94 lines
3.7 KiB
YAML
94 lines
3.7 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: oidc-job
|
|
namespace: dev-tools
|
|
spec:
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: oidc-setup
|
|
image: harbor.dvirlabs.com/dev-tools/vault:1.15.5-curl-v2
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -e
|
|
echo "⏳ Waiting for Vault to become available..."
|
|
until curl -s http://vault.dev-tools.svc.cluster.local:8200/v1/sys/health | grep '"initialized":true'; do
|
|
sleep 2
|
|
done
|
|
|
|
export VAULT_ADDR=http://vault.dev-tools.svc.cluster.local:8200
|
|
export VAULT_TOKEN=$(cat /vault/secrets/root-token)
|
|
|
|
echo "🔑 Verifying Vault token..."
|
|
if ! vault token lookup >/dev/null 2>&1; then
|
|
echo "❌ Invalid Vault token. Exiting."
|
|
exit 1
|
|
fi
|
|
|
|
echo "🔐 Enabling OIDC auth method..."
|
|
vault auth enable oidc || true
|
|
|
|
echo "🔧 Configuring OIDC connection to Keycloak..."
|
|
vault write auth/oidc/config \
|
|
oidc_discovery_url="https://keycloak.dvirlabs.com/realms/lab" \
|
|
oidc_client_id="vault" \
|
|
oidc_client_secret="8GWiUqwUZimb4xXHqFNTYCrTkKyc9hrY" \
|
|
default_role="vault-admins"
|
|
|
|
echo 'path "auth/oidc/role/default" { capabilities = ["read"] }' > /tmp/oidc-ui-access.hcl
|
|
vault policy write oidc-ui-access /tmp/oidc-ui-access.hcl
|
|
|
|
echo "🎯 Creating OIDC role named 'default'..."
|
|
vault write auth/oidc/role/default \
|
|
bound_audiences="vault" \
|
|
allowed_redirect_uris="https://vault.dvirlabs.com/ui/vault/auth/oidc/oidc/callback" \
|
|
user_claim="preferred_username" \
|
|
groups_claim="groups" \
|
|
oidc_scopes="profile email groups" \
|
|
policies="default" \
|
|
token_policies="oidc-ui-access" \
|
|
ttl="1h"
|
|
|
|
echo 'path "*" { capabilities = ["create", "read", "update", "delete", "list", "sudo"] }' > /tmp/vault-admin.hcl
|
|
vault policy write vault-admin /tmp/vault-admin.hcl
|
|
|
|
echo "🎯 Creating OIDC role named 'vault-admins' via API..."
|
|
cat >/tmp/vault-admins-role.json <<'JSON'
|
|
{
|
|
"bound_audiences": ["vault"],
|
|
"allowed_redirect_uris": [
|
|
"https://vault.dvirlabs.com/ui/vault/auth/oidc/oidc/callback",
|
|
"http://localhost:8250/oidc/callback"
|
|
],
|
|
"user_claim": "sub",
|
|
"groups_claim": "groups",
|
|
"bound_claims": { "groups": ["vault-admins"] },
|
|
"oidc_scopes": ["profile","email","groups"],
|
|
"policies": ["vault-admin"],
|
|
"ttl": "1h"
|
|
}
|
|
JSON
|
|
|
|
curl -sS \
|
|
-H "X-Vault-Token: $VAULT_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-X PUT "$VAULT_ADDR/v1/auth/oidc/role/vault-admins" \
|
|
--data @/tmp/vault-admins-role.json
|
|
|
|
echo "🔎 Verifying role..."
|
|
curl -sS -H "X-Vault-Token: $VAULT_TOKEN" \
|
|
"$VAULT_ADDR/v1/auth/oidc/role/vault-admins" | sed 's/"client_secret".*"/"client_secret":"***"/'
|
|
|
|
echo "✅ All OIDC setup completed successfully."
|
|
volumeMounts:
|
|
- name: vault-token
|
|
mountPath: /vault/secrets
|
|
readOnly: true
|
|
volumes:
|
|
- name: vault-token
|
|
secret:
|
|
secretName: vault-root-init-token
|