395 lines
16 KiB
Go
395 lines
16 KiB
Go
package cluster
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"fmt"
|
|
"html"
|
|
"io"
|
|
"net/http"
|
|
"net/http/cookiejar"
|
|
neturl "net/url"
|
|
"regexp"
|
|
"strings"
|
|
"time"
|
|
|
|
"scm.bstein.dev/bstein/ananke/internal/config"
|
|
)
|
|
|
|
type keycloakTokenResponse struct {
|
|
AccessToken string `json:"access_token"`
|
|
}
|
|
|
|
type keycloakUser struct {
|
|
ID string `json:"id"`
|
|
}
|
|
|
|
type keycloakImpersonationResponse struct {
|
|
Redirect string `json:"redirect"`
|
|
}
|
|
|
|
type kubernetesSecret struct {
|
|
Data map[string]string `json:"data"`
|
|
}
|
|
|
|
var keycloakLoginFormActionPattern = regexp.MustCompile(`(?is)<form[^>]*id=["']kc-form-login["'][^>]*action=["']([^"']+)["']`)
|
|
|
|
// checklistAuthHTTPClient runs one orchestration or CLI step.
|
|
// Signature: (o *Orchestrator) checklistAuthHTTPClient(ctx context.Context, timeout time.Duration, insecureSkipTLS bool) (*http.Client, error).
|
|
// Why: startup checklist checks that require real user behavior need an
|
|
// authenticated robotuser browser-like session before probing service pages.
|
|
func (o *Orchestrator) checklistAuthHTTPClient(ctx context.Context, timeout time.Duration, insecureSkipTLS bool) (*http.Client, error) {
|
|
jar, _ := cookiejar.New(nil)
|
|
transport := &http.Transport{}
|
|
if insecureSkipTLS {
|
|
transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
|
|
}
|
|
client := &http.Client{
|
|
Timeout: timeout,
|
|
Transport: transport,
|
|
Jar: jar,
|
|
}
|
|
if err := o.authenticateRobotChecklistSession(ctx, client); err != nil {
|
|
return nil, err
|
|
}
|
|
return client, nil
|
|
}
|
|
|
|
// authenticateRobotChecklistSession runs one orchestration or CLI step.
|
|
// Signature: (o *Orchestrator) authenticateRobotChecklistSession(ctx context.Context, client *http.Client) error.
|
|
// Why: authenticated checklist probes must reflect what a human sees after
|
|
// Keycloak login, not only pre-auth redirects.
|
|
func (o *Orchestrator) authenticateRobotChecklistSession(ctx context.Context, client *http.Client) error {
|
|
auth := o.cfg.Startup.ServiceChecklistAuth
|
|
mode := strings.TrimSpace(auth.Mode)
|
|
if mode == "" || mode == "none" {
|
|
return fmt.Errorf("startup checklist auth mode is disabled")
|
|
}
|
|
if mode != "keycloak_robotuser" {
|
|
return fmt.Errorf("unsupported startup checklist auth mode %q", mode)
|
|
}
|
|
|
|
adminUser, adminPassword, err := o.keycloakAdminCredentials(ctx, auth)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := o.keycloakAdminBrowserLogin(ctx, client, auth, adminUser, adminPassword); err != nil {
|
|
return fmt.Errorf("initialize keycloak admin browser session: %w", err)
|
|
}
|
|
adminToken, err := o.keycloakAdminToken(ctx, client, auth, adminUser, adminPassword)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
robotUserID, err := o.keycloakRobotUserID(ctx, client, auth, adminToken)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
redirectURL, err := o.keycloakImpersonationRedirect(ctx, client, auth, adminToken, robotUserID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if strings.TrimSpace(redirectURL) == "" {
|
|
redirectURL = keycloakBaseURL(auth) + "/realms/" + strings.TrimSpace(auth.Realm) + "/account/"
|
|
}
|
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, redirectURL, nil)
|
|
if err != nil {
|
|
return fmt.Errorf("build robot redirect request: %w", err)
|
|
}
|
|
req.Header.Set("User-Agent", "ananke/startup-checklist")
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return fmt.Errorf("initialize robot session redirect: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 1024))
|
|
finalURL := ""
|
|
if resp.Request != nil && resp.Request.URL != nil {
|
|
finalURL = strings.TrimSpace(resp.Request.URL.String())
|
|
}
|
|
if strings.Contains(finalURL, "/protocol/openid-connect/auth") || strings.Contains(finalURL, "/login-actions/authenticate") {
|
|
return fmt.Errorf("robot session bootstrap ended on keycloak login flow: %s", finalURL)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// keycloakAdminBrowserLogin runs one orchestration or CLI step.
|
|
// Signature: (o *Orchestrator) keycloakAdminBrowserLogin(ctx context.Context, client *http.Client, auth config.ServiceChecklistAuthSettings, adminUser string, adminPassword string) error.
|
|
// Why: Keycloak impersonation only yields a usable robot session cookie when the
|
|
// client already has a real admin browser session; token-only API calls are not
|
|
// sufficient for downstream OIDC-gated service checks.
|
|
func (o *Orchestrator) keycloakAdminBrowserLogin(ctx context.Context, client *http.Client, auth config.ServiceChecklistAuthSettings, adminUser string, adminPassword string) error {
|
|
baseURL := keycloakBaseURL(auth)
|
|
authURL := baseURL + "/realms/master/protocol/openid-connect/auth?" + keycloakAdminConsoleAuthQuery(baseURL).Encode()
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, authURL, nil)
|
|
if err != nil {
|
|
return fmt.Errorf("build keycloak admin auth request: %w", err)
|
|
}
|
|
req.Header.Set("User-Agent", "ananke/startup-checklist")
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return fmt.Errorf("request keycloak admin auth page: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
body, _ := io.ReadAll(io.LimitReader(resp.Body, 512*1024))
|
|
if resp.StatusCode/100 != 2 {
|
|
return fmt.Errorf("keycloak admin auth page request failed status=%d body=%q", resp.StatusCode, compactHTTPBody(body))
|
|
}
|
|
actionURL, err := keycloakLoginFormAction(string(body), baseURL)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
form := neturl.Values{}
|
|
form.Set("username", adminUser)
|
|
form.Set("password", adminPassword)
|
|
form.Set("credentialId", "")
|
|
|
|
loginReq, err := http.NewRequestWithContext(ctx, http.MethodPost, actionURL, strings.NewReader(form.Encode()))
|
|
if err != nil {
|
|
return fmt.Errorf("build keycloak admin login request: %w", err)
|
|
}
|
|
loginReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
loginReq.Header.Set("User-Agent", "ananke/startup-checklist")
|
|
|
|
loginResp, err := client.Do(loginReq)
|
|
if err != nil {
|
|
return fmt.Errorf("request keycloak admin login submit: %w", err)
|
|
}
|
|
defer loginResp.Body.Close()
|
|
loginBody, _ := io.ReadAll(io.LimitReader(loginResp.Body, 512*1024))
|
|
finalURL := ""
|
|
if loginResp.Request != nil && loginResp.Request.URL != nil {
|
|
finalURL = strings.TrimSpace(loginResp.Request.URL.String())
|
|
}
|
|
if loginResp.StatusCode >= 500 {
|
|
return fmt.Errorf("keycloak admin login failed status=%d body=%q", loginResp.StatusCode, compactHTTPBody(loginBody))
|
|
}
|
|
if strings.Contains(finalURL, "/login-actions/authenticate") || strings.Contains(finalURL, "/protocol/openid-connect/auth") {
|
|
return fmt.Errorf("keycloak admin login did not complete (final_url=%q)", finalURL)
|
|
}
|
|
if strings.Contains(strings.ToLower(string(loginBody)), "kc-form-login") {
|
|
return fmt.Errorf("keycloak admin login form still present after submit")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// keycloakAdminCredentials runs one orchestration or CLI step.
|
|
// Signature: (o *Orchestrator) keycloakAdminCredentials(ctx context.Context, auth config.ServiceChecklistAuthSettings) (string, string, error).
|
|
// Why: robotuser impersonation uses a cluster-managed admin secret so startup
|
|
// checks do not rely on interactive credentials.
|
|
func (o *Orchestrator) keycloakAdminCredentials(ctx context.Context, auth config.ServiceChecklistAuthSettings) (string, string, error) {
|
|
namespace := strings.TrimSpace(auth.AdminSecretNamespace)
|
|
name := strings.TrimSpace(auth.AdminSecretName)
|
|
userKey := strings.TrimSpace(auth.AdminSecretUsernameKey)
|
|
passwordKey := strings.TrimSpace(auth.AdminSecretPasswordKey)
|
|
|
|
username, err := o.kubernetesSecretValue(ctx, namespace, name, userKey)
|
|
if err != nil {
|
|
return "", "", fmt.Errorf("read keycloak admin username from secret %s/%s: %w", namespace, name, err)
|
|
}
|
|
password, err := o.kubernetesSecretValue(ctx, namespace, name, passwordKey)
|
|
if err != nil {
|
|
return "", "", fmt.Errorf("read keycloak admin password from secret %s/%s: %w", namespace, name, err)
|
|
}
|
|
return username, password, nil
|
|
}
|
|
|
|
// kubernetesSecretValue runs one orchestration or CLI step.
|
|
// Signature: (o *Orchestrator) kubernetesSecretValue(ctx context.Context, namespace string, name string, key string) (string, error).
|
|
// Why: checklist auth depends on secret-backed credentials and should decode
|
|
// them directly from Kubernetes rather than shelling out to external tools.
|
|
func (o *Orchestrator) kubernetesSecretValue(ctx context.Context, namespace string, name string, key string) (string, error) {
|
|
out, err := o.kubectl(ctx, 25*time.Second, "-n", namespace, "get", "secret", name, "-o", "json")
|
|
if err != nil {
|
|
return "", fmt.Errorf("kubectl get secret: %w", err)
|
|
}
|
|
var doc kubernetesSecret
|
|
if err := json.Unmarshal([]byte(out), &doc); err != nil {
|
|
return "", fmt.Errorf("decode secret json: %w", err)
|
|
}
|
|
encoded, ok := doc.Data[key]
|
|
if !ok {
|
|
return "", fmt.Errorf("key %q not present in secret", key)
|
|
}
|
|
decoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(encoded))
|
|
if err != nil {
|
|
return "", fmt.Errorf("decode base64 secret value: %w", err)
|
|
}
|
|
value := strings.TrimSpace(string(decoded))
|
|
if value == "" {
|
|
return "", fmt.Errorf("decoded value is empty")
|
|
}
|
|
return value, nil
|
|
}
|
|
|
|
// keycloakAdminToken runs one orchestration or CLI step.
|
|
// Signature: (o *Orchestrator) keycloakAdminToken(ctx context.Context, client *http.Client, auth config.ServiceChecklistAuthSettings, adminUser string, adminPassword string) (string, error).
|
|
// Why: admin API access is needed to impersonate robotuser for deterministic
|
|
// user-journey checks across OIDC-gated services.
|
|
func (o *Orchestrator) keycloakAdminToken(ctx context.Context, client *http.Client, auth config.ServiceChecklistAuthSettings, adminUser string, adminPassword string) (string, error) {
|
|
form := neturl.Values{}
|
|
form.Set("grant_type", "password")
|
|
form.Set("client_id", "admin-cli")
|
|
form.Set("username", adminUser)
|
|
form.Set("password", adminPassword)
|
|
|
|
tokenURL := keycloakBaseURL(auth) + "/realms/master/protocol/openid-connect/token"
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, tokenURL, strings.NewReader(form.Encode()))
|
|
if err != nil {
|
|
return "", fmt.Errorf("build admin token request: %w", err)
|
|
}
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req.Header.Set("User-Agent", "ananke/startup-checklist")
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", fmt.Errorf("request admin token: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
body, _ := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
|
|
if resp.StatusCode/100 != 2 {
|
|
return "", fmt.Errorf("admin token request failed status=%d body=%q", resp.StatusCode, compactHTTPBody(body))
|
|
}
|
|
|
|
var payload keycloakTokenResponse
|
|
if err := json.Unmarshal(body, &payload); err != nil {
|
|
return "", fmt.Errorf("decode admin token response: %w", err)
|
|
}
|
|
token := strings.TrimSpace(payload.AccessToken)
|
|
if token == "" {
|
|
return "", fmt.Errorf("admin token response missing access_token")
|
|
}
|
|
return token, nil
|
|
}
|
|
|
|
// keycloakRobotUserID runs one orchestration or CLI step.
|
|
// Signature: (o *Orchestrator) keycloakRobotUserID(ctx context.Context, client *http.Client, auth config.ServiceChecklistAuthSettings, adminToken string) (string, error).
|
|
// Why: impersonation requires the concrete user id and should fail fast when
|
|
// robotuser is missing from the realm.
|
|
func (o *Orchestrator) keycloakRobotUserID(ctx context.Context, client *http.Client, auth config.ServiceChecklistAuthSettings, adminToken string) (string, error) {
|
|
base := keycloakBaseURL(auth)
|
|
realm := strings.TrimSpace(auth.Realm)
|
|
username := strings.TrimSpace(auth.RobotUsername)
|
|
query := neturl.Values{}
|
|
query.Set("username", username)
|
|
query.Set("exact", "true")
|
|
usersURL := base + "/admin/realms/" + realm + "/users?" + query.Encode()
|
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, usersURL, nil)
|
|
if err != nil {
|
|
return "", fmt.Errorf("build robot user lookup request: %w", err)
|
|
}
|
|
req.Header.Set("Authorization", "Bearer "+adminToken)
|
|
req.Header.Set("User-Agent", "ananke/startup-checklist")
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", fmt.Errorf("lookup robot user: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
body, _ := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
|
|
if resp.StatusCode/100 != 2 {
|
|
return "", fmt.Errorf("robot user lookup failed status=%d body=%q", resp.StatusCode, compactHTTPBody(body))
|
|
}
|
|
|
|
var users []keycloakUser
|
|
if err := json.Unmarshal(body, &users); err != nil {
|
|
return "", fmt.Errorf("decode robot user lookup response: %w", err)
|
|
}
|
|
if len(users) == 0 || strings.TrimSpace(users[0].ID) == "" {
|
|
return "", fmt.Errorf("robot user %q not found in realm %q", username, realm)
|
|
}
|
|
return strings.TrimSpace(users[0].ID), nil
|
|
}
|
|
|
|
// keycloakImpersonationRedirect runs one orchestration or CLI step.
|
|
// Signature: (o *Orchestrator) keycloakImpersonationRedirect(ctx context.Context, client *http.Client, auth config.ServiceChecklistAuthSettings, adminToken string, robotUserID string) (string, error).
|
|
// Why: opening a real impersonated browser session guarantees checks evaluate
|
|
// post-login app behavior instead of only auth-gateway redirects.
|
|
func (o *Orchestrator) keycloakImpersonationRedirect(ctx context.Context, client *http.Client, auth config.ServiceChecklistAuthSettings, adminToken string, robotUserID string) (string, error) {
|
|
base := keycloakBaseURL(auth)
|
|
realm := strings.TrimSpace(auth.Realm)
|
|
impersonateURL := base + "/admin/realms/" + realm + "/users/" + strings.TrimSpace(robotUserID) + "/impersonation"
|
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, impersonateURL, http.NoBody)
|
|
if err != nil {
|
|
return "", fmt.Errorf("build robot impersonation request: %w", err)
|
|
}
|
|
req.Header.Set("Authorization", "Bearer "+adminToken)
|
|
req.Header.Set("User-Agent", "ananke/startup-checklist")
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", fmt.Errorf("request robot impersonation: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
body, _ := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
|
|
if resp.StatusCode/100 != 2 {
|
|
return "", fmt.Errorf("robot impersonation failed status=%d body=%q", resp.StatusCode, compactHTTPBody(body))
|
|
}
|
|
|
|
var payload keycloakImpersonationResponse
|
|
if err := json.Unmarshal(body, &payload); err != nil {
|
|
return "", fmt.Errorf("decode robot impersonation response: %w", err)
|
|
}
|
|
return strings.TrimSpace(payload.Redirect), nil
|
|
}
|
|
|
|
// keycloakBaseURL runs one orchestration or CLI step.
|
|
// Signature: keycloakBaseURL(auth config.ServiceChecklistAuthSettings) string.
|
|
// Why: centralizing URL normalization keeps auth request construction stable.
|
|
func keycloakBaseURL(auth config.ServiceChecklistAuthSettings) string {
|
|
return strings.TrimRight(strings.TrimSpace(auth.KeycloakBaseURL), "/")
|
|
}
|
|
|
|
// keycloakAdminConsoleAuthQuery runs one orchestration or CLI step.
|
|
// Signature: keycloakAdminConsoleAuthQuery() neturl.Values.
|
|
// Why: centralizes required Keycloak admin-console auth parameters, including
|
|
// PKCE fields required by current Keycloak defaults.
|
|
func keycloakAdminConsoleAuthQuery(baseURL string) neturl.Values {
|
|
query := neturl.Values{}
|
|
query.Set("client_id", "security-admin-console")
|
|
query.Set("redirect_uri", strings.TrimRight(strings.TrimSpace(baseURL), "/")+"/admin/master/console/")
|
|
query.Set("response_type", "code")
|
|
query.Set("scope", "openid")
|
|
query.Set("state", "ananke-startup-checklist")
|
|
query.Set("nonce", "ananke-startup-checklist")
|
|
query.Set("code_challenge_method", "S256")
|
|
query.Set("code_challenge", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
|
|
return query
|
|
}
|
|
|
|
// keycloakLoginFormAction runs one orchestration or CLI step.
|
|
// Signature: keycloakLoginFormAction(page string, baseURL string) (string, error).
|
|
// Why: Keycloak's login form action carries session-bound query params and must
|
|
// be parsed from the rendered page before posting credentials.
|
|
func keycloakLoginFormAction(page string, baseURL string) (string, error) {
|
|
matches := keycloakLoginFormActionPattern.FindStringSubmatch(page)
|
|
if len(matches) < 2 || strings.TrimSpace(matches[1]) == "" {
|
|
return "", fmt.Errorf("keycloak login page missing kc-form-login action")
|
|
}
|
|
action := html.UnescapeString(strings.TrimSpace(matches[1]))
|
|
if strings.HasPrefix(action, "/") {
|
|
return strings.TrimRight(strings.TrimSpace(baseURL), "/") + action, nil
|
|
}
|
|
if strings.HasPrefix(action, "http://") || strings.HasPrefix(action, "https://") {
|
|
return action, nil
|
|
}
|
|
return "", fmt.Errorf("keycloak login action uses unsupported format %q", action)
|
|
}
|
|
|
|
// compactHTTPBody runs one orchestration or CLI step.
|
|
// Signature: compactHTTPBody(raw []byte) string.
|
|
// Why: checklist auth errors should include a readable body summary without
|
|
// leaking multi-line payload noise into orchestrator logs.
|
|
func compactHTTPBody(raw []byte) string {
|
|
text := strings.TrimSpace(string(raw))
|
|
if text == "" {
|
|
return ""
|
|
}
|
|
return strings.Join(strings.Fields(text), " ")
|
|
}
|