platform/sicabe-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix aiflow-keycloak problem

Browse Source
This commit is contained in:
subroto
2026-10-11 20:10:01 +07:00
parent 9f454b6e8e
commit 9ddc4f0585
3 changed files with 29 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/bootstrap.sh
+3 -1
View File
@@ -237,7 +237,9 @@ bootstrap_keycloak() {
["trino"]="https TRINO_HOST TRINO_HTTPS_PORT 12443"
["grafana"]="http GRAFANA_HOST GRAFANA_PORT 12300"
["openmetadata"]="http OPENMETADATA_HOST OPENMETADATA_PORT 12085"
["airflow"]="http AIRFLOW_HOST AIRFLOW_PORT 12082"
# AIRFLOW_WEBSERVER_HOST (BUKAN AIRFLOW_HOST — itu penanda external, tak diisi
# generator → _comp_addr jatuh ke SICABE_HOST_ADDRESS/localhost).
["airflow"]="http AIRFLOW_WEBSERVER_HOST AIRFLOW_PORT 12082"
["starrocks"]="http STARROCKS_FE_HOST STARROCKS_HTTP_PORT 12030"
)
_comp_addr() { # <host_var> → alamat efektif (IP/alamat, atau host ini bila co-located)
deploy/scripts/test-generate.sh
+17 -1
View File
@@ -216,7 +216,7 @@ fi
# ─── 0j. Verifikasi Keycloak lengkap (verify-keycloak.sh) ────────────────────
vk="${DEPLOY_DIR}/scripts/verify-keycloak.sh"
if [[ -x "${vk}" ]] && bash -n "${vk}" 2>/dev/null \
if [[ -x "${vk}" ]] && bash -n "${vk}" 2>/dev/null \
&& grep -q 'client_credentials' "${vk}" && grep -q 'redirectUris' "${vk}" \
&& grep -q 'publicClient' "${vk}" && grep -q 'origin host' "${vk}" \
&& grep -q 'kc_auth_probe' "${vk}" && grep -q 'password masih DEFAULT' "${vk}"; then
@@ -357,6 +357,22 @@ else
bad "eksternal URL penuh belum didukung (wire=${_uo} parse=${_uo_parse} gen=${_uo_gen})"
fi
# ─── 0p. Origin client 'airflow' pakai AIRFLOW_WEBSERVER_HOST ─────────────────
# Regresi: memakai `AIRFLOW_HOST` (penanda komponen external, SENGAJA tak diisi
# generator) → _comp_addr/comp_addr jatuh ke SICABE_HOST_ADDRESS (alamat host LOKAL),
# sehingga di host non-pemilik (compute/state) origin jadi alamat host ITU, bukan
# alamat control pemilik airflow → verify-keycloak FAIL "belum terdaftar di client".
_ap=1
grep -q '\[airflow\]="http AIRFLOW_WEBSERVER_HOST' "${DEPLOY_DIR}/scripts/verify-keycloak.sh" || _ap=0
grep -q '\["airflow"\]="http AIRFLOW_WEBSERVER_HOST' "${DEPLOY_DIR}/bootstrap.sh" || _ap=0
grep -q '\[airflow\]="http AIRFLOW_HOST ' "${DEPLOY_DIR}/scripts/verify-keycloak.sh" && _ap=0
grep -q '\["airflow"\]="http AIRFLOW_HOST ' "${DEPLOY_DIR}/bootstrap.sh" && _ap=0
if [[ "${_ap}" == "1" ]]; then
ok "client origin airflow: pakai AIRFLOW_WEBSERVER_HOST (verify-keycloak + bootstrap)"
else
bad "client origin airflow masih pakai AIRFLOW_HOST (origin salah di host non-pemilik)"
fi
# ─── 1. generate ────────────────────────────────────────────────────────────
if ! python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
"${INVENTORY}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \
deploy/scripts/verify-keycloak.sh
+5 -1
View File
@@ -65,11 +65,15 @@ declare -A CLIENT_PUBLIC=(
# redirectUris. Deteksi kesalahan umum: redirectUris hanya `https://localhost:12443/*`
# padahal user membuka `https://<ip-host>:12443` → Keycloak menolak "invalid redirect_uri".
# <client> = "<scheme> <host_var> <port_var> <default_port>"
# CATATAN: pakai var TOPOLOGI yang DIISI generator. `AIRFLOW_HOST` SENGAJA TIDAK
# diisi (penanda komponen external, lihat generate.py) → memakainya membuat
# comp_addr jatuh ke SICABE_HOST_ADDRESS (alamat host LOKAL), sehingga origin salah
# di host non-pemilik (mis. compute mengharap airflow di alamat compute, bukan control).
declare -A CLIENT_ORIGIN=(
[trino]="https TRINO_HOST TRINO_HTTPS_PORT 12443"
[grafana]="http GRAFANA_HOST GRAFANA_PORT 12300"
[openmetadata]="http OPENMETADATA_HOST OPENMETADATA_PORT 12085"
[airflow]="http AIRFLOW_HOST AIRFLOW_PORT 12082"
[airflow]="http AIRFLOW_WEBSERVER_HOST AIRFLOW_PORT 12082"
[starrocks]="http STARROCKS_FE_HOST STARROCKS_HTTP_PORT 12030"
)
# Alamat efektif: nilai var bila berupa ALAMAT (mengandung titik); kalau kosong/co-located