Skip to content

Commit 53a2ac6

Browse files
awsimayaawsimaya
authored
Merge pull request #244 from aws-samples/keycloak-automation
Keycloak automation
2 parents 166ac3b + 4a94894 commit 53a2ac6

File tree

3 files changed

+869
-0
lines changed

3 files changed

+869
-0
lines changed

‎PetAdoptions/cdk/pet_stack/resources/load_balancer/iam_policy.json

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,41 @@
150150
}
151151
}
152152
},
153+
{
154+
"Effect": "Allow",
155+
"Action": [
156+
"elasticloadbalancing:AddTags",
157+
"elasticloadbalancing:RemoveTags"
158+
],
159+
"Resource": [
160+
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
161+
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
162+
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
163+
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
164+
]
165+
},
166+
{
167+
"Effect": "Allow",
168+
"Action": [
169+
"elasticloadbalancing:AddTags"
170+
],
171+
"Resource": [
172+
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
173+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
174+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
175+
],
176+
"Condition": {
177+
"StringEquals": {
178+
"elasticloadbalancing:CreateAction": [
179+
"CreateTargetGroup",
180+
"CreateLoadBalancer"
181+
]
182+
},
183+
"Null": {
184+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
185+
}
186+
}
187+
},
153188
{
154189
"Effect": "Allow",
155190
"Action": [

‎PetAdoptions/keycloak-cleanup.sh

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
#!/bin/bash
2+
#
3+
# Copyright 2023 Amazon.com, Inc. or its affiliates. All Rights Reserved.
4+
#
5+
# Permission is hereby granted, free of charge, to any person obtaining a copy of this
6+
# software and associated documentation files (the "Software"), to deal in the Software
7+
# without restriction, including without limitation the rights to use, copy, modify,
8+
# merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
9+
# permit persons to whom the Software is furnished to do so.
10+
#
11+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
12+
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
13+
# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
14+
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
15+
# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
16+
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
17+
#
18+
19+
#title keycloak-cleanup.sh
20+
#description This script cleans up keycloak related resources for Amazon Managed Grafana SAML authentication.
21+
#author Sourav Paul (@psour)
22+
#contributors @psour
23+
#date 2023-09-06
24+
#version 1.0
25+
#usage ./keycloak-cleanup.sh -c <EKS_CLUSTER_NAME> [-n|--keycloak-namespace <KEYCLOAK_NAMESPACE>] [-h|--help]
26+
#==============================================================================
27+
28+
echo ---------------------------------------------------------------------------------------------
29+
echo "This script cleans up keycloak related resources for Amazon Managed Grafana SAML authentication."
30+
echo ---------------------------------------------------------------------------------------------
31+
32+
#### Resolve command line arguments
33+
POSITIONAL_ARGS=()
34+
35+
while [[ $# -gt 0 ]]; do
36+
case $1 in
37+
-c|--cluster-name)
38+
CLUSTER_NAME="$2"
39+
shift # past argument
40+
shift # past value
41+
;;
42+
-n|--keycloak-namespace)
43+
KEYCLOAK_NAMESPACE="$2"
44+
shift # past argument
45+
shift # past value
46+
;;
47+
-h|--help)
48+
SHOW_HELP=YES
49+
shift # past argument
50+
;;
51+
-*|--*)
52+
echo "Unknown option $1"
53+
exit 1
54+
;;
55+
*)
56+
POSITIONAL_ARGS+=("$1") # save positional arg
57+
shift # past argument
58+
;;
59+
esac
60+
done
61+
62+
#### Functions
63+
function print_usage() {
64+
echo ""
65+
echo "Options:"
66+
echo " -c, --cluster-name string Amazon EKS cluster name"
67+
echo " -n, --keycloak-namespace string Namespace for keycloak (default keycloak)"
68+
echo " -h, --help Show this help message"
69+
}
70+
71+
function handle_error() {
72+
echo ""
73+
echo $1
74+
echo ""
75+
echo "Exiting script with code: $2..."
76+
exit $2
77+
}
78+
79+
function handle_error_with_usage() {
80+
echo ""
81+
echo $1
82+
echo ""
83+
echo "Printing help..."
84+
print_usage
85+
echo ""
86+
echo "Exiting script with code: $2..."
87+
echo ""
88+
exit $2
89+
}
90+
91+
function handle_arg_help() {
92+
if [ "$SHOW_HELP" = "YES" ]; then
93+
print_usage
94+
exit 0
95+
fi
96+
}
97+
98+
function validate_arg_cluster_name() {
99+
if [ -z "$CLUSTER_NAME" ]; then
100+
handle_error_with_usage "ERROR: Amazon EKS cluster name is required." 2
101+
fi
102+
}
103+
104+
function resolve_arg_keycloak_namespace() {
105+
if [ -z "$KEYCLOAK_NAMESPACE" ]; then
106+
KEYCLOAK_NAMESPACE=keycloak
107+
fi
108+
}
109+
110+
function print_script_arguments() {
111+
echo ""
112+
echo "Script arguments:"
113+
echo "---------------------------------------------------------------------------------------------"
114+
echo " CLUSTER_NAME........$CLUSTER_NAME"
115+
echo " KEYCLOAK_NAMESPACE..$KEYCLOAK_NAMESPACE"
116+
echo "---------------------------------------------------------------------------------------------"
117+
echo ""
118+
}
119+
120+
function locate_eks_cluster() {
121+
echo "Searching Amazon EKS cluster with name '$CLUSTER_NAME'..."
122+
CLUSTER_META=$(aws eks describe-cluster --name $CLUSTER_NAME)
123+
CMD_RESULT=$?
124+
if [ -z "$CLUSTER_META" ] || [ $CMD_RESULT -ne 0 ] ; then
125+
handle_error "ERROR: Could not locate Amazon EKS cluster with name '$CLUSTER_NAME'. Please check error message." 3
126+
fi
127+
echo "Found Amazon EKS cluster."
128+
}
129+
130+
function uninstall_keycloak() {
131+
echo "Uninstalling application 'keycloak'..."
132+
helm uninstall keycloak --namespace $KEYCLOAK_NAMESPACE
133+
CMD_RESULT=$?
134+
if [ $CMD_RESULT -ne 0 ]; then
135+
handle_error "ERROR: Failed to uninstall application 'keycloak'." 4
136+
fi
137+
138+
echo "Deleting namespace '$KEYCLOAK_NAMESPACE'..."
139+
kubectl delete ns $KEYCLOAK_NAMESPACE
140+
CMD_RESULT=$?
141+
if [ $CMD_RESULT -ne 0 ]; then
142+
handle_error "ERROR: Failed to delete namespce '$KEYCLOAK_NAMESPACE'." 5
143+
fi
144+
}
145+
146+
function remove_helm_repo() {
147+
echo "Removing helm repo 'bitnami'..."
148+
helm repo remove bitnami
149+
CMD_RESULT=$?
150+
if [ $CMD_RESULT -ne 0 ]; then
151+
handle_error "ERROR: Failed to remove helm repo 'bitnami'." 6
152+
fi
153+
}
154+
155+
function uninstall_ebs_csi_driver_addon() {
156+
echo "Deleting EBS StorageClass..."
157+
kubectl delete -f storageclass.yaml
158+
CMD_RESULT=$?
159+
if [ $CMD_RESULT -ne 0 ]; then
160+
handle_error "ERROR: Failed to delete EBS StorageClass." 7
161+
fi
162+
163+
echo "Uninstalling EBS CSI driver addon from cluster..."
164+
eksctl delete addon \
165+
--name aws-ebs-csi-driver \
166+
--cluster $CLUSTER_NAME
167+
CMD_RESULT=$?
168+
if [ $CMD_RESULT -ne 0 ]; then
169+
handle_error "ERROR: Failed to uninstall EBS CSI driver addon from cluster." 8
170+
fi
171+
172+
echo "Waiting for EBS CSI driver addon deletion to complete..."
173+
aws eks wait addon-deleted \
174+
--cluster-name $CLUSTER_NAME \
175+
--addon-name aws-ebs-csi-driver
176+
CMD_RESULT=$?
177+
if [ $CMD_RESULT -ne 0 ]; then
178+
handle_error "ERROR: Failed to wait for EBS CSI driver addon deletion to complete." 9
179+
fi
180+
181+
echo "Deleting IRSA for EBS CSI driver addon..."
182+
eksctl delete iamserviceaccount \
183+
--name ebs-csi-controller-sa \
184+
--namespace kube-system \
185+
--cluster $CLUSTER_NAME
186+
CMD_RESULT=$?
187+
if [ $CMD_RESULT -ne 0 ]; then
188+
handle_error "ERROR: Failed to delete IRSA for EBS CSI driver addon." 10
189+
fi
190+
}
191+
192+
#### Main ####
193+
194+
handle_arg_help
195+
196+
validate_arg_cluster_name
197+
198+
resolve_arg_keycloak_namespace
199+
200+
print_script_arguments
201+
202+
locate_eks_cluster
203+
204+
uninstall_keycloak
205+
206+
remove_helm_repo
207+
208+
uninstall_ebs_csi_driver_addon
209+
210+
echo ""
211+
echo "Cleanup done."

0 commit comments

Comments
 (0)