sync dari sicabe-doc/deploy @ e8f8fde

deploy/scripts/test-generate.sh

@@ -89,9 +89,9 @@ grep -q '${MINIO_INTERNAL_PORT:-9000}'    "${dc}" || miss="${miss} MINIO"
 hard="$(grep -nE '\$\{(POSTGRES_HOST|KEYCLOAK_HOST|MINIO_HOST)[^}]*\}:(5432|8080|9000)' "${dc}" || true)"
 [[ -z "${hard}" ]] && ok "docker-compose: tak ada port internal literal di var *_HOST" \
                     || bad "docker-compose: masih ada port literal: ${hard}"
-grep -q '${ENV:KEYCLOAK_INTERNAL_PORT}' "${DEPLOY_DIR}/config/trino/config-coordinator.properties" \
-  && ok "Trino config: token/jwks-url pakai \${ENV:KEYCLOAK_INTERNAL_PORT}" \
-  || bad "Trino config: port Keycloak masih literal 8080"
+grep -q '${ENV:KEYCLOAK_INTERNAL_URL}' "${DEPLOY_DIR}/config/trino/config-coordinator.properties" \
+  && ok "Trino config: token/jwks-url pakai \${ENV:KEYCLOAK_INTERNAL_URL} (skema+host+port)" \
+  || bad "Trino config: URL Keycloak belum terparameter (token/jwks literal?)"
 grep -q ':{port}' "${DEPLOY_DIR}/lib/cluster/generate.py" \
   && ok "generate.py: URL_ENDPOINT_VARS memakai {port} (dari .env)" \
   || bad "generate.py: URL_ENDPOINT_VARS masih port literal"
@@ -225,20 +225,20 @@ else
   bad "verify-keycloak.sh hilang/tidak lengkap"
 fi
 
-# ─── 0k. Trino OAuth2: token/jwks pakai KEYCLOAK_HOST (bukan literal `keycloak`) ──
+# ─── 0k. Trino OAuth2: token/jwks pakai KEYCLOAK_INTERNAL_URL (bukan literal) ──
 # Kls bug sama dgn target MinIO Prometheus: Trino server-ke-server ke Keycloak. Bila
 # Keycloak EKSTERNAL (P3), literal `keycloak:` tak resolve → penukaran token gagal →
 # callback `/oauth2/callback` balas "Authentication response could not be verified".
 _tc="${DEPLOY_DIR}/config/trino/config-coordinator.properties"
-if grep -q 'token-url=http://${ENV:KEYCLOAK_HOST}:${ENV:KEYCLOAK_INTERNAL_PORT}' "${_tc}" 2>/dev/null \
-   && grep -q 'jwks-url=http://${ENV:KEYCLOAK_HOST}:' "${_tc}" 2>/dev/null \
+if grep -q 'token-url=${ENV:KEYCLOAK_INTERNAL_URL}' "${_tc}" 2>/dev/null \
+   && grep -q 'jwks-url=${ENV:KEYCLOAK_INTERNAL_URL}' "${_tc}" 2>/dev/null \
    && grep -q 'oauth2.state-key=${ENV:TRINO_OAUTH_STATE_KEY}' "${_tc}" 2>/dev/null \
-   && grep -q 'KEYCLOAK_HOST: ${KEYCLOAK_HOST' "${DEPLOY_DIR}/docker-compose.yml" 2>/dev/null \
+   && grep -q 'KEYCLOAK_INTERNAL_URL: ${KEYCLOAK_INTERNAL_URL' "${DEPLOY_DIR}/docker-compose.yml" 2>/dev/null \
    && grep -q 'TRINO_OAUTH_STATE_KEY: ${TRINO_OAUTH_STATE_KEY' "${DEPLOY_DIR}/docker-compose.yml" 2>/dev/null \
    && ! grep -qE 'token-url=http://keycloak:' "${_tc}" 2>/dev/null; then
-  ok "trino oauth2: token-url/jwks-url pakai KEYCLOAK_HOST + state-key tetap"
+  ok "trino oauth2: token/jwks pakai KEYCLOAK_INTERNAL_URL + state-key tetap"
 else
-  bad "trino oauth2: token-url/jwks-url literal 'keycloak:' atau state-key belum diset"
+  bad "trino oauth2: token/jwks belum pakai KEYCLOAK_INTERNAL_URL atau state-key belum diset"
 fi
 
 # ─── 0l. StarRocks OIDC: redirect_url = alamat browser (bukan localhost) ──────
@@ -307,6 +307,56 @@ else
   bad "storage: konfigurasi bucket/warehouse belum lengkap →${wh_bad}"
 fi
 
+# ─── 0o. Komponen EKSTERNAL ber-URL penuh (domain + skema) ────────────────────
+# Client existing (mis. Keycloak) bisa sudah berdomain `https://sso.example.com`.
+# Alamat itu WAJIB didukung: skema+port dihormati (tak ditempeli http://…:12xxx) dan
+# server→server diarahkan lewat KEYCLOAK_INTERNAL_URL (token/jwks Trino & Grafana).
+_uo=1
+grep -q 'def parse_address' "${DEPLOY_DIR}/lib/cluster/inventory.py" || _uo=0
+grep -q 'def _ext_url' "${DEPLOY_DIR}/lib/cluster/generate.py" || _uo=0
+grep -q 'token-url=${ENV:KEYCLOAK_INTERNAL_URL}' "${DEPLOY_DIR}/config/trino/config-coordinator.properties" || _uo=0
+grep -q 'KEYCLOAK_INTERNAL_URL' "${DEPLOY_DIR}/docker-compose.yml" || _uo=0
+_uo_parse="$(python3 - "${DEPLOY_DIR}" <<'PY'
+import importlib.util, sys
+d = sys.argv[1]
+s = importlib.util.spec_from_file_location("inv", f"{d}/lib/cluster/inventory.py")
+inv = importlib.util.module_from_spec(s); s.loader.exec_module(inv)
+cases = {"https://sso.example.com": ("https", "sso.example.com", 443),
+         "http://minio.corp:9000": ("http", "minio.corp", 9000),
+         "https://sso.example.com:8443": ("https", "sso.example.com", 8443),
+         "sso.example.com": ("", "sso.example.com", None),
+         "10.20.0.10": ("", "10.20.0.10", None)}
+print("1" if all(inv.parse_address(k) == v for k, v in cases.items()) else "0")
+PY
+)"
+cat > "${OUT}/inv-url.yml" <<'YML'
+version: 1
+tls: { mode: none }
+hosts:
+  control: { address: 10.20.0.10, tiers: [identity, policy, pipeline, governance] }
+  compute: { address: 10.20.0.11, tiers: [coord, engine] }
+  state:   { address: 10.20.0.12, tiers: [state] }
+components:
+  keycloak: { address: https://sso.example.com }
+YML
+_uo_gen=0
+if python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
+      "${OUT}/inv-url.yml" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \
+      "${OUT}/url" "${DEPLOY_DIR}/scripts/render-config.sh" > "${OUT}/uri.log" 2>&1; then
+  _ue="${OUT}/url/host-control/.env"
+  if grep -qx 'KEYCLOAK_HOST=sso.example.com' "${_ue}" 2>/dev/null \
+     && grep -qx 'KEYCLOAK_PUBLIC_URL=https://sso.example.com' "${_ue}" 2>/dev/null \
+     && grep -qx 'KEYCLOAK_INTERNAL_URL=https://sso.example.com' "${_ue}" 2>/dev/null \
+     && grep -qx 'KEYCLOAK_SSL_REQUIRED=external' "${_ue}" 2>/dev/null; then
+    _uo_gen=1
+  fi
+fi
+if [[ "${_uo}" == "1" && "${_uo_parse}" == "1" && "${_uo_gen}" == "1" ]]; then
+  ok "eksternal URL penuh: domain https dihormati + KEYCLOAK_INTERNAL_URL + sslRequired=external"
+else
+  bad "eksternal URL penuh belum didukung (wire=${_uo} parse=${_uo_parse} gen=${_uo_gen})"
+fi
+
 # ─── 1. generate ────────────────────────────────────────────────────────────
 if ! python3 "${DEPLOY_DIR}/lib/cluster/generate.py" render \
       "${INVENTORY}" "${DEPLOY_DIR}/docker-compose.yml" "${DEPLOY_DIR}/.env" \

deploy/scripts/verify-keycloak.sh

@@ -33,7 +33,7 @@ source "${SCRIPT_DIR}/lib/common.sh"
 source "${SCRIPT_DIR}/config/environment.defaults.sh"
 sicabe_load_env "${SCRIPT_DIR}" "$@" || exit 1
 
-KC="$(sicabe_local_url http KEYCLOAK_HOST "${KEYCLOAK_PORT:-12080}" KEYCLOAK_URL)"
+KC="$(sicabe_keycloak_url)"
 REALM="${SICABE_REALM:-sicabe}"
 
 REQUIRED_CLIENTS=("trino" "starrocks" "airflow" "openmetadata" "grafana")

deploy/scripts/verify-phase1-iam.sh

@@ -35,7 +35,7 @@ sicabe_load_env "${SCRIPT_DIR}" "$@"
 # Config RELEVAN: mode host (--env-file) = BUNDLE host (ter-render), bukan deploy/config/ sumber.
 if [[ -n "${SICABE_BUNDLE_DIR:-}" ]]; then CONFIG_DIR="${SICABE_BUNDLE_DIR}/config"; else CONFIG_DIR="${SCRIPT_DIR}/config"; fi
 
-KC="$(sicabe_local_url http KEYCLOAK_HOST "${KEYCLOAK_PORT:-12080}" KEYCLOAK_URL)"
+KC="$(sicabe_keycloak_url)"
 REALM="${SICABE_REALM:-sicabe}"
 LDAP_HOST="${LDAP_HOST:-localhost}"
 LDAP_PORT="${LDAP_PORT:-389}"

deploy/scripts/verify-phase3-processing.sh

@@ -131,7 +131,7 @@ trino_exec_oidc() { _trino_stmt "$2" -H "Authorization: Bearer $1"; }
 # oidc_token <username> <password> → access token (client 'trino', scope openid)
 oidc_token() {
   curl -s --max-time 20 -X POST \
-    "$(sicabe_local_url http KEYCLOAK_HOST "${KEYCLOAK_PORT:-12080}" KEYCLOAK_URL)/realms/${SICABE_REALM:-sicabe}/protocol/openid-connect/token" \
+    "$(sicabe_keycloak_url)/realms/${SICABE_REALM:-sicabe}/protocol/openid-connect/token" \
     -d grant_type=password -d client_id=trino -d "client_secret=${TRINO_CLIENT_SECRET}" \
     -d "username=$1" -d "password=$2" -d scope=openid 2>/dev/null |
     python3 -c "import sys,json;print(json.load(sys.stdin).get('access_token',''))" 2>/dev/null

deploy/scripts/verify-phase4-serving.sh

@@ -53,7 +53,7 @@ BUCKET="${MINIO_BUCKET_ICEBERG_DATA:-iceberg-data}"
 S3_ENDPOINT="${S3_ENDPOINT:-http://minio:9000}"
 S3_REGION="${S3_REGION:-us-east-1}"
 LDAP_URL="${LDAP_URL:-ldap://openldap:389}"
-KC_BASE="$(sicabe_local_url http KEYCLOAK_HOST "${KEYCLOAK_PORT:-12080}" KEYCLOAK_URL)"
+KC_BASE="$(sicabe_keycloak_url)"
 REALM="${SICABE_REALM:-sicabe}"
 GROUP_PROVIDER_NAME="${STARROCKS_GROUP_PROVIDER:-sr_ldap}"
 OIDC_NAME="${STARROCKS_OIDC_INTEGRATION:-sr_oidc}"