gen_secrets.sh

#!/usr/bin/env bash
# gen_secrets.sh — create/rotate per-federation secrets without leaking to logs
# - Per federation:   keycloak-credentials (client-id/client-secret), mip-secret (autogenerated),
#                     jupyterhub-crypt (autogenerated)
# - Common (mip-athena): codex-llm (Jupyter AI server URL, from CODEX_VLLM_BASE_URL
#                     or a hidden prompt; skipped when empty)
# - Common (datacatalog): datacatalog-secrets (keycloak + DB creds)
# - Skips existing secrets; use --force to rotate
# - Prompts show the target federation; client-secret input is hidden
# - No secrets printed to stdout/stderr; no inline --from-literal

set -euo pipefail

# ----------------------------- flags / config ---------------------------------
FORCE_UPDATE="${FORCE_UPDATE:-0}"
if [[ "${1:-}" == "-f" || "${1:-}" == "--force" ]]; then
  FORCE_UPDATE=1
  shift || true
fi

# Hide client-id prompt as well (default shows it so you can see typos)
KC_HIDE_ID="${KC_HIDE_ID:-0}"

# kubectl options (safe defaults); adjust if needed
KUBECTL_OPTS="${KUBECTL_OPTS:---request-timeout=20s}"

# Per-apply timeout (if coreutils `timeout` exists)
APPLY_TIMEOUT="${APPLY_TIMEOUT:-25s}"
if command -v timeout >/dev/null 2>&1; then
  TIMEOUT_CMD=(timeout -k 3s "${APPLY_TIMEOUT}")
else
  TIMEOUT_CMD=()  # no timeout available; kubectl will run normally
fi

# ------------------------------ safety settings -------------------------------
# Remember xtrace state and disable tracing while handling secrets
XTRACE_STATE="$(set +o | grep xtrace || true)"
set +x

# Default perms for any files we create: files 600, dirs 700
umask 077

# -------------------------------- helpers -------------------------------------
gen_password() {
  # Generate a 24-char alphanumeric string.
  # Temporarily disable pipefail so SIGPIPE from upstream is ignored.
  local pw rc
  set +o pipefail
  pw="$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c24)"
  rc=$?
  set -o pipefail
  if [[ $rc -ne 0 || -z "$pw" ]]; then
    echo "failed to generate password" >&2
    exit 1
  fi
  printf '%s' "$pw"
}

secret_exists() { # $1=ns, $2=name
  kubectl ${KUBECTL_OPTS} -n "$1" get secret "$2" >/dev/null 2>&1
}

prompt_visible() { # $1=var, $2=prompt
  local __var="$1" __msg="$2" __val=""
  if [[ "${KC_HIDE_ID}" == "1" ]]; then
    read -r -s -p "$__msg" __val </dev/tty; echo >/dev/tty
  else
    read -r -p "$__msg" __val </dev/tty
  fi
  printf -v "$__var" '%s' "$__val"
}

prompt_secret() { # $1=var, $2=prompt
  local __var="$1" __msg="$2" __val=""
  read -r -s -p "$__msg" __val </dev/tty; echo >/dev/tty
  printf -v "$__var" '%s' "$__val"
}

mkpriv() {
  local base="/dev/shm"
  [[ -d "$base" && -w "$base" ]] || base="${TMPDIR:-/tmp}"
  mktemp "$base/mipsec.XXXXXX"
}

secure_rm() {
  command -v shred >/dev/null 2>&1 && shred -u "$1" || rm -f "$1"
}

apply_yaml_file() { # $1=ns, $2=path
  local ns="$1" f="$2" rc=0
  set +e
  "${TIMEOUT_CMD[@]}" kubectl ${KUBECTL_OPTS} -n "$ns" apply -o name -f "$f"
  rc=$?
  set -e
  return "$rc"
}

# -------------------------- discover federation namespaces --------------------
readarray -t FED_NS < <(kubectl ${KUBECTL_OPTS} get ns \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | grep '^federation-' || true)

echo "[info] Found ${#FED_NS[@]} federation namespaces: ${FED_NS[*]:-<none>}"

# -------------------------- common datacatalog-secrets -------------------------
# Creates/rotates: mip-common-datacatalog/datacatalog-secrets
# stringData:
#   keycloak.client-id
#   keycloak.client-secret
#   db.user
#   db.password
if secret_exists "mip-common-datacatalog" "datacatalog-secrets" && [[ "$FORCE_UPDATE" -eq 0 ]]; then
  echo "[skip] mip-common-datacatalog/datacatalog-secrets exists."
else
  # Allow env to pre-seed; otherwise, prompt (hide secrets; KC_HIDE_ID respected for client-id)
  [[ -z "${COMMON_KC_CLIENT_ID:-}"     ]] && prompt_visible COMMON_KC_CLIENT_ID     "Keycloak client-id for mip-common-datacatalog: "
  [[ -z "${COMMON_KC_CLIENT_SECRET:-}" ]] && prompt_secret  COMMON_KC_CLIENT_SECRET "Keycloak client-secret for mip-common-datacatalog: "
  if [[ -z "${COMMON_DB_USER:-}" ]]; then
    COMMON_DB_USER="$(gen_password)"
    COMMON_DB_PASSWORD="$(gen_password)"
  fi
  if [[ -z "${COMMON_KC_CLIENT_ID:-}" || -z "${COMMON_KC_CLIENT_SECRET:-}" || -z "${COMMON_DB_USER:-}" || -z "${COMMON_DB_PASSWORD:-}" ]]; then
    echo "[err] missing datacatalog client-id/secret or DB user/password; aborting." >&2
    exit 1
  fi

  f=$(mkpriv)
  cat >"$f" <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: datacatalog-secrets
type: Opaque
stringData:
  keycloak.client-id: ${COMMON_KC_CLIENT_ID}
  keycloak.client-secret: ${COMMON_KC_CLIENT_SECRET}
  db.user: ${COMMON_DB_USER}
  db.password: ${COMMON_DB_PASSWORD}
EOF
  if apply_yaml_file "mip-common-datacatalog" "$f"; then
    echo "[ok ] mip-common-datacatalog/datacatalog-secrets"
  else
    echo "[err] mip-common-datacatalog/datacatalog-secrets" >&2
  fi
  secure_rm "$f"
    unset COMMON_KC_CLIENT_ID COMMON_KC_CLIENT_SECRET
fi

# -------------------------- mip-athena/codex-llm -------------------------------
# Jupyter AI (Codex) inference server URL, key base-url, read only by the shared
# athena-proxy (common/athena-proxy). The namespace is created by Argo CD when
# that app syncs. Optional: without it Codex is off.
if ! kubectl ${KUBECTL_OPTS} get ns mip-athena >/dev/null 2>&1; then
  echo "[skip] mip-athena/codex-llm: namespace mip-athena does not exist yet."
elif secret_exists "mip-athena" "codex-llm" && [[ "$FORCE_UPDATE" -eq 0 ]]; then
  echo "[skip] mip-athena/codex-llm exists."
else
  [[ -z "${CODEX_VLLM_BASE_URL:-}" ]] && prompt_secret CODEX_VLLM_BASE_URL "Codex server URL ending in /v1 (empty to skip): "
  if [[ -z "${CODEX_VLLM_BASE_URL:-}" ]]; then
    echo "[skip] mip-athena/codex-llm (no URL given)."
  else
    f=$(mkpriv)
    cat >"$f" <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: codex-llm
type: Opaque
stringData:
  base-url: ${CODEX_VLLM_BASE_URL}
EOF
    if apply_yaml_file "mip-athena" "$f"; then
      echo "[ok ] mip-athena/codex-llm"
    else
      echo "[err] mip-athena/codex-llm" >&2
    fi
    secure_rm "$f"
  fi
fi

# -------------------------- per-federation secrets ----------------------------
for ns in "${FED_NS[@]}"; do
  echo ">> Namespace: ${ns}"

  # --- keycloak-credentials per federation (prompt only if creating/forcing) ---
  if secret_exists "$ns" "keycloak-credentials" && [[ "$FORCE_UPDATE" -eq 0 ]]; then
    echo "   [skip] ${ns}/keycloak-credentials exists."
  else
    local_id=""; local_secret=""
      prompt_visible local_id     "   Keycloak client-id for ${ns}: "
      prompt_secret  local_secret "   Keycloak client-secret for ${ns}: "
    if [[ -z "$local_id" || -z "$local_secret" ]]; then
      echo "   [err] missing client-id/secret for ${ns}; skipping."
    else
      f=$(mkpriv)
      cat >"$f" <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: keycloak-credentials
type: Opaque
stringData:
  client-id: ${local_id}
  client-secret: ${local_secret}
EOF
      if apply_yaml_file "$ns" "$f"; then
        echo "   [ok ] ${ns}/keycloak-credentials"
      else
        echo "   [err] ${ns}/keycloak-credentials" >&2
      fi
      secure_rm "$f"
    fi
  fi

  # --- mip-secret per federation (generate or rotate) --------------------------
  if secret_exists "$ns" "mip-secret" && [[ "$FORCE_UPDATE" -eq 0 ]]; then
    echo "   [skip] ${ns}/mip-secret exists."
  else
    echo "   [gen] ${ns}/mip-secret …"
    # Fixed values for now
    PB_ADMIN_USER="postgres"
    PB_USER="portal"

    # Autogenerated passwords
    PB_ADMIN_PASS="$(gen_password)"
    PB_PASS="$(gen_password)"

    f=$(mkpriv)
    cat >"$f" <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: mip-secret
type: Opaque
stringData:
  platform-backend-db.DB_ADMIN_USER: ${PB_ADMIN_USER}
  platform-backend-db.DB_ADMIN_PASSWORD: ${PB_ADMIN_PASS}
  platform-backend-db.PLATFORM_DB_USER: ${PB_USER}
  platform-backend-db.PLATFORM_DB_PASSWORD: ${PB_PASS}
EOF
    if apply_yaml_file "$ns" "$f"; then
      echo "   [ok ] ${ns}/mip-secret"
    else
      echo "   [err] ${ns}/mip-secret" >&2
    fi
    secure_rm "$f"
  fi

  # --- jupyterhub-crypt per federation (generate or rotate) --------------------
  # JupyterHub auth_state encryption key (madgik/mip notebook). Kept out of the
  # chart values so it stays stable across syncs; rotating it only drops stored
  # auth state, users log in again.
  if secret_exists "$ns" "jupyterhub-crypt" && [[ "$FORCE_UPDATE" -eq 0 ]]; then
    echo "   [skip] ${ns}/jupyterhub-crypt exists."
  else
    f=$(mkpriv)
    cat >"$f" <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: jupyterhub-crypt
type: Opaque
stringData:
  crypt-key: $(openssl rand -hex 32)
EOF
    if apply_yaml_file "$ns" "$f"; then
      echo "   [ok ] ${ns}/jupyterhub-crypt"
    else
      echo "   [err] ${ns}/jupyterhub-crypt" >&2
    fi
    secure_rm "$f"
  fi
done

# ------------------------------ restore xtrace --------------------------------
eval "$XTRACE_STATE"