Page MenuHomePhorge
Files F71538

co_update_keycloak.sh
hans (Hans)
Actions

Aangemaakt door
hans
Tue, Aug 25, 11:33 AM
Size
14 KB
Referenced Files
None
Abonnees
None

co_update_keycloak.sh
View Options

#!/bin/bash
# Keycloak update script for the Carta identity servers.
#
# Usage:
# co_update_keycloak.sh <production|development> <version>
#
# Both arguments are mandatory. There are no defaults: an unpinned version or an
# implied mode is how you end up with dev and prod on different builds.
#
# Required environment variables (no defaults, fail fast if missing):
# production -> KC_PROD_DB_PASSWORD
# development -> KC_DEV_DB_PASSWORD
# Set them in the environment or a root-only sourced secrets file, not here.
#
# -e: exit on any failing command. -u: unset variable is an error.
# -o pipefail: a pipeline fails if any stage fails.
set -euo pipefail
# ---------------------------------------------------------------------------
# Constants (single source of truth)
# ---------------------------------------------------------------------------
REMOTE_DB_HOST="h4.lead.nl"
SQLCMD="/opt/mssql-tools/bin/sqlcmd"
RELEASE_API="https://api.github.com/repos/keycloak/keycloak/releases/tags"
# Custom themes to carry over from the previous installation, by directory name.
# Empty means: use the themes shipped with the distribution and nothing else.
# Every entry is copied verbatim, so an entry that was built against an older
# Keycloak will break that older Keycloak's templates on the new server.
CUSTOM_THEMES=()
# Custom provider JARs to carry over, by file name. Empty means: none.
# A JAR built against an older Keycloak can still load and then misbehave, so
# verify the provider actually works after the build, not just that it starts.
# Any *.jar found in the old providers/ that is not listed here aborts the run,
# so a forgotten artefact is a stop, not a silent carry-over. Only JARs are
# considered: the distribution ships a providers/README.md of its own.
CUSTOM_PROVIDERS=()
# Theme directory names that would shadow a theme shipped inside the
# distribution. Copying one of these over is what breaks the admin console.
# Maintain this list when Keycloak adds a built-in theme.
RESERVED_THEME_NAMES=(base keycloak keycloak.v2 welcome)
# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------
echo_error_and_exit() {
echo "Error: $1" >&2
exit 1
}
get_user_consent() {
local message="$1"
read -r -p "$message [y/n]: " consent
if [[ "$consent" != "y" ]]; then
echo "User aborted operation."
exit 1
fi
}
require_command() {
command -v "$1" >/dev/null 2>&1 || echo_error_and_exit "Required command not found: $1"
}
# ---------------------------------------------------------------------------
# Arguments
# ---------------------------------------------------------------------------
if [[ $# -ne 2 ]]; then
echo_error_and_exit "Usage: $(basename "$0") <production|development> <version> (example: $(basename "$0") development 26.7.2)"
fi
mode="$1"
target_version="$2"
case "$mode" in
production)
BASE_NAME="keycloak"
REMOTE_DB_USER="KeyCloakAdmin"
REMOTE_DB_PASSWORD="${KC_PROD_DB_PASSWORD:?Set KC_PROD_DB_PASSWORD in the environment before running (production DB backup password)}"
;;
development)
BASE_NAME="keycloakdev"
REMOTE_DB_USER="KeyCloakDevAdmin"
REMOTE_DB_PASSWORD="${KC_DEV_DB_PASSWORD:?Set KC_DEV_DB_PASSWORD in the environment before running (development DB backup password)}"
;;
*)
echo_error_and_exit "Mode must be exactly 'production' or 'development', got '$mode'."
;;
esac
[[ "$target_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
|| echo_error_and_exit "Version must be a pinned release tag such as 26.7.2, got '$target_version'."
require_command curl
require_command jq
require_command unzip
require_command sha256sum
[[ -x "$SQLCMD" ]] || echo_error_and_exit "sqlcmd not found or not executable at $SQLCMD."
timestamp="$(date +'%Y%m%d_%H%M%S')"
destination_folder="/opt/$BASE_NAME"
previous_folder="/opt/$BASE_NAME.previous_$timestamp"
REMOTE_DB_NAME="$BASE_NAME"
REMOTE_BACKUP_PATH="/var/backups/$BASE_NAME/backup_$timestamp.bak"
SERVICE_NAME="$BASE_NAME"
work_folder="/var/tmp/$BASE_NAME/$timestamp"
zip_folder="$work_folder/zip"
installation_folder="$work_folder/install"
staging_folder="$installation_folder/keycloak-$target_version"
[[ -d "$destination_folder" ]] || echo_error_and_exit "Destination $destination_folder does not exist."
# State for the exit trap, so an abort does not leave the service down.
service_stopped="no"
deployed="no"
on_exit() {
local status=$?
[[ $status -eq 0 ]] && return
if [[ "$deployed" == "yes" ]]; then
echo "Aborted with $target_version already in place. Roll back with:" >&2
echo " sudo systemctl stop $SERVICE_NAME" >&2
echo " sudo mv $destination_folder /opt/$BASE_NAME.failed_$timestamp" >&2
echo " sudo mv $previous_folder $destination_folder" >&2
echo " sudo systemctl start $SERVICE_NAME" >&2
elif [[ "$service_stopped" == "yes" ]]; then
echo "Aborted before anything was replaced. Restarting the previous installation." >&2
sudo systemctl start "$SERVICE_NAME" \
|| echo "Failed to restart $SERVICE_NAME. Start it manually." >&2
fi
}
trap on_exit EXIT
# ---------------------------------------------------------------------------
# Preflight: everything that can be judged without touching the running server
# is judged here, so an abort costs no downtime.
# ---------------------------------------------------------------------------
validate_carry_over() {
local theme reserved provider existing name known allowed source_theme
for theme in "${CUSTOM_THEMES[@]}"; do
source_theme="$destination_folder/themes/$theme"
[[ -d "$source_theme" ]] \
|| echo_error_and_exit "Custom theme '$theme' not found in $destination_folder/themes."
for reserved in "${RESERVED_THEME_NAMES[@]}"; do
if [[ "$theme" == "$reserved" ]]; then
echo_error_and_exit "Custom theme '$theme' shadows a built-in theme. Rename it instead of overriding it."
fi
done
if [[ -d "$source_theme/META-INF" || -d "$source_theme/theme" ]]; then
echo_error_and_exit "Custom theme '$theme' looks like an unpacked JAR (contains META-INF/ or theme/). Deploy the JAR in providers/ or unpack it at the right level."
fi
done
shopt -s nullglob
for existing in "$destination_folder/providers/"*.jar; do
name="$(basename "$existing")"
known="no"
for allowed in "${CUSTOM_PROVIDERS[@]}"; do
if [[ "$name" == "$allowed" ]]; then
known="yes"
fi
done
if [[ "$known" != "yes" ]]; then
shopt -u nullglob
echo_error_and_exit "Unknown artefact in providers/: '$name'. Add it to CUSTOM_PROVIDERS or remove it, then run again."
fi
done
shopt -u nullglob
for provider in "${CUSTOM_PROVIDERS[@]}"; do
[[ -f "$destination_folder/providers/$provider" ]] \
|| echo_error_and_exit "Custom provider '$provider' not found in $destination_folder/providers."
done
if [[ ${#CUSTOM_THEMES[@]} -eq 0 ]]; then
echo "No custom themes configured; using the distribution themes."
fi
if [[ ${#CUSTOM_PROVIDERS[@]} -eq 0 ]]; then
echo "No custom providers configured."
fi
}
validate_carry_over
echo "Preflight passed."
echo "Mode: $mode"
echo "Target version: $target_version"
echo "Destination: $destination_folder"
echo "Installed version: $("$destination_folder/bin/kc.sh" --version 2>/dev/null | head -1 || echo 'unknown')"
echo
# ---------------------------------------------------------------------------
# Download and verify
# ---------------------------------------------------------------------------
get_user_consent "Do you want to download Keycloak $target_version?"
mkdir -p "$zip_folder" "$installation_folder"
release_json="$(curl -fsSL "$RELEASE_API/$target_version")" \
|| echo_error_and_exit "Release tag $target_version not found on GitHub."
asset_name="keycloak-$target_version.zip"
download_url="$(jq -r --arg n "$asset_name" '.assets[] | select(.name==$n) | .browser_download_url' <<<"$release_json")"
expected_digest="$(jq -r --arg n "$asset_name" '.assets[] | select(.name==$n) | .digest' <<<"$release_json")"
[[ -n "$download_url" && "$download_url" != "null" ]] \
|| echo_error_and_exit "Release $target_version has no asset named $asset_name."
[[ "$expected_digest" == sha256:* ]] \
|| echo_error_and_exit "Release $target_version publishes no sha256 digest for $asset_name; refusing to install unverified bytes."
zip_path="$zip_folder/$asset_name"
curl -fL "$download_url" -o "$zip_path" || echo_error_and_exit "Failed to download $download_url."
actual_sha="$(sha256sum "$zip_path" | cut -d' ' -f1)"
[[ "$actual_sha" == "${expected_digest#sha256:}" ]] \
|| echo_error_and_exit "Checksum mismatch for $asset_name. Expected ${expected_digest#sha256:}, got $actual_sha."
unzip -tq "$zip_path" || echo_error_and_exit "Downloaded archive is corrupt."
echo "Downloaded and verified $asset_name (sha256 $actual_sha)."
unzip -q "$zip_path" -d "$installation_folder" || echo_error_and_exit "Failed to extract $zip_path."
[[ -d "$staging_folder" ]] || echo_error_and_exit "Archive did not contain keycloak-$target_version."
# ---------------------------------------------------------------------------
# Stop the service, then back up. A copy taken while Keycloak is running is not
# consistent, and neither is a database backup that predates the last write.
# ---------------------------------------------------------------------------
get_user_consent "Do you want to stop $SERVICE_NAME and take backups?"
sudo systemctl stop "$SERVICE_NAME" || echo_error_and_exit "Failed to stop $SERVICE_NAME."
service_stopped="yes"
echo "Service $SERVICE_NAME stopped."
BACKUP_COMMAND="BACKUP DATABASE [$REMOTE_DB_NAME] TO DISK = N'$REMOTE_BACKUP_PATH' WITH NOFORMAT, NOINIT, NAME = N'$REMOTE_DB_NAME-full', SKIP, NOREWIND, NOUNLOAD, STATS = 10"
"$SQLCMD" -S "$REMOTE_DB_HOST" -U "$REMOTE_DB_USER" -P "$REMOTE_DB_PASSWORD" -Q "$BACKUP_COMMAND" \
|| echo_error_and_exit "Database backup failed on $REMOTE_DB_HOST."
echo "Database backed up to $REMOTE_BACKUP_PATH on $REMOTE_DB_HOST."
# ---------------------------------------------------------------------------
# Stage the new installation: config, curated themes, curated providers, logs.
# ---------------------------------------------------------------------------
cp -a "$destination_folder/conf/." "$staging_folder/conf/" \
|| echo_error_and_exit "Failed to copy conf/ into the staging folder."
echo "Copied conf/."
# The allow lists were validated in the preflight; here they are only copied.
for theme in "${CUSTOM_THEMES[@]}"; do
cp -a "$destination_folder/themes/$theme" "$staging_folder/themes/" \
|| echo_error_and_exit "Failed to copy theme '$theme'."
echo "Copied theme '$theme'."
done
for provider in "${CUSTOM_PROVIDERS[@]}"; do
cp -a "$destination_folder/providers/$provider" "$staging_folder/providers/" \
|| echo_error_and_exit "Failed to copy provider '$provider'."
echo "Copied provider '$provider'."
done
# Keep the logs. They are needed most on the day an upgrade goes wrong.
if [[ -d "$destination_folder/data/log" ]]; then
mkdir -p "$staging_folder/data"
cp -a "$destination_folder/data/log" "$staging_folder/data/" \
|| echo_error_and_exit "Failed to carry over data/log."
echo "Carried over data/log."
fi
sudo chown -R "$BASE_NAME:$BASE_NAME" "$staging_folder" \
|| echo_error_and_exit "Failed to set ownership on the staging folder."
# ---------------------------------------------------------------------------
# Deploy. The old installation is moved aside, not deleted, so a rollback is a
# move back rather than a restore from backup.
# ---------------------------------------------------------------------------
get_user_consent "Do you want to deploy $target_version to $destination_folder? (current install moves to $previous_folder)"
sudo mv "$destination_folder" "$previous_folder" || echo_error_and_exit "Failed to move the current installation aside."
sudo mv "$staging_folder" "$destination_folder" || echo_error_and_exit "Failed to move the new installation into place."
sudo chown -R "$BASE_NAME:$BASE_NAME" "$destination_folder" \
|| echo_error_and_exit "Failed to set ownership on $destination_folder."
deployed="yes"
echo "Deployed $target_version to $destination_folder."
# ---------------------------------------------------------------------------
# Build in both modes, so dev exercises the same code path as production.
# ---------------------------------------------------------------------------
get_user_consent "Do you want to run 'kc.sh build'?"
sudo -u "$BASE_NAME" "$destination_folder/bin/kc.sh" build || echo_error_and_exit "Keycloak build failed."
echo "Build completed."
# ---------------------------------------------------------------------------
# Start and verify
# ---------------------------------------------------------------------------
get_user_consent "Do you want to start $SERVICE_NAME?"
sudo systemctl start "$SERVICE_NAME" || echo_error_and_exit "Failed to start $SERVICE_NAME."
running_version="$("$destination_folder/bin/kc.sh" --version | head -1)"
grep -q "$target_version" <<<"$running_version" \
|| echo_error_and_exit "Deployed version does not report $target_version: $running_version"
echo "Service started. $running_version"
# ---------------------------------------------------------------------------
# Cleanup
# ---------------------------------------------------------------------------
get_user_consent "Do you want to remove the temporary files in $work_folder?"
rm -rf "$work_folder"
echo
echo "Done. Verify the login page, the admin console and a test login before you"
echo "remove the previous installation:"
echo " sudo rm -rf $previous_folder"
echo "Rollback, if needed:"
echo " sudo systemctl stop $SERVICE_NAME"
echo " sudo mv $destination_folder /opt/$BASE_NAME.failed_$timestamp"
echo " sudo mv $previous_folder $destination_folder"
echo " sudo systemctl start $SERVICE_NAME"

File Metadata

Mime Type
text/x-shellscript
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
61933
Default Alt Text
co_update_keycloak.sh (14 KB)

Event Timeline

Copyright © LEAD Solutions B.V.