Skip to content

Commit 2f3fc23

Browse files
aabouzaidaabouzaid
authored
refactor: move orchestration oidc from global to component (#4233)
1 parent dde9565 commit 2f3fc23

24 files changed

+181
-184
lines changed

‎charts/camunda-platform-8.8/README.md‎

Lines changed: 10 additions & 11 deletions
Large diffs are not rendered by default.

‎charts/camunda-platform-8.8/templates/common/constraints.tpl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -167,11 +167,11 @@ Fail with a message if Web Modeler is enabled but management Identity is not ena
167167
{{- end }}
168168

169169
{{ if and (.Values.orchestration.enabled)
170-
(not .Values.global.identity.auth.orchestration.existingSecret)
171-
(not .Values.global.identity.auth.orchestration.secret.existingSecret)
170+
(not .Values.orchestration.security.authentication.oidc.existingSecret)
171+
(not .Values.orchestration.security.authentication.oidc.secret.existingSecret)
172172
(not .Values.global.secrets.autoGenerated) }}
173173
{{- $existingSecretsNotConfigured = append
174-
$existingSecretsNotConfigured "global.identity.auth.orchestration.secret.existingSecret" }}
174+
$existingSecretsNotConfigured "orchestration.security.authentication.oidc.secret.existingSecret" }}
175175
{{- end }}
176176
{{- end }}
177177

‎charts/camunda-platform-8.8/templates/common/secret-camunda.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ data:
3838
{{ ((.Values.global.identity.auth.console.secret).existingSecretKey) | default .Values.global.identity.auth.console.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
3939
{{- end }}
4040
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
41-
"config" .Values.global.identity.auth.orchestration
41+
"config" .Values.orchestration.security.authentication.oidc
4242
"autogeneratedSecretName" .Values.global.secrets.name
4343
)) "true" }}
44-
{{ ((.Values.global.identity.auth.orchestration.secret).existingSecretKey) | default .Values.global.identity.auth.orchestration.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
44+
{{ ((.Values.orchestration.security.authentication.oidc.secret).existingSecretKey) | default .Values.orchestration.security.authentication.oidc.existingSecretKey }}: "{{ randAlphaNum 16 | b64enc }}"
4545
{{- end }}
4646
{{- if eq (include "camundaPlatform.shouldAutogenerateSecret" (dict
4747
"config" .Values.global.identity.auth.optimize

‎charts/camunda-platform-8.8/templates/common/secret-core.yaml‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎charts/camunda-platform-8.8/templates/common/secret-orchestration.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if and (.Values.global.identity.auth.enabled) (or (not .Values.orchestration.security.authentication.oidc.existingSecret) (typeIs "string" .Values.orchestration.security.authentication.oidc.existingSecret)) }}
2+
{{- $secretName := include "camundaPlatform.identitySecretName" (dict "context" . "component" "orchestration") }}
3+
apiVersion: v1
4+
kind: Secret
5+
metadata:
6+
name: {{ $secretName }}
7+
labels: {{- include "camundaPlatform.identityLabels" . | nindent 4 }}
8+
type: Opaque
9+
data:
10+
{{ .Values.orchestration.security.authentication.oidc.existingSecretKey }}: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" .Values.orchestration.security.authentication.oidc.existingSecretKey "length" 10 "providedValues" (list "orchestration.security.authentication.oidc.existingSecret") "context" $) }}
11+
{{- end }}

‎charts/camunda-platform-8.8/templates/identity/configmap.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ data:
110110
id: ${CAMUNDA_ORCHESTRATION_CLIENT_ID:${VALUES_KEYCLOAK_INIT_ORCHESTRATION_CLIENT_ID:orchestration}}
111111
type: confidential
112112
secret: ${CAMUNDA_ORCHESTRATION_SECRET:${VALUES_KEYCLOAK_INIT_ORCHESTRATION_SECRET:}}
113-
root-url: {{ tpl .Values.global.identity.auth.orchestration.redirectUrl $ | quote }}
113+
root-url: {{ tpl .Values.orchestration.security.authentication.oidc.redirectUrl $ | quote }}
114114
redirect-uris:
115115
- "/login/oauth2/code/orchestration"
116116
apis:
@@ -276,7 +276,7 @@ data:
276276
id: orchestration
277277
type: confidential
278278
secret: ${VALUES_KEYCLOAK_INIT_ORCHESTRATION_SECRET:}
279-
root-url: {{ tpl .Values.global.identity.auth.orchestration.redirectUrl $ | quote }}
279+
root-url: {{ tpl .Values.orchestration.security.authentication.oidc.redirectUrl $ | quote }}
280280
redirect-uris:
281281
- "/identity-callback"
282282
optimize:

‎charts/camunda-platform-8.8/templates/identity/deployment.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ spec:
4949
) | nindent 12 }}
5050
{{- include "camundaPlatform.emitEnvVarFromSecretConfig" (dict
5151
"envName" "VALUES_KEYCLOAK_INIT_ORCHESTRATION_SECRET"
52-
"config" .Values.global.identity.auth.orchestration
52+
"config" .Values.orchestration.security.authentication.oidc
5353
) | nindent 12 }}
5454
{{- include "camundaPlatform.emitEnvVarFromSecretConfig" (dict
5555
"envName" "VALUES_KEYCLOAK_INIT_CONSOLE_SECRET"
@@ -83,10 +83,10 @@ spec:
8383
value: "orchestration"
8484
{{- include "camundaPlatform.emitEnvVarFromSecretConfig" (dict
8585
"envName" "KEYCLOAK_CLIENTS_1_SECRET"
86-
"config" .Values.global.identity.auth.orchestration
86+
"config" .Values.orchestration.security.authentication.oidc
8787
) | nindent 12 }}
8888
- name: KEYCLOAK_CLIENTS_1_ROOT_URL
89-
value: {{ tpl .Values.global.identity.auth.orchestration.redirectUrl $ | quote }}
89+
value: {{ tpl .Values.orchestration.security.authentication.oidc.redirectUrl $ | quote }}
9090
- name: KEYCLOAK_CLIENTS_1_REDIRECT_URIS_0
9191
value: /login/oauth2/code/orchestration
9292
- name: KEYCLOAK_CLIENTS_1_REDIRECT_URIS_1
@@ -110,7 +110,7 @@ spec:
110110
value: Migration
111111
{{- include "camundaPlatform.emitEnvVarFromSecretConfig" (dict
112112
"envName" "KEYCLOAK_CLIENTS_2_SECRET"
113-
"config" .Values.global.identity.auth.orchestration
113+
"config" .Values.orchestration.security.authentication.oidc
114114
) | nindent 12 }}
115115
- name: KEYCLOAK_CLIENTS_2_REDIRECT_URIS_0
116116
value: /dummy

‎charts/camunda-platform-8.8/templates/orchestration/_helpers.tpl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -157,15 +157,15 @@ app.kubernetes.io/version: {{ include "camundaPlatform.versionLabel" (dict
157157
[orchestration] Define variables related to authentication.
158158
*/}}
159159
{{- define "orchestration.authClientId" -}}
160-
{{- .Values.global.identity.auth.orchestration.clientId | default "orchestration" -}}
160+
{{- .Values.orchestration.security.authentication.oidc.clientId | default "orchestration" -}}
161161
{{- end -}}
162162
163163
{{- define "orchestration.authAudience" -}}
164-
{{- .Values.global.identity.auth.orchestration.audience | default "orchestration-api" -}}
164+
{{- .Values.orchestration.security.authentication.oidc.audience | default "orchestration-api" -}}
165165
{{- end -}}
166166
167167
{{- define "orchestration.authTokenScope" -}}
168-
{{- .Values.global.identity.auth.orchestration.tokenScope -}}
168+
{{- .Values.orchestration.security.authentication.oidc.tokenScope -}}
169169
{{- end -}}
170170
171171
{{- define "orchestration.enabledProfiles" -}}

‎charts/camunda-platform-8.8/templates/orchestration/files/_application-unified.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ camunda:
9292
client-secret: ${VALUES_ORCHESTRATION_CLIENT_SECRET:}
9393
audiences:
9494
- {{ include "orchestration.authClientId" . | quote }}
95-
- {{ .Values.global.identity.auth.orchestration.audience | quote }}
95+
- {{ .Values.orchestration.security.authentication.oidc.audience | quote }}
9696
- {{ .Values.global.identity.auth.webModeler.clientApiAudience | quote }}
9797
- {{ .Values.global.identity.auth.webModeler.publicApiAudience | quote }}
9898
{{- $redirectURIDefault := printf "http://%s:8080" (include "orchestration.fullname" .) }}
@@ -101,7 +101,7 @@ camunda:
101101
For more details: https://github.com/camunda/camunda-platform-helm/issues/3952
102102
*/}}
103103
issuer-uri: {{ (include "camundaPlatform.authIssuerUrl" .) | quote }}
104-
redirect-uri: "{{ tpl .Values.global.identity.auth.orchestration.redirectUrl $ | default $redirectURIDefault }}/sso-callback"
104+
redirect-uri: "{{ tpl .Values.orchestration.security.authentication.oidc.redirectUrl $ | default $redirectURIDefault }}/sso-callback"
105105
authenticationRefreshInterval: {{ .Values.orchestration.security.authentication.authenticationRefreshInterval | quote }}
106106
{{- end }}
107107
method: {{ .Values.orchestration.security.authentication.method | quote }}
@@ -152,7 +152,7 @@ camunda:
152152
enabled: {{ include "orchestration.multitenancyChecksEnabled" . }}
153153
{{- if .Values.global.identity.auth.enabled }}
154154
identity:
155-
redirectRootUrl: "{{ tpl .Values.global.identity.auth.orchestration.redirectUrl $ }}/operate"
155+
redirectRootUrl: "{{ tpl .Values.orchestration.security.authentication.oidc.redirectUrl $ }}/operate"
156156
{{- end }}
157157
{{- if .Values.global.opensearch.enabled }}
158158
# OpenSearch
@@ -185,7 +185,7 @@ camunda:
185185

186186
{{- if .Values.global.identity.auth.enabled }}
187187
identity:
188-
redirectRootUrl: "{{ tpl .Values.global.identity.auth.orchestration.redirectUrl $ }}/tasklist"
188+
redirectRootUrl: "{{ tpl .Values.orchestration.security.authentication.oidc.redirectUrl $ }}/tasklist"
189189
{{- end }}
190190
{{- if .Values.global.opensearch.enabled }}
191191
# OpenSearch

‎charts/camunda-platform-8.8/templates/orchestration/importer-deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ spec:
6060
{{- if .Values.global.identity.auth.enabled }}
6161
{{- include "camundaPlatform.emitEnvVarFromSecretConfig" (dict
6262
"envName" "VALUES_ORCHESTRATION_CLIENT_SECRET"
63-
"config" .Values.global.identity.auth.orchestration
63+
"config" .Values.orchestration.security.authentication.oidc
6464
) | nindent 12 }}
6565
{{- end }}
6666
{{- if or .Values.global.elasticsearch.tls.existingSecret .Values.global.opensearch.tls.existingSecret }}

0 commit comments

Comments
 (0)