-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathinstall.py
More file actions
3716 lines (3107 loc) · 171 KB
/
install.py
File metadata and controls
3716 lines (3107 loc) · 171 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#! /usr/bin/env python3
import argparse
import enum
import os
import logging
import shlex
import string
import random
import re
import yaml
import subprocess
import time
import sys
from keycloak_admin_api import KeycloakAdminAPIClient
from auth import AuthClient
from config import *
SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
DEFAULT_CONFIG_FILE_PATH = "config.private.yaml"
K8S_DEPLOY_NODE_REPO = "git@github.com:EUCAIM/k8s-deploy-node.git"
##WHY None? Because CONFIG is set later after parsing args in main
CONFIG = None
## Function to execute shell commands
def cmd(command, exit_on_error=True):
print(command)
ret = os.system(command)
if exit_on_error and ret != 0: exit(1)
return ret
## To get command output as string
def cmd_output(command):
'''Execute command and return output as string'''
try:
result = subprocess.run(command, shell=True, capture_output=True, text=True)
return result.stdout
except Exception as e:
print(f"Error executing command: {e}")
return ""
def generate_random_password(length: int = 16) -> str:
alphabet = string.ascii_letters + string.digits
return ''.join(random.choice(alphabet) for _ in range(length))
## Load or generate guacamole admin password (persisted across runs so reinstalls don't break the DB)
_guac_pw_file = os.path.join(SCRIPT_DIR, "guacamole-eucaim-user-creator-password.txt")
_guac_pw_loaded = None
if os.path.exists(_guac_pw_file):
with open(_guac_pw_file) as _f:
for _line in _f:
if _line.startswith("Password:"):
_guac_pw_loaded = _line.split(":", 1)[1].strip()
break
if _guac_pw_loaded:
guacamole_user_creator_password = _guac_pw_loaded
print(f"Reusing existing guacamole-eucaim-user-creator password from {_guac_pw_file}")
else:
guacamole_user_creator_password = generate_random_password(24)
## Update YAML files
def update_yaml_config(file_path, update_func):
'''Generic function to update YAML configuration files'''
with open(file_path) as f:
docs = list(yaml.safe_load_all(f))
updated = update_func(docs)
if updated:
# If file is in k8s-deploy-node directory, create private copy
if 'k8s-deploy-node' in file_path:
# Create new file path with .private.yaml suffix
base_path = file_path.rsplit('.', 1)[0] # Remove extension
private_file_path = base_path + '.private.yaml'
with open(private_file_path, 'w') as f:
yaml.safe_dump_all(docs, f, sort_keys=False)
print(f"Created private copy: {private_file_path}")
return private_file_path
else:
# For non-k8s-deploy-node files, edit in place
with open(file_path, 'w') as f:
yaml.safe_dump_all(docs, f, sort_keys=False)
return True
return False
## It updates the tracer variable on the 2-dataset-service.yaml with the one indicated by the user
def configure_tracer_service(config, tracer_url=None):
'''Configure or disable tracer service in configuration'''
if "tracer" in config:
if tracer_url:
config["tracer"]["url"] = tracer_url
print(f" Updated tracer URL: {tracer_url}")
else:
config["tracer"]["url"] = ""
print(" Tracer service disabled (URL set to empty)")
else:
config["tracer"] = {"url": tracer_url or ""}
print(" Tracer service disabled (added empty configuration)")
return config
def update_postgres_password(file_path, password, env_var_name="POSTGRES_PASSWORD"):
'''Update PostgreSQL password in deployment YAML'''
def update_password(docs):
updated = False
for doc in docs:
if doc.get("kind") == "Deployment":
for container in doc["spec"]["template"]["spec"]["containers"]:
for env in container.get("env", []):
if env.get("name") == env_var_name:
env["value"] = password
updated = True
return updated
result = update_yaml_config(file_path, update_password)
if result:
# If result is a string, it's the private file path
private_path = result if isinstance(result, str) else file_path
print(f"Injected password into {env_var_name} in {private_path}")
return private_path
else:
print(f"Warning: Could not find {env_var_name} to update password.")
return False
## Delete stuck PVs by removing finalizers
def force_cleanup_pvs():
'''Force cleanup of stuck PVs by removing finalizers'''
print("Force cleaning up stuck PVs...")
ret = cmd("minikube kubectl -- get pv --no-headers | grep Terminating", exit_on_error=False)
if ret == 0:
pv_names = [
"pv-datalake", "pv-dataset-service-data", "pv-datasets",
"pv-guacamole-postgresql", "pv-postgres-data",
"pv-postgres-data-keycloak", "pv-themes-data", "pv-standalone-deployments"
]
for pv in pv_names:
cmd(f"minikube kubectl -- patch pv {pv} -p '{{\"metadata\":{{\"finalizers\":null}}}}' --type=merge || true")
cmd("sleep 5")
## Class to manage Keycloak client secrets find them if existing to avoid conflicts or generate new ones
class Auth_client_secrets():
def __init__(self):
private_realm_file = os.path.join(SCRIPT_DIR, "eucaim-node-realm.private.json")
existing_secrets = {}
if os.path.exists(private_realm_file):
try:
import json
with open(private_realm_file, 'r') as f:
realm_data = json.load(f)
## Read all existing client secrets
for client in realm_data.get('clients', []):
client_id = client.get('clientId')
secret = client.get('secret')
if client_id and secret:
existing_secrets[client_id] = secret
print(f" Found existing realm configuration with {len(existing_secrets)} client secrets")
except Exception as e:
print(f" Warning: Could not read existing secrets from {private_realm_file}: {e}")
self.CLIENT_DATASET_SERVICE_SECRET = existing_secrets.get('dataset-service', generate_random_password(32))
self.CLIENT_FEM_CLIENT_SECRET = existing_secrets.get('fem-client', generate_random_password(32))
self.CLIENT_JOBMAN_SERVICE_SECRET = existing_secrets.get('jobman-service', generate_random_password(32))
self.CLIENT_KUBERNETES_SECRET = existing_secrets.get('kubernetes', generate_random_password(32))
self.CLIENT_KUBERNETES_OPERATOR_SECRET = existing_secrets.get('kubernetes-operator', generate_random_password(32))
if existing_secrets:
print(f" Reusing existing client secrets to maintain consistency")
def install_keycloak(auth_client_secrets: Auth_client_secrets):
if CONFIG is None: raise Exception()
keycloak_path = os.path.join(SCRIPT_DIR, "k8s-deploy-node", "keycloak")
os.chdir(keycloak_path)
## Force cleanup of stuck PVs first
force_cleanup_pvs()
print("Cleaning up existing Keycloak resources (preserving ingress, certificates, and secrets)...")
cmd("minikube kubectl -- create namespace keycloak || true")
cmd("minikube kubectl -- delete deployment --all -n keycloak --timeout=30s || true")
cmd("minikube kubectl -- delete statefulset --all -n keycloak --timeout=30s || true")
cmd("minikube kubectl -- delete service db -n keycloak --timeout=30s || true")
cmd("minikube kubectl -- delete service keycloak -n keycloak --timeout=30s || true")
cmd("minikube kubectl -- delete pvc --all -n keycloak --timeout=30s || true")
cmd("minikube kubectl -- delete job --all -n keycloak --timeout=30s || true")
cmd("minikube kubectl -- delete pod --all -n keycloak --timeout=30s --force --grace-period=0 || true")
print("Waiting for cleanup to complete...")
cmd("sleep 10")
print("Cleaning Keycloak PVs...")
cmd("minikube kubectl -- delete pv pv-postgres-data-keycloak pv-themes-data pv-standalone-deployments --timeout=30s --force --grace-period=0 || true")
cmd("sleep 5")
cmd("minikube kubectl -- label nodes minikube chaimeleon.eu/target=core-services --overwrite")
cmd("minikube kubectl -- create priorityclass core-services --value=1000 --description='Priority class for core services' || true")
cmd("minikube kubectl -- create priorityclass core-applications --value=900 --description='Priority class for core applications' || true")
cmd("minikube ssh -- 'sudo rm -rf /var/hostpath-provisioner/keycloak'")
cmd("minikube ssh -- 'sudo mkdir -p /var/hostpath-provisioner/keycloak/postgres-data'")
cmd("minikube ssh -- 'sudo mkdir -p /var/hostpath-provisioner/keycloak/themes-data'")
cmd("minikube ssh -- 'sudo mkdir -p /var/hostpath-provisioner/keycloak/standalone-deployments'")
cmd("minikube ssh -- 'sudo chmod -R 777 /var/hostpath-provisioner/keycloak/'")
cmd("sleep 10")
update_postgres_password("dep2_database.yaml", CONFIG.keycloak.db_password)
realm_config_file_private = "eucaim-node-realm.private.json"
keycloak_deploy_file = "dep3_keycloak_v4.yaml"
def update_keycloak_deployment(docs):
'''Update Keycloak deployment configuration'''
updated = False
for doc in docs:
if doc.get("kind") == "Deployment":
for env in doc["spec"]["template"]["spec"]["containers"][0].get("env", []):
if env.get("name") == "KC_BOOTSTRAP_ADMIN_USERNAME":
env["value"] = CONFIG.keycloak.admin_username
updated = True
elif env.get("name") == "KC_BOOTSTRAP_ADMIN_PASSWORD":
env["value"] = CONFIG.keycloak.admin_password
updated = True
elif env.get("name") == "KC_DB_PASSWORD":
env["value"] = CONFIG.keycloak.db_password
updated = True
elif env.get("name") == "KC_SPI_EVENTS_LISTENER_EMAIL_TO_ADMIN_EMAIL_RECEIVERS":
env["value"] = CONFIG.keycloak.admin_emails
updated = True
elif env.get("name") == "KC_HOSTNAME":
env["value"] = CONFIG.public_domain
updated = True
if not any("--import-realm" in str(param) for param in doc["spec"]["template"]["spec"]["containers"][0].get("args", [])):
doc["spec"]["template"]["spec"]["containers"][0]["args"].append("--import-realm")
updated = True
if not any(mount["subPath"] == realm_config_file_private for mount in doc["spec"]["template"]["spec"]["containers"][0]["volumeMounts"]):
doc["spec"]["template"]["spec"]["containers"][0]["volumeMounts"].append({
"name": "vol-standalone-deployments",
"subPath": realm_config_file_private,
"mountPath": "/opt/keycloak/data/import/" + realm_config_file_private
})
updated = True
return updated
result = update_yaml_config(keycloak_deploy_file, update_keycloak_deployment)
if result:
# If result is a string, it's the edited file path
keycloak_deploy_file = result if isinstance(result, str) else keycloak_deploy_file
print(f"Injected config values into {keycloak_deploy_file}")
# OLD CODE (commented for safety):
# with open(keycloak_deploy_file) as f:
# docs = list(yaml.safe_load_all(f))
# updated = False
# for doc in docs:
# if doc.get("kind") == "Deployment":
# for env in doc["spec"]["template"]["spec"]["containers"][0].get("env", []):
# if env.get("name") == "KC_BOOTSTRAP_ADMIN_USERNAME":
# env["value"] = CONFIG.keycloak.admin_username
# updated = True
# elif env.get("name") == "KC_BOOTSTRAP_ADMIN_PASSWORD":
# env["value"] = CONFIG.keycloak.admin_password
# updated = True
# elif env.get("name") == "KC_DB_PASSWORD":
# env["value"] = CONFIG.keycloak.db_password
# updated = True
# elif env.get("name") == "KC_SPI_EVENTS_LISTENER_EMAIL_TO_ADMIN_EMAIL_RECEIVERS":
# env["value"] = CONFIG.keycloak.admin_emails
# updated = True
# elif env.get("name") == "KC_HOSTNAME":
# env["value"] = CONFIG.public_domain
# updated = True
#
# if not any("--import-realm" in str(param) for param in doc["spec"]["template"]["spec"]["containers"][0].get("args", [])):
# doc["spec"]["template"]["spec"]["containers"][0]["args"].append("--import-realm")
# updated = True
#
# if not any(mount["subPath"] == realm_config_file_private for mount in doc["spec"]["template"]["spec"]["containers"][0]["volumeMounts"]):
# doc["spec"]["template"]["spec"]["containers"][0]["volumeMounts"].append({
# "name": "vol-standalone-deployments",
# "subPath": realm_config_file_private,
# "mountPath": "/opt/keycloak/data/import/" + realm_config_file_private
# })
# updated = True
# if updated:
# with open(keycloak_deploy_file, 'w') as f:
# yaml.safe_dump_all(docs, f, sort_keys=False)
# print(f"Injected config values into {keycloak_deploy_file}")
# Verify namespace is ready before applying resources
print("Verifying namespace is ready...")
cmd("minikube kubectl -- get namespace keycloak")
# Apply PVC manifests for dataset-service if present (do not replace storageClassName)
# Always ensure Keycloak volumes (PV + namespaced PVCs) are applied when available
# This creates the Keycloak PVs and the namespaced PVCs like `postgres-data`.
if os.path.exists("dep0_volumes.yaml"):
print(" Applying dep0_volumes.yaml for Keycloak volumes (pv + pvc) — creating a private file with storageClassName='standard' and applying it")
# Read file and extract only PersistentVolumeClaim documents
try:
with open('dep0_volumes.yaml', 'r') as f:
docs = list(yaml.safe_load_all(f))
except Exception as e:
print(f" Warning: could not read dep0_volumes.yaml: {e}")
docs = []
# Update storageClassName to 'standard' for all PVCs
pvc_docs = [d for d in docs if isinstance(d, dict) and d.get("kind") == "PersistentVolumeClaim"]
for d in pvc_docs:
if "spec" not in d:
d["spec"] = {}
d["spec"]["storageClassName"] = "standard"
if "metadata" not in d:
d["metadata"] = {}
d["metadata"]["namespace"] = "keycloak"
# Save the updated PVCs to dep0_volumes.private.yaml
private_dep0 = "dep0_volumes.private.yaml"
try:
with open(private_dep0, "w") as pf:
yaml.safe_dump_all(pvc_docs, pf, sort_keys=False)
print(f" Created private volumes file: {private_dep0}")
except Exception as e:
print(f" Warning: could not write private file {private_dep0}: {e}")
# Apply the private file
cmd("minikube kubectl -- create namespace keycloak || true")
cmd(f"minikube kubectl -- apply -f {private_dep0}")
# Apply init volumes for keycloak if present
if os.path.exists("dep1_init_volumes.yaml"):
cmd("minikube kubectl -- apply -f dep1_init_volumes.yaml -n keycloak")
jar1_url = "https://github.com/chaimeleon-eu/keycloak-event-listener-email-to-admin/releases/download/v1.0.6/keycloak-event-listener-email-to-admin-1.0.6.jar"
jar2_url = "https://github.com/chaimeleon-eu/keycloak-required-action-user-validated/releases/download/v1.0.5/keycloak-required-action-user-validated-1.0.5.jar"
jar1_path = "/tmp/keycloak-event-listener-email-to-admin-1.0.6.jar"
jar2_path = "/tmp/keycloak-required-action-user-validated-1.0.5.jar"
print("Downloading Keycloak extension JARs...")
for jar_url, jar_path in [(jar1_url, jar1_path), (jar2_url, jar2_path)]:
max_retries = 5
success = False
for attempt in range(max_retries):
# Remove old file if exists
cmd(f"rm -f {jar_path}", exit_on_error=False)
# Try wget first (with increased timeout and retries)
print(f" Attempt {attempt + 1}/{max_retries}: Downloading {os.path.basename(jar_path)}...")
download_result = cmd(
f"wget --timeout=60 --tries=3 --retry-connrefused --waitretry=5 "
f"--user-agent='Mozilla/5.0' -O {jar_path} '{jar_url}'",
exit_on_error=False
)
# If wget fails, try curl as fallback
if download_result != 0:
print(f" wget failed, trying curl...")
download_result = cmd(
f"curl -L --max-time 60 --retry 3 --retry-delay 5 "
f"-A 'Mozilla/5.0' -o {jar_path} '{jar_url}'",
exit_on_error=False
)
if download_result == 0 and os.path.exists(jar_path):
# Verify file size (JARs should be > 5KB)
file_size = os.path.getsize(jar_path)
if file_size < 5000:
print(f" Downloaded file too small ({file_size} bytes), likely error page")
continue
# Verify it's a valid ZIP/JAR file
verify_result = cmd(f"unzip -t {jar_path} >/dev/null 2>&1", exit_on_error=False)
if verify_result == 0:
print(f" Downloaded and verified: {os.path.basename(jar_path)} ({file_size} bytes)")
success = True
break
else:
print(f" File corrupted (invalid ZIP/JAR)")
else:
print(f" Download failed")
# Wait before retry (exponential backoff)
if attempt < max_retries - 1:
wait_time = 2 ** attempt
print(f" Waiting {wait_time}s before retry...")
time.sleep(wait_time)
if not success:
print(f"\n WARNING: Could not download {os.path.basename(jar_path)} after {max_retries} attempts")
print(f" URL: {jar_url}")
print(f" Keycloak may not work properly without this extension")
print(f" You can manually download it later and copy to /var/hostpath-provisioner/keycloak/standalone-deployments/\n")
cmd("tar -czf /tmp/themes.tar.gz themes/")
cmd("minikube cp /tmp/themes.tar.gz minikube:/tmp/")
cmd("minikube ssh -- 'sudo tar -xzf /tmp/themes.tar.gz -C /var/hostpath-provisioner/keycloak/themes-data/ --strip-components=1'")
# Only copy JARs if they were successfully downloaded and validated
if os.path.exists(jar1_path) and os.path.getsize(jar1_path) > 0:
cmd(f"minikube cp {jar1_path} minikube:/var/hostpath-provisioner/keycloak/standalone-deployments/")
else:
print(f" Warning: Skipping corrupted JAR: {jar1_path}")
if os.path.exists(jar2_path) and os.path.getsize(jar2_path) > 0:
cmd(f"minikube cp {jar2_path} minikube:/var/hostpath-provisioner/keycloak/standalone-deployments/")
else:
print(f" Warning: Skipping corrupted JAR: {jar2_path}")
realm_config_file = os.path.join(SCRIPT_DIR, "eucaim-node-realm.json")
# Auto-copy realm template if missing
if not os.path.exists(realm_config_file):
source_realm = os.path.join(SCRIPT_DIR, "k8s-deploy-node", "keycloak", "eucaim-node-realm.json")
if os.path.exists(source_realm):
print(f" Copying realm template from k8s-deploy-node...")
import shutil
shutil.copy(source_realm, realm_config_file)
else:
raise FileNotFoundError(f"Realm template not found: {source_realm}")
realm_config_file_private_path = os.path.join(os.getcwd(), realm_config_file_private)
with open(realm_config_file, "rt") as fin:
with open(realm_config_file_private_path, "wt") as fout:
for line in fin:
l = line.replace("{{ PUBLIC_DOMAIN }}", CONFIG.public_domain)
l = l.replace("{{ IDP_LSRI_ENABLED }}", CONFIG.keycloak.idp_lsri.enabled)
l = l.replace("{{ IDP_LSRI_CLIENT_ID }}", CONFIG.keycloak.idp_lsri.client_id)
l = l.replace("{{ IDP_LSRI_CLIENT_SECRET }}", CONFIG.keycloak.idp_lsri.client_secret)
l = l.replace("{{ CLIENT_DATASET_SERVICE_SECRET }}", auth_client_secrets.CLIENT_DATASET_SERVICE_SECRET)
l = l.replace("{{ CLIENT_FEM_CLIENT_SECRET }}", auth_client_secrets.CLIENT_FEM_CLIENT_SECRET)
l = l.replace("{{ CLIENT_JOBMAN_SERVICE_SECRET }}", auth_client_secrets.CLIENT_JOBMAN_SERVICE_SECRET)
l = l.replace("{{ CLIENT_KUBERNETES_SECRET }}", auth_client_secrets.CLIENT_KUBERNETES_SECRET)
l = l.replace("{{ CLIENT_KUBERNETES_OPERATOR_SECRET }}", auth_client_secrets.CLIENT_KUBERNETES_OPERATOR_SECRET)
fout.write(l)
cmd(f"minikube cp {realm_config_file_private_path} minikube:/var/hostpath-provisioner/keycloak/standalone-deployments/")
cmd("minikube kubectl -- apply -f dep2_database.yaml -n keycloak")
cmd("minikube kubectl -- wait --for=condition=ready pod -l app=db -n keycloak --timeout=300s")
cmd("sleep 30")
cmd(f"minikube kubectl -- apply -f {keycloak_deploy_file} -n keycloak")
# Check if we should use Gateway API or traditional Ingress
use_gateway_api = getattr(CONFIG, 'use_gateway_api', True)
use_tls = (hasattr(CONFIG, 'letsencrypt') and
hasattr(CONFIG.letsencrypt, 'email') and
CONFIG.letsencrypt.email and
getattr(CONFIG, 'cert_manager_available', False))
if use_gateway_api:
# NEW: Gateway API with HTTPRoute - apply from YAML file
print(f"\n Configuring HTTPRoute for Keycloak (Gateway API)...")
# Verify Gateway API CRDs are installed
crd_check = cmd("minikube kubectl -- get crd httproutes.gateway.networking.k8s.io 2>/dev/null", exit_on_error=False)
if crd_check != 0:
print(" WARNING: Gateway API CRDs not installed yet")
else:
httproute_file = "dep4_httproute.yaml"
update_ingress_host(httproute_file, CONFIG.public_domain)
cmd(f"minikube kubectl -- apply -f {httproute_file}")
print(f" HTTPRoute applied for Keycloak at https://{CONFIG.public_domain}/auth")
else:
ingress_file = "dep4_ingress.yaml"
if not getattr(CONFIG, 'cert_manager_available', False):
print("Note: Using HTTP-only ingress (cert-manager not available)")
# Always use the same ingress file (no separate TLS ingress file)
update_ingress_host(ingress_file, CONFIG.public_domain)
print("Checking if ingress already exists...")
ingress_exists = cmd(f"minikube kubectl -- get ingress proxy-keycloak -n keycloak 2>/dev/null", exit_on_error=False)
if ingress_exists == 0:
print(" Ingress already exists - preserving to avoid certificate recreation")
else:
print("Creating new ingress...")
cmd(f"minikube kubectl -- apply -f {ingress_file} -n keycloak")
if use_tls:
print("TLS certificate will be automatically provisioned by cert-manager")
os.chdir("..")
def ensure_ingress_addon():
print("Checking minikube ingress addon...")
ret = cmd("minikube addons list | grep 'ingress' | grep 'enabled'", exit_on_error=False)
if ret != 0:
print("Enabling minikube ingress addon...")
cmd("minikube addons enable ingress")
print(" Ingress addon enabled")
cmd("minikube kubectl -- wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller --timeout=120s || true")
else:
print(" Ingress addon already enabled")
def install_traefik_gateway_api():
'''Install Traefik with Gateway API support (uses external traefik-values.yaml file)'''
prev_dir = os.getcwd()
try:
print("\n" + "="*80)
print(" Installing Traefik with Gateway API support")
print("="*80 + "\n")
# Check if Traefik is already installed
ret = cmd("helm list -n traefik 2>/dev/null | grep traefik", exit_on_error=False)
if ret == 0:
print(" Traefik already installed")
return
# Change to traefik directory
traefik_dir = os.path.join(SCRIPT_DIR, "k8s-deploy-node", "traefik")
os.chdir(traefik_dir)
# Create namespace
print("Creating traefik namespace...")
cmd("minikube kubectl -- create namespace traefik --dry-run=client -o yaml | minikube kubectl -- apply -f -")
# Add Traefik helm repo
print("Adding Traefik Helm repository...")
cmd("helm repo add traefik https://traefik.github.io/charts")
cmd("helm repo update")
# Install Traefik using values file
print("Installing Traefik via Helm (this may take a minute)...")
cmd(f"helm install traefik traefik/traefik -n traefik -f traefik-values.yaml --timeout=5m")
# Wait for pods to be ready
print("Waiting for Traefik pods to be ready...")
cmd("minikube kubectl -- wait --for=condition=ready pod -l app.kubernetes.io/name=traefik -n traefik --timeout=120s")
print("\n" + " Traefik installed successfully")
# Show GatewayClass
print("\nAvailable GatewayClasses:")
cmd("minikube kubectl -- get gatewayclass", exit_on_error=False)
print("\n INFO: Dashboard available at: http://localhost:9000/dashboard/")
print(" To access: kubectl port-forward -n traefik svc/traefik 9000:9000\n")
finally:
os.chdir(prev_dir)
def create_main_gateway(domain: str, use_tls: bool = True):
'''Create the main Gateway resource for Gateway API'''
print("\n" + "="*80)
print(f" Creating main Gateway for domain: {domain}")
print("="*80 + "\n")
# Sanitize domain for secret name (replace dots with dashes)
secret_name = domain.replace('.', '-') + '-tls'
gateway_yaml = (
"apiVersion: gateway.networking.k8s.io/v1\n"
"kind: Gateway\n"
"metadata:\n"
" name: main-gateway\n"
" namespace: default\n"
" annotations:\n"
' description: "Main Gateway for all services in the cluster"\n'
"spec:\n"
" gatewayClassName: traefik\n"
" listeners:\n"
" - name: http\n"
" protocol: HTTP\n"
" port: 80\n"
" allowedRoutes:\n"
" namespaces:\n"
" from: All\n"
)
if use_tls:
gateway_yaml += (
" - name: https\n"
" protocol: HTTPS\n"
" port: 443\n"
" tls:\n"
" mode: Terminate\n"
" certificateRefs:\n"
" - kind: Secret\n"
f" name: {secret_name}\n"
" namespace: default\n"
" allowedRoutes:\n"
" namespaces:\n"
" from: All\n"
)
# Write to temp file and apply
gateway_file = "/tmp/main-gateway.yaml"
with open(gateway_file, 'w') as f:
f.write(gateway_yaml)
print(f"Applying Gateway configuration...")
cmd(f"minikube kubectl -- apply -f {gateway_file}")
# Wait for gateway to be ready
print("Waiting for Gateway to be ready...")
time.sleep(5)
ret = cmd("minikube kubectl -- wait --for=condition=Programmed gateway/main-gateway -n default --timeout=60s", exit_on_error=False)
if ret == 0:
print(" Gateway is ready and programmed")
else:
print(" Gateway created (may take a moment to become ready)")
# Show gateway status
print("\nGateway status:")
cmd("minikube kubectl -- get gateway main-gateway -n default", exit_on_error=False)
print("\n Gateway created successfully\n")
def setup_gateway_or_ingress(use_gateway_api: bool = True):
'''Setup either Gateway API (Traefik) or traditional Ingress (nginx)'''
if use_gateway_api:
print("\n" + "="*80)
print(" Setting up Gateway API with Traefik")
print("="*80 + "\n")
install_traefik_gateway_api()
else:
print("\n" + "="*80)
print(" Setting up traditional Ingress (LEGACY)")
print("="*80 + "\n")
ensure_ingress_addon()
def update_ingress_host(ingress_file: str, domain: str):
'''Update the host in the ingress YAML file'''
import re
if not os.path.exists(ingress_file):
print(f" Ingress file {ingress_file} not found, skipping...")
return
with open(ingress_file, 'r') as f:
content = f.read()
# Replace host with the configured domain
content = re.sub(r'host:\s+[a-zA-Z0-9.-]+', f'host: {domain}', content)
# Replace domain in redirect URLs (for root path redirect ingress)
content = re.sub(
r'(https?://)[a-zA-Z0-9.-]+(/[a-zA-Z0-9-_/%.]*)',
rf'\1{domain}\2',
content
)
# Replace hostnames entries used by HTTPRoute resources.
content = re.sub(
r'(hostnames:\s*\[\s*")([^\"]+)("\s*\])',
rf'\1{domain}\3',
content
)
content = re.sub(
r'(hostnames:\s*\n\s*-\s*")([^\"]+)(")',
rf'\1{domain}\3',
content
)
content = re.sub(
r'(hostnames:\s*\n\s*-\s*)([A-Za-z0-9.-]+)',
rf'\1"{domain}"',
content
)
# Replace TLS hosts in several common YAML forms (inline list, block quoted, block unquoted)
content = re.sub(
r'(tls:\s*\n\s*-\s*hosts:\s*\[\s*")([^\"]+)("\s*\])',
rf'\1{domain}\3',
content
)
content = re.sub(
r'(tls:\s*\n\s*-\s*hosts:\s*\n\s*-\s*")([^\"]+)(")',
rf'\1{domain}\3',
content
)
content = re.sub(
r'(tls:\s*\n\s*-\s*hosts:\s*\n\s*-\s*)([A-Za-z0-9.-]+)',
rf'\1"{domain}"',
content
)
# Replace TLS secretName lines (simple, conservative replacement)
# This will replace any 'secretName: <value>' with the configured domain string.
content = re.sub(r'(^\s*secretName:\s*)([A-Za-z0-9._-]+)', rf'\1{domain}', content, flags=re.MULTILINE)
with open(ingress_file, 'w') as f:
f.write(content)
print(f" Updated {ingress_file} host to: {domain}")
def create_dataset_service_pvcs():
'''Create PVCs for dataset-service by applying the canonical 0-pvcs.yaml only.'''
print(" Applying dataset-service PVC manifest (0-pvcs-hostpath.yaml) ...")
pvcs_path = os.path.join(SCRIPT_DIR, "k8s-deploy-node", "dataset-service", "0-pvcs-hostpath.yaml")
# Ensure namespace exists
cmd("minikube kubectl -- create namespace dataset-service || true")
# Ensure all required host directories exist on the minikube VM before applying PVCs.
# The hostpath provisioner requires the directories to already exist or the pod will
# fail with "no such file or directory" (CreateContainerConfigError).
print(" Creating required host directories on minikube VM...")
dirs = [
"/var/hostpath-provisioner/dataset-service/postgres-data",
"/var/hostpath-provisioner/dataset-service/dataset-service-data",
"/var/hostpath-provisioner/dataset-service/datalake",
"/var/hostpath-provisioner/dataset-service/datasets",
]
for d in dirs:
cmd(f"minikube ssh -- 'sudo mkdir -p {d}'")
cmd("minikube ssh -- 'sudo chmod -R 777 /var/hostpath-provisioner/dataset-service/'")
print(" Host directories created.")
if not os.path.exists(pvcs_path):
print(f" Warning: PV manifest not found: {pvcs_path}")
return False
print(f" Applying PV/PVC manifest: {pvcs_path} to namespace dataset-service")
cmd(f"minikube kubectl -- apply -f {pvcs_path} -n dataset-service")
cmd("minikube kubectl -- get pvc -n dataset-service")
return True
def install_dataset_service(auth_client_secret: str):
if CONFIG is None:
raise Exception("CONFIG is None")
prev_dir = os.getcwd()
try:
dataset_dir = os.path.join(SCRIPT_DIR, "k8s-deploy-node", "dataset-service")
os.chdir(dataset_dir)
db_service_file = "1-db-service.yaml"
deployment_file = "2-dataset-service.yaml"
cmd("minikube kubectl -- create namespace dataset-service || true")
# Create PVCs first (this will auto-create PVs)
create_dataset_service_pvcs()
# Try to get the current kid from Keycloak JWKS
print(f" Attempting to fetch current kid from Keycloak JWKS...")
kid_rs256 = "UPDATE_ME_WITH_REAL_KID_FROM_JWKS" # Default placeholder
# Wait for Keycloak to be ready before fetching kid
print(f" Waiting for Keycloak to be ready...")
max_wait = 180 # 3 minutes
waited = 0
keycloak_ready = False
while waited < max_wait:
result = cmd_output(
"minikube kubectl -- get pods -n keycloak -l app=keycloak "
"-o jsonpath='{.items[0].status.conditions[?(@.type==\"Ready\")].status}' 2>/dev/null"
).strip()
if result in ("True", "'True'"):
print(f" Keycloak is ready (waited {waited}s)")
keycloak_ready = True
print(f" Waiting additional 10s for Keycloak to be fully ready...")
time.sleep(10)
break
time.sleep(5)
waited += 5
if waited % 30 == 0:
print(f" Still waiting for Keycloak... ({waited}s)")
if not keycloak_ready:
print(f" Keycloak not ready after {max_wait}s, will use placeholder kid")
try:
import requests
jwks_url = f"https://{CONFIG.public_domain}/auth/realms/EUCAIM-NODE/protocol/openid-connect/certs"
print(f" Fetching from: {jwks_url}")
response = requests.get(jwks_url, verify=False, timeout=10)
response.raise_for_status()
jwks_data = response.json()
# Find RS256 key
for key in jwks_data.get('keys', []):
if key.get('alg') == 'RS256':
kid_rs256 = key.get('kid')
print(f" Found RS256 kid from Keycloak: {kid_rs256}")
break
if kid_rs256 == "UPDATE_ME_WITH_REAL_KID_FROM_JWKS":
print(" No RS256 key found in JWKS, using placeholder")
except Exception as e:
print(f" Could not fetch kid from Keycloak: {e}")
print(f" Will use placeholder and update later")
# 1. Generate password and inject into POSTGRES_PASSWORD
result_db = update_postgres_password(db_service_file, CONFIG.postgres.db_password)
if result_db:
# If result is a string, it's the edited file path
db_service_file = result_db if isinstance(result_db, str) else db_service_file
def update_dataset_service_deployment(docs):
'''Update dataset-service deployment configuration'''
import json
updated = False
for doc in docs:
if doc.get("kind") == "Deployment":
containers = doc["spec"]["template"]["spec"]["containers"]
for container in containers:
for env in container.get("env", []):
if env.get("name") == "DATASET_SERVICE_CONFIG":
config_json = env["value"]
config = json.loads(config_json)
if "db" in config:
config["db"]["password"] = CONFIG.postgres.db_password
if "self" in config:
for key, value in config["self"].items():
if isinstance(value, str) and value == "XXXXXXXX":
config["self"][key] = generate_random_password(16)
if "auth" in config and "client" in config["auth"]:
config["auth"]["client"]["client_secret"] = auth_client_secret
# Update domain-dependent URLs (direct assignment with correct domain)
if "auth" in config:
# Update auth.token_validation fields
if "token_validation" in config["auth"]:
config["auth"]["token_validation"]["token_issuer_public_keys_url"] = \
f"https://{CONFIG.public_domain}/auth/realms/EUCAIM-NODE/protocol/openid-connect/certs"
config["auth"]["token_validation"]["issuer"] = \
f"https://{CONFIG.public_domain}/auth/realms/EUCAIM-NODE"
# Update auth.client.auth_url
if "client" in config["auth"]:
config["auth"]["client"]["auth_url"] = \
f"https://{CONFIG.public_domain}/auth/realms/EUCAIM-NODE/protocol/openid-connect/token"
# Update auth.admin_api.url
if "admin_api" in config["auth"]:
config["auth"]["admin_api"]["url"] = \
f"https://{CONFIG.public_domain}/auth/admin/realms/EUCAIM-NODE/"
# Update self URLs
if "self" in config:
config["self"]["root_url"] = f"https://{CONFIG.public_domain}/dataset-service"
config["self"]["dataset_link_format"] = \
f"https://{CONFIG.public_domain}/dataset-service/datasets/%s/details"
tracer_url = CONFIG.tracer.url if hasattr(CONFIG, 'tracer') and hasattr(CONFIG.tracer, 'url') and CONFIG.tracer.url else None
config = configure_tracer_service(config, tracer_url)
if "auth" in config and "token_validation" in config["auth"]:
config["auth"]["token_validation"]["kid"] = kid_rs256
if kid_rs256.startswith("UPDATE_ME") or kid_rs256 in ["KEYCLOAK_NOT_READY", "INVALID_JWKS_RESPONSE", "DOWNLOAD_FAILED", "NO_KEYS_FOUND"]:
print(f" Updated kid in config with placeholder: {kid_rs256}")
print(" You will need to update this manually once Keycloak is running")
else:
print(f" Updated kid in token validation config: {kid_rs256}")
else:
print(" Warning: Could not find auth.token_validation section in config")
env["value"] = json.dumps(config, indent=2)
updated = True
return updated
result = update_yaml_config(deployment_file, update_dataset_service_deployment)
if result:
# If result is a string, it's the edited file path
deployment_file = result if isinstance(result, str) else deployment_file
print(f"Injected password and random tokens into DATASET_SERVICE_CONFIG of {deployment_file}")
else:
print("Warning: Could not find DATASET_SERVICE_CONFIG to update password and tokens.")
# Apply resources
# Ensure kube-apiserver is responsive before applying (it may have restarted for OIDC config)
print(f" Waiting for kube-apiserver to be ready before applying manifests...")
api_waited = 0
while api_waited < 120:
api_ok = cmd_output("minikube kubectl -- get --raw=/healthz 2>/dev/null").strip()
if api_ok == "ok":
print(f" API server ready")
break
time.sleep(5)
api_waited += 5
if api_waited % 20 == 0:
print(f" Still waiting for API server... ({api_waited}s)")
else:
print(f" Warning: API server may not be ready, proceeding anyway")
cmd(f"minikube kubectl -- apply -f {db_service_file} -n dataset-service")
cmd("minikube kubectl -- apply -f 0-service-account.yaml -n dataset-service")
# Delete existing deployment to force recreation with new kid
print(f"\n Deleting existing dataset-service-backend deployment (if exists)...")
cmd("minikube kubectl -- delete deployment dataset-service-backend -n dataset-service --ignore-not-found=true")
# Wait a moment for the deployment to be fully deleted
print(f" Waiting for deployment deletion to complete...")
cmd("sleep 5")
# Apply the new deployment with updated configuration
print(f" Creating new dataset-service-backend deployment with updated kid...")
cmd(f"minikube kubectl -- apply -f {deployment_file} -n dataset-service")
# Check if we should use Gateway API or traditional Ingress
use_gateway_api = getattr(CONFIG, 'use_gateway_api', True)
if use_gateway_api:
# NEW: Gateway API with HTTPRoute - apply from YAML files
print(f"\n Configuring HTTPRoute for dataset-service (Gateway API)...")
# Apply HTTPRoute with Middleware (all in one file)
httproute_file = "3-httproute.yaml"
update_ingress_host(httproute_file, CONFIG.public_domain)
cmd(f"minikube kubectl -- apply -f {httproute_file}")
print(f" HTTPRoute applied for dataset-service at https://{CONFIG.public_domain}/dataset-service")
# Apply redirect HTTPRoute if needed
redirect_httproute_file = "4-httproute-redirect.yaml"
if os.path.exists(redirect_httproute_file):
update_ingress_host(redirect_httproute_file, CONFIG.public_domain)
cmd(f"minikube kubectl -- apply -f {redirect_httproute_file}")
print(" Redirect HTTPRoute applied")
else:
# LEGACY: Traditional Ingress (commented but functional)
print(f"\n Configuring ingress for dataset-service (LEGACY)...")
update_ingress_host("3-ingress.yaml", CONFIG.public_domain)
cmd("minikube kubectl -- apply -f 3-ingress.yaml -n dataset-service")
print(f" Ingress applied for dataset-service at https://{CONFIG.public_domain}/dataset-service")
redirect_ingress_file = "4-ingress-for-redirect-from-root-path.yaml"
if os.path.exists(redirect_ingress_file):
update_ingress_host(redirect_ingress_file, CONFIG.public_domain)
cmd("minikube kubectl -- apply -f 4-ingress-for-redirect-from-root-path.yaml -n dataset-service")
print(" Redirect ingress applied")
print(f"\n Waiting for dataset-service-backend deployment to be ready...")
cmd("minikube kubectl -- wait --for=condition=available --timeout=180s deployment/dataset-service-backend -n dataset-service || true")
finally:
os.chdir(prev_dir)
def install_dataset_explorer(CONFIG):
'''Build and deploy dataset-explorer UI to be served by dataset-service'''
print(f"\n{'='*80}")
print(" Installing Dataset Explorer UI")
print(f"{'='*80}\n")
dataset_explorer_dir = os.path.join(SCRIPT_DIR, "k8s-deploy-node", "dataset-explorer")
if not os.path.exists(dataset_explorer_dir):
print(f"Warning: dataset-explorer directory not found at {dataset_explorer_dir}")
return
prev_dir = os.getcwd()
try:
os.chdir(dataset_explorer_dir)
# Update config-mini-node.json with correct domain
print("Configuring dataset-explorer with domain settings...")
config_file = "config-mini-node.json"
if os.path.exists(config_file):
import json
import re
# Backup original file
backup_file = "config-mini-node.json.backup"
if not os.path.exists(backup_file):
cmd(f"cp {config_file} {backup_file}")
with open(config_file, 'r') as f:
raw = f.read()
domain = CONFIG.public_domain
# Detect ALL old node domains from the file (any https:// URL that is NOT
# a well-known external host and NOT the target domain).
external_hosts = {'github.com', 'zenodo.org', 'www.zenodo.org'}
old_domains = []
for m in re.finditer(r'https?://([a-zA-Z0-9._-]+)', raw):
host = m.group(1)
if host not in external_hosts and host != domain and host not in old_domains:
old_domains.append(host)
if old_domains:
for old_domain in old_domains:
print(f" Replacing old domain '{old_domain}' → '{domain}' in {config_file}")
raw = raw.replace(old_domain, domain)
else:
print(f" No old domain detected in {config_file}, skipping domain replacement")
# Replace any localhost references with the configured domain
if 'localhost' in raw: