_SECRET\",\"redirectUris\":[\"http://74.48.78.17:19667/auth/oidc/callback\",\"https://auth.74-48-78-17.nip.io/auth/oidc/callback\"],\"webOrigins\":[\"+\"],\"standardFlowEnabled\":true,\"directAccessGrantsEnabled\":true}"
echo client-created
volumeMounts:
- name: admin-password
mountPath: /tmp/admin-password
readOnly: true
- name: client-secret
mountPath: /tmp/client-secret
readOnly: true
containers:
- name: done
image: curlimages/curl:8.10.1
command:
- /bin/sh
- -c
- |
echo keycloak-bootstrap-complete
sleep 30
volumes:
- name: admin-password
secret: