136 lines
5.2 KiB
Bash
Executable File
136 lines
5.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# eBdesk SiCABE — StarRocks: terapkan DYNAMIC CONFIG (hilang saat FE restart)
|
|
# =============================================================================
|
|
# Mengapa terpisah dan BUKAN di fe.conf?
|
|
# `authentication_chain` harus memuat `sr_oidc`, tetapi integrasi `sr_oidc`
|
|
# baru dibuat lewat SQL (bootstrap step 5). Pada boot pertama FE, integrasi itu
|
|
# BELUM ada sehingga menaruhnya di fe.conf akan gagal. Nilainya karena itu
|
|
# bersifat runtime: harus diterapkan ULANG setiap kali FE restart.
|
|
#
|
|
# Yang diterapkan:
|
|
# 1. authentication_chain = native,<sr_oidc> → tanpa ini login OIDC mati
|
|
# (integrasi tetap "ada" di SHOW SECURITY INTEGRATIONS, jadi sulit terlihat).
|
|
# 2. activate_all_roles_on_login = TRUE → role otomatis aktif saat login.
|
|
#
|
|
# Skrip ini:
|
|
# - idempoten (aman dipanggil berkali-kali),
|
|
# - memverifikasi lebih dulu bahwa security integration ada (kalau tidak,
|
|
# berhenti dengan pesan agar menjalankan bootstrap step 5),
|
|
# - memverifikasi hasilnya setelah diterapkan (exit != 0 bila gagal).
|
|
#
|
|
# Usage:
|
|
# ./scripts/starrocks-reapply-dynamic-config.sh
|
|
# # StarRocks existing:
|
|
# STARROCKS_HOST=starrocks.corp STARROCKS_PORT=9030 \
|
|
# STARROCKS_ROOT_PASSWORD=... ./scripts/starrocks-reapply-dynamic-config.sh
|
|
# =============================================================================
|
|
set -uo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
# shellcheck source=../lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
# shellcheck source=../config/environment.defaults.sh
|
|
source "${SCRIPT_DIR}/config/environment.defaults.sh"
|
|
sicabe_load_env "${SCRIPT_DIR}" "$@"
|
|
|
|
STARROCKS_HOST="${STARROCKS_HOST:-localhost}"
|
|
STARROCKS_PORT="${STARROCKS_PORT:-${STARROCKS_FE_PORT:-12930}}"
|
|
# Multi-host: arahkan ke host pemilik StarRocks FE (single-host tetap localhost).
|
|
STARROCKS_HOST="$(sicabe_local_host STARROCKS_FE_HOST STARROCKS_HOST)"
|
|
SR_USER="${STARROCKS_USER:-root}"
|
|
SR_PW="${STARROCKS_ROOT_PASSWORD:-}"
|
|
OIDC_NAME="${STARROCKS_OIDC_INTEGRATION:-sr_oidc}"
|
|
SR_MYSQL_IMAGE="${SR_MYSQL_IMAGE:-mysql:8}"
|
|
|
|
if command -v mysql >/dev/null 2>&1; then
|
|
SR_MODE="host"
|
|
elif docker image inspect "${SR_MYSQL_IMAGE}" >/dev/null 2>&1; then
|
|
SR_MODE="container"
|
|
else
|
|
SR_MODE="none"
