generated from coulomb/repo-seed
29 lines
953 B
Bash
29 lines
953 B
Bash
#!/usr/bin/env bash
|
|
# Verify the live KeyCape config carries the OpenBao CLI client and KeyCape is
|
|
# serving OIDC discovery after rollout.
|
|
|
|
set -euo pipefail
|
|
|
|
NAMESPACE="${KEYCAPE_NAMESPACE:-sso}"
|
|
SECRET="${KEYCAPE_CONFIG_SECRET:-keycape-config}"
|
|
KUBECTL="${KUBECTL:-kubectl}"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
"$KUBECTL" get secret "$SECRET" -n "$NAMESPACE" -o json \
|
|
| python3 "$SCRIPT_DIR/openbao-client-config.py" verify
|
|
|
|
KC_POD=$("$KUBECTL" get pod -n "$NAMESPACE" \
|
|
-l app.kubernetes.io/name=keycape \
|
|
--field-selector=status.phase=Running \
|
|
-o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
|
|
|
|
if [[ -z "$KC_POD" ]]; then
|
|
echo "[FAIL] no running KeyCape pod found in namespace $NAMESPACE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
"$KUBECTL" exec -n "$NAMESPACE" "$KC_POD" -- \
|
|
wget -qO- "http://localhost:8080/.well-known/openid-configuration" >/dev/null
|
|
|
|
echo "[PASS] KeyCape discovery endpoint responds from pod $KC_POD"
|