mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
fix(web-app-gitea): delegate ldap/oidc auth exec to host node
In swarm the ldap/oidc setup+cleanup 'container exec' tasks used
GITEA_CONTAINER_ADDRESS (a swarm-wide-resolved container id) and ran on
the manager without delegation. When gitea is scheduled on a worker,
'docker exec' is node-local, so the manager's daemon can't see that
container -> 'No such container', failing the deploy.
Bring these tasks to parity with the DB/manager-ops tasks (commit
6a5cf7b66): use GITEA_LOCAL_CID + delegate_to GITEA_HOST_NODE (facts
already set by resolve_host_cid.yml in 01_manager_ops before setup/
cleanup run), with the container-exec-resolver nocheck marker. Applies
to every exec incl. the id-lookup steps, else idempotency/cleanup
misfire on worker placement.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
kevinveenbirkenbachandClaude Opus 4.8 committed
1 parent
62e763e3de
commit
99bc9a94d9
4 files changed
+30
-20
No files matched your search
@@ -1,17 +1,19 @@
|
||||
---
|
||||
- name: "🔍 Lookup existing LDAP auth source ID"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth list \
|
||||
| awk -v name="LDAP ({{ SOFTWARE_NAME }})" '$0 ~ name {print $1; exit}'
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
register: ldap_source_id_raw
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: "🗑️ Delete existing LDAP auth source if present"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth delete --id {{ ldap_source_id_raw.stdout }}
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
when: ldap_source_id_raw.stdout != ""
|
||||
register: ldap_delete
|
||||
failed_when: ldap_delete.rc != 0
|
||||
@@ -1,17 +1,19 @@
|
||||
---
|
||||
- name: "🔍 Lookup existing OIDC auth source ID"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth list \
|
||||
| awk -v name="{{ OIDC.BUTTON_TEXT }}" '$0 ~ name {print $1; exit}'
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
register: oidc_source_id_raw
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: "🗑️ Delete existing OIDC auth source if present"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth delete --id {{ oidc_source_id_raw.stdout }}
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
when: oidc_source_id_raw.stdout != ""
|
||||
register: oidc_delete
|
||||
failed_when: oidc_delete.rc != 0
|
||||
@@ -1,19 +1,21 @@
|
||||
---
|
||||
- name: "➕ Add LDAP Authentication Source"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth add-ldap \
|
||||
{{ GITEA_LDAP_AUTH_ARGS | join(' ') }}
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
register: ldap_manage
|
||||
failed_when: ldap_manage.rc != 0 and not (ldap_manage.stderr | gitea_auth_noop)
|
||||
|
||||
- name: "🔍 Lookup existing LDAP auth source ID"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth list \
|
||||
| tail -n +2 \
|
||||
| grep -F "LDAP ({{ DOMAIN_PRIMARY }})" \
|
||||
| awk '{print $1; exit}'
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
register: ldap_source_id_raw
|
||||
failed_when:
|
||||
- ldap_source_id_raw.rc != 0
|
||||
@@ -25,10 +27,11 @@
|
||||
ldap_source_id: "{{ ldap_source_id_raw.stdout }}"
|
||||
|
||||
- name: "🔄 Update LDAP Authentication Source"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth update-ldap \
|
||||
--id {{ ldap_source_id }} \
|
||||
{{ GITEA_LDAP_AUTH_ARGS | join(' ') }}
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
register: ldap_manage
|
||||
failed_when: ldap_manage.rc != 0
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
- name: "➕ Add Keycloak OIDC Provider"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth add-oauth \
|
||||
--provider openidConnect \
|
||||
--name "{{ OIDC.BUTTON_TEXT }}" \
|
||||
@@ -9,16 +9,18 @@
|
||||
--secret "{{ OIDC.CLIENT.SECRET }}" \
|
||||
--auto-discover-url "{{ OIDC.CLIENT.DISCOVERY_DOCUMENT }}" \
|
||||
--scopes "openid profile email"
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
register: oidc_manage
|
||||
failed_when: oidc_manage.rc != 0 and not (oidc_manage.stderr | gitea_auth_noop)
|
||||
|
||||
- name: "🔍 Lookup existing Keycloak auth source ID"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
/app/gitea/gitea admin auth list \
|
||||
| tail -n +2 \
|
||||
| grep -F "{{ OIDC.BUTTON_TEXT }}" \
|
||||
| awk '{print $1; exit}'
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
register: oidc_source_id_raw
|
||||
failed_when:
|
||||
- oidc_source_id_raw.rc != 0
|
||||
@@ -30,8 +32,8 @@
|
||||
oidc_source_id: "{{ oidc_source_id_raw.stdout }}"
|
||||
|
||||
- name: "🔄 Update Keycloak OIDC Provider"
|
||||
shell: |
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_CONTAINER_ADDRESS }} \
|
||||
shell: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
||||
container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
|
||||
gitea admin auth update-oauth \
|
||||
--id {{ oidc_source_id }}\
|
||||
--provider openidConnect \
|
||||
@@ -40,5 +42,6 @@
|
||||
--secret "{{ OIDC.CLIENT.SECRET }}" \
|
||||
--auto-discover-url "{{ OIDC.CLIENT.DISCOVERY_DOCUMENT }}" \
|
||||
--scopes "openid profile email"
|
||||
delegate_to: "{{ GITEA_HOST_NODE }}"
|
||||
register: oidc_manage
|
||||
failed_when: oidc_manage.rc != 0
|
||||
Reference in new issue
Block a user