|
|
fi
|
|
|
|
# sr_sql <sql> → hasil; kode keluar bukan-0 bila koneksi/kliens gagal.
|
|
sr_sql() {
|
|
case "${SR_MODE}" in
|
|
host)
|
|
MYSQL_PWD="${SR_PW}" mysql --protocol=TCP -h "${STARROCKS_HOST}" -P "${STARROCKS_PORT}" \
|
|
-u "${SR_USER}" -N -B -e "$1" 2>/dev/null
|
|
;;
|
|
container)
|
|
docker run --rm -i --network "${SICABE_NETWORK:-sicabe-network}" \
|
|
-e MYSQL_PWD="${SR_PW}" "${SR_MYSQL_IMAGE}" \
|
|
mysql --protocol=TCP -h "${STARROCKS_HOST}" -P "${STARROCKS_PORT}" -u "${SR_USER}" \
|
|
-N -B -e "$1" 2>/dev/null
|
|
;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
apply_dynamic_config() {
|
|
echo -e "${INFO} [1/2] authentication_chain = native,${OIDC_NAME}"
|
|
sr_sql "ADMIN SET FRONTEND CONFIG (\"authentication_chain\" = \"native,${OIDC_NAME}\");" >/dev/null
|
|
|
|
echo -e "${INFO} [2/2] activate_all_roles_on_login = TRUE"
|
|
sr_sql "SET GLOBAL activate_all_roles_on_login = TRUE;" >/dev/null
|
|
}
|
|
|
|
main() {
|
|
print_section "StarRocks — terapkan dynamic config (auth chain OIDC)"
|
|
|
|
if [[ "${SR_MODE}" == "none" ]]; then
|
|
echo -e "${ERR} Klien MySQL tidak tersedia di host dan image ${SR_MYSQL_IMAGE} belum ada."
|
|
echo " Install klien: sudo apt-get install -y mysql-client (atau tarik image mysql)"
|
|
exit 1
|
|
fi
|
|
if [[ -z "${SR_PW}" ]]; then
|
|
echo -e "${ERR} STARROCKS_ROOT_PASSWORD kosong (isi di .env)."
|
|
exit 1
|
|
fi
|
|
if [[ "$(sr_sql 'SELECT 1')" != "1" ]]; then
|
|
echo -e "${ERR} Tidak bisa terhubung ke StarRocks di ${STARROCKS_HOST}:${STARROCKS_PORT}."
|
|
exit 1
|
|
fi
|
|
echo -e "${OK} Terhubung ke ${STARROCKS_HOST}:${STARROCKS_PORT}"
|
|
|
|
# Prasyarat: integrasi harus sudah ada — kalau tidak, menyetel chain akan error.
|
|
if ! sr_sql "SHOW SECURITY INTEGRATIONS;" | grep -q "${OIDC_NAME}"; then
|
|
echo -e "${ERR} Security integration '${OIDC_NAME}' belum ada."
|
|
echo " Jalankan dulu: ./bootstrap.sh --step 5"
|
|
exit 1
|
|
fi
|
|
echo -e "${OK} Security integration '${OIDC_NAME}' ada (prasyarat terpenuhi)"
|
|
|
|
apply_dynamic_config
|
|
|
|
# Verifikasi hasil — jangan lapor sukses tanpa bukti.
|
|
local chain roles
|
|
chain="$(sr_sql "ADMIN SHOW FRONTEND CONFIG LIKE 'authentication_chain';" | awk -F'\t' '{print $3}')"
|
|
roles="$(sr_sql "SHOW VARIABLES LIKE 'activate_all_roles_on_login';" | awk -F'\t' '{print $2}')"
|
|
|
|
local rc=0
|
|
if [[ "${chain}" == *"${OIDC_NAME}"* ]]; then
|
|
echo -e "${OK} authentication_chain = ${chain}"
|
|
else
|
|
echo -e "${ERR} authentication_chain = ${chain:-tak terbaca} — gagal memuat ${OIDC_NAME}"
|
|
rc=1
|
|
fi
|
|
if [[ "${roles}" == "true" ]]; then
|
|
echo -e "${OK} activate_all_roles_on_login = ${roles}"
|
|
else
|
|
echo -e "${ERR} activate_all_roles_on_login = ${roles:-tak terbaca} (diharapkan true)"
|
|
rc=1
|
|
fi
|
|
|
|
if [[ ${rc} -eq 0 ]]; then
|
|
echo -e "${OK} ${GREEN}Dynamic config diterapkan.${NC}"
|
|
echo -e "${INFO} Verifikasi menyeluruh: ./scripts/verify-phase4-serving.sh"
|
|
else
|
|
echo -e "${ERR} Sebagian dynamic config gagal diterapkan."
|
|
fi
|
|
exit ${rc}
|
|
}
|
|
|
|
main "$@"
|