Skip to content

Commit 4519656

Browse files
author
Maurice Faber
committed
refactor: simplified oidc, overloading with keycloak if exists [ci skip]
1 parent d659c2c commit 4519656

17 files changed

+49
-54
lines changed

‎.cspell.json

+3-1
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
"oo",
3030
"oo mkilled",
3131
"RAGRS",
32+
"jwks",
3233
"RAGZRS",
3334
"registr",
3435
"roboll",
@@ -99,5 +100,6 @@
99100
"sitespeed",
100101
"testmode",
101102
"untrusted"
102-
]
103+
],
104+
"language": "en"
103105
}

‎.values/.vscode/settings.json

+1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
},
1717
"prettier.enable": true,
1818
"sops.defaults.gcpCredentialsPath": "gcp-key.json",
19+
"sops.enabled": true,
1920
"yaml.schemas": {
2021
"http://json-schema.org/draft/2019-09/schema#": ".vscode/values-schema.yaml",
2122
".vscode/values-schema.yaml": "env/*.yaml"

‎charts/otomi-api/values.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,6 @@ secrets:
7373
GIT_USER:
7474
GIT_EMAIL:
7575
GIT_PASSWORD:
76-
OIDC_CLIENT_SECRET:
7776

7877
env:
7978
GIT_REPO_URL:

‎charts/team-ns/templates/_helpers.tpl

-2
Original file line numberDiff line numberDiff line change
@@ -108,9 +108,7 @@ metadata:
108108
{{- end }}
109109
{{- end }}
110110
{{- if .hasAuth }}
111-
{{- if .hasKeycloak }}
112111
nginx.ingress.kubernetes.io/auth-response-headers: Authorization
113-
{{- end }}
114112
nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy.istio-system.svc.cluster.local/oauth2/auth"
115113
nginx.ingress.kubernetes.io/auth-signin: "https://auth.{{ .cluster.domain }}/oauth2/start?rd=/oauth2/redirect/$http_host$escaped_request_uri"
116114
{{- end }}

‎charts/team-ns/templates/ingress.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -31,30 +31,30 @@
3131
{{- end }}
3232

3333
# apps.* that need their path rewritten to /
34-
{{ include "ingress" (dict "dot" . "provider" "nginx" "name" "private" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" true "hasForward" false "hasAuth" true "services" $private "hasKeycloak" $hasKeycloak) }}
34+
{{ include "ingress" (dict "dot" . "provider" "nginx" "name" "private" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" true "hasForward" false "hasAuth" true "services" $private) }}
3535
---
3636

3737
# apps.* that need their path forwarded instead of rewritten to /
3838
{{- if gt (len $privateForward) 0 }}
39-
{{ include "ingress" (dict "dot" . "provider" "nginx" "name" "private-forward" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" true "hasForward" true "hasAuth" true "services" $privateForward "hasKeycloak" $hasKeycloak) }}
39+
{{ include "ingress" (dict "dot" . "provider" "nginx" "name" "private-forward" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" true "hasForward" true "hasAuth" true "services" $privateForward) }}
4040
---
4141
{{- end }}
4242

4343
# apps with custom domains
4444
{{- if gt (len $privateCustom) 0 }}
45-
{{ include "ingress" (dict "dot" . "provider" "nginx" "name" "private-custom" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" false "hasForward" false "hasAuth" true "services" $privateCustom "hasKeycloak" $hasKeycloak) }}
45+
{{ include "ingress" (dict "dot" . "provider" "nginx" "name" "private-custom" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" false "hasForward" false "hasAuth" true "services" $privateCustom) }}
4646
---
4747
{{- end }}
4848

4949
# public services
5050
{{- if gt (len $public) 0 }}
51-
{{ include "ingress" (dict "dot" . "provider" "nginx" "name" "public" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" false "hasForward" false "hasAuth" false "services" $public "hasKeycloak" $hasKeycloak) }}
51+
{{ include "ingress" (dict "dot" . "provider" "nginx" "name" "public" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" false "hasForward" false "hasAuth" false "services" $public) }}
5252
---
5353
{{- end }}
5454

5555
{{- if $v.otomi.hasCloudLB }}
5656
# external LB ingress
57-
{{ include "ingress" (dict "dot" . "provider" $v.cluster.provider "name" "external" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" false "hasForward" false "hasAuth" false "services" $v.services "hasKeycloak" $hasKeycloak) }}
57+
{{ include "ingress" (dict "dot" . "provider" $v.cluster.provider "name" "external" "teamId" $v.teamId "domain" $v.domain "cluster" $v.cluster "otomi" $v.otomi "isApps" false "hasForward" false "hasAuth" false "services" $v.services) }}
5858
---
5959
{{- end }}
6060

‎charts/team-ns/templates/istio-virtualservices.yaml

+15-5
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{{- $v := .Values }}
2+
{{- $k := $v.charts.keycloak | default dict }}
23
{{- if or (eq $v.teamId "admin") ($v.otomi.isMultitenant) }}
34
{{- $ := . }}
45
{{- range $s := $v.services }}
@@ -79,7 +80,8 @@ spec:
7980
set:
8081
X-Forwarded-Proto: https
8182
---
82-
{{- if and $v.hasKeycloak (not (hasKey $s "isPublic")) (hasKey $s "authz") }}
83+
{{- if and (not (hasKey $s "isPublic")) (hasKey $s "authz") }}
84+
# grrr
8385
{{- $workload := ($s.authz.workload | toYaml | replace "__TEAM" $v.teamId) }}
8486
apiVersion: security.istio.io/v1beta1
8587
kind: RequestAuthentication
@@ -90,12 +92,19 @@ spec:
9092
selector:
9193
matchLabels: {{ $workload | nindent 6 }}
9294
jwtRules:
95+
{{- if $k.enabled }}
9396
- issuer: https://keycloak.{{ $v.cluster.domain }}/realms/master
9497
jwksUri: https://keycloak.{{ $v.cluster.domain }}/realms/master/protocol/openid-connect/certs
95-
forwardOriginalToken: {{ $s.authz.forwardOriginalToken | default false }}
9698
audiences:
97-
- otomi
99+
- {{ $k.idp.clientID }}
100+
{{- else }}
101+
- issuer: {{ $v.oidc.issuer }}
102+
# jwksUri: {{ $v.oidc.jwksUri }}
103+
{{- end }}
104+
forwardOriginalToken: {{ $s.authz.forwardOriginalToken | default false }}
98105
---
106+
{{- if $k.enabled }}
107+
{{- $principal := printf "https://keycloak.%s/realms/master/*" $v.cluster.domain }}
99108
apiVersion: security.istio.io/v1beta1
100109
kind: AuthorizationPolicy
101110
metadata:
@@ -110,7 +119,7 @@ spec:
110119
# {}
111120
from:
112121
- source:
113-
requestPrincipals: ['https://keycloak.{{ $v.cluster.domain }}/realms/master/*']
122+
requestPrincipals: [{{ $principal }}]
114123
{{- if not $s.isShared }}
115124
when:
116125
- key: request.auth.claims[groups]
@@ -130,10 +139,11 @@ spec:
130139
{{- end }}
131140
- from:
132141
- source:
133-
notRequestPrincipals: ['https://keycloak.{{ $v.cluster.domain }}/realms/master/*']
142+
notRequestPrincipals: [{{ $principal }}]
134143
---
135144
{{- end }}
136145
{{- end }}
137146
{{- end }}
138147
{{- end }}
139148
{{- end }}
149+
{{- end }}

‎helmfile.d/helmfile-15.ingress-core.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ releases:
1919
- name: admin
2020
teamId: admin
2121
charts: {{- $v.charts | toYaml | nindent 10 }}
22+
oidc: {{- $v.oidc | toYaml | nindent 10 }}
2223
cluster: {{- $v.cluster | toYaml | nindent 10 }}
2324
otomi: {{- $v.otomi | toYaml | nindent 10 }}
2425
domain: {{ $adminDomain }}

‎helmfile.d/helmfile-60.teams.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ releases:
2626
- cluster: {{- $v.cluster | toYaml | nindent 10 }}
2727
charts: {{- $v.charts | toYaml | nindent 10 }}
2828
otomi: {{- $v.otomi | toYaml | nindent 10 }}
29-
hasKeycloak: {{ $v.charts.keycloak | get "enabled" true }}
29+
oidc: {{- $v.oidc | toYaml | nindent 10 }}
3030
domain: {{ $domain }}
3131
certStage: {{ $cm.stage }}
3232
knative:

‎helmfile.d/snippets/grafana.gotmpl

+5-13
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,21 @@
1-
{{- if not .hasOauth2 }}
2-
"auth.anonymous":
3-
enabled: true
4-
org_role: Admin
5-
org_name: Main Org.
6-
{{- else }}
71
"auth.generic_oauth":
82
tls_skip_verify_insecure: {{ eq .stage "staging" }}
93
enabled: true
104
name: OAuth
115
org_role: Admin
126
allow_sign_up: true
13-
# allow_sign_up: false
147
oauth_auto_login: true # false = so we can login with admin / bladibla
15-
client_id: {{ .keycloak.clientID }}
16-
client_secret: {{ .keycloak.clientSecret }}
8+
client_id: {{ .hasKeycloak | ternary .keycloak.clientID .oidc.clientID }}
9+
client_secret: {{ .hasKeycloak | ternary .keycloak.clientSecret .oidc.clientSecret }}
1710
scopes: openid
18-
auth_url: {{ .hasKeycloak | ternary (printf "%s/protocol/openid-connect/auth" .keycloakBase) (.oidc | getOrNil "oauth2.authUrl") }}
19-
token_url: {{ .hasKeycloak | ternary (printf "%s/protocol/openid-connect/token" .keycloakBase) (.oidc | getOrNil "oauth2.tokenUrl") }}
20-
api_url: {{ .hasKeycloak | ternary (printf "%s/protocol/openid-connect/userinfo" .keycloakBase) (.oidc | get "oauth2.apiUrl" (.oidc | getOrNil "oauth2.tokenUrl")) }}
11+
auth_url: {{ .hasKeycloak | ternary (printf "%s/protocol/openid-connect/auth" .keycloakBase) (.oidc | getOrNil "authUrl") }}
12+
token_url: {{ .hasKeycloak | ternary (printf "%s/protocol/openid-connect/token" .keycloakBase) (.oidc | getOrNil "tokenUrl") }}
13+
api_url: {{ .hasKeycloak | ternary (printf "%s/protocol/openid-connect/userinfo" .keycloakBase) (.oidc | get "apiUrl" (.oidc | getOrNil "tokenUrl")) }}
2114
{{- if .hasKeycloak }}
2215
role_attribute_path: contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'team-admin') && 'Admin' || 'Editor'
2316
{{- else }}
2417
role_attribute_path: 'Admin'
2518
{{- end }}
26-
{{- end }}
2719
log:
2820
level: error
2921
users:

‎values-schema.yaml

+9-11
Original file line numberDiff line numberDiff line change
@@ -1153,6 +1153,7 @@ properties:
11531153
name:
11541154
type: string
11551155
oidc:
1156+
description: Holds many parts used in different locations. Please see keycloak, istio and oauth-proxy all consuming parts.
11561157
type: object
11571158
additionalProperties: false
11581159
properties:
@@ -1162,6 +1163,14 @@ properties:
11621163
type: string
11631164
issuer:
11641165
type: string
1166+
jwksUri:
1167+
type: string
1168+
authUrl:
1169+
'$ref': '#/definitions/url'
1170+
tokenUrl:
1171+
'$ref': '#/definitions/url'
1172+
apiUrl:
1173+
'$ref': '#/definitions/url'
11651174
tenantID:
11661175
type: string
11671176
scope:
@@ -1170,17 +1179,6 @@ properties:
11701179
type: string
11711180
teamAdminGroupID:
11721181
type: string
1173-
oauth2:
1174-
description: Can be used in case no keycloak is chosen, to fall back to oauth2 urls. Handy for apps like grafana.
1175-
type: object
1176-
properties:
1177-
authUrl:
1178-
'$ref': '#/definitions/url'
1179-
tokenUrl:
1180-
'$ref': '#/definitions/url'
1181-
apiUrl:
1182-
'$ref': '#/definitions/url'
1183-
required: [authUrl, tokenUrl]
11841182
otomi:
11851183
type: object
11861184
additionalProperties: false

‎values/istio-operator/istio-operator-raw.gotmpl

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,8 @@
1010
{{- $realm := $k | get "realm" "master" }}
1111
{{- $keycloakBase := printf "https://keycloak.%s/realms/%s" $v.cluster.domain $realm }}
1212
{{- $o := $v.oidc }}
13-
{{- $hasOauth2 := or $hasKeycloak (hasKey $o "oauth2") }}
1413
{{- $appsDomain := printf "apps.%s" $v.cluster.domain }}
15-
{{- $grafanaIni := tpl (readFile "../../helmfile.d/snippets/grafana.gotmpl") (dict "keycloakBase" $keycloakBase "hasKeycloak" $hasKeycloak "hasOauth2" $hasOauth2 "oidc" $v.oidc "stage" $stage "keycloak" ($k | get "idp")) | toString }}
14+
{{- $grafanaIni := tpl (readFile "../../helmfile.d/snippets/grafana.gotmpl") (dict "keycloakBase" $keycloakBase "hasKeycloak" $hasKeycloak "oidc" $v.oidc "stage" $stage "keycloak" ($k | get "idp")) | toString }}
1615
resources:
1716
- apiVersion: install.istio.io/v1alpha1
1817
kind: IstioOperator

‎values/jobs/harbor.gotmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@ tasks:
3434
secret:
3535
HARBOR_PASSWORD: {{ $h | get "adminPassword" "bladibla" }}
3636
HARBOR_USER: admin
37-
OIDC_CLIENT_ID: {{ $o.clientID }}
38-
OIDC_CLIENT_SECRET: {{ $o.clientSecret }}
37+
OIDC_CLIENT_ID: {{ $hasKeycloak | ternary $k.idp.clientID $o.clientID }}
38+
OIDC_CLIENT_SECRET: {{ $hasKeycloak | ternary $k.idp.clientSecret $o.clientSecret }}
3939
env:
4040
HARBOR_BASE_URL: "http://harbor-harbor-core.harbor/api/v2.0"
4141
TEAM_NAMES: '{{ $teamNames | toJson }}'

‎values/jobs/keycloak.gotmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ tasks:
3939
KEYCLOAK_ADMIN: {{ $k | get "admin.username" "admin" }}
4040
KEYCLOAK_ADMIN_PASSWORD: {{ $k | get "admin.password" "bladibla" }}
4141
KEYCLOAK_REALM: master
42-
KEYCLOAK_CLIENT_ID: {{ $k.idp | get "clientID" "otomi" }}
42+
KEYCLOAK_CLIENT_ID: {{ $k.idp.clientID }}
4343
KEYCLOAK_CLIENT_SECRET: {{ $k.idp.clientSecret }}
4444
TENANT_ID: {{ $v.oidc.tenantID }}
4545
TENANT_CLIENT_ID: {{ $v.oidc.clientID }}

‎values/oauth2-proxy/oauth2-proxy-raw.gotmpl

-3
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,6 @@ resources:
1818
{{- end }}
1919
kubernetes.io/ingress.class: nginx
2020
ingress.kubernetes.io/ssl-redirect: {{ if $v.otomi.hasCloudLB }}"false"{{ else }}"true"{{ end }}
21-
{{- if $hasKeycloak }}
22-
nginx.ingress.kubernetes.io/auth-response-headers: Authorization
23-
{{- end }}
2421
nginx.ingress.kubernetes.io/configuration-snippet: |
2522
# rewrite auth redirects to original hosts
2623
rewrite ^/oauth2/redirect/(.*) https://$1 redirect;

‎values/oauth2-proxy/oauth2-proxy.gotmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ image:
1212
repository: quay.io/oauth2-proxy/oauth2-proxy
1313

1414
config:
15-
clientID: {{ $o.clientID }}
16-
clientSecret: {{ $o.clientSecret }}
15+
clientID: {{ $hasKeycloak | ternary $k.idp.clientID $o.clientID }}
16+
clientSecret: {{ $hasKeycloak | ternary $k.idp.clientSecret $o.clientSecret }}
1717
cookieSecret: {{ $v | getOrNil "charts.oauth2-proxy.config.cookieSecret" | default "blajajaaa" }}
1818

1919
replicas: 2

‎values/otomi-api/otomi-api.gotmpl

+2-3
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,9 @@ secrets:
2525
{{- if $v.sops.enabled }}
2626
GCLOUD_SERVICE_KEY: '{{ $o.tools.gcloudServiceKey }}'
2727
{{- end }}
28-
OIDC_CLIENT_SECRET: {{ $v.oidc.clientSecret }}
2928

3029
env:
31-
# DEBUG: '*'
30+
DEBUG: '*'
3231
GIT_REPO_URL: {{ $o.git.repoUrl }}
3332
GIT_BRANCH: {{ $o | get "git.branch" "master" }}
3433
CLUSTER_ID: {{ printf "%s/%s" $c.provider $c.name }}
@@ -39,7 +38,7 @@ env:
3938
{{- end }}
4039
USE_SOPS: {{ $v.sops.enabled }}
4140
CORE_VERSION: '{{ $version }}'
42-
{{- if (not ($v.charts.keycloak | get "enabled" false)) }}
41+
{{- if (not ($v.charts.keycloak | get "enabled" true)) }}
4342
NO_AUTHZ: true
4443
{{- end }}
4544

‎values/prometheus-operator/prometheus-operator.gotmpl

+1-2
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,9 @@
66
{{- $hasKeycloak := $k | get "enabled" true }}
77
{{- $realm := $k | get "realm" "master" }}
88
{{- $keycloakBase := printf "https://keycloak.%s/realms/%s" $v.cluster.domain $realm }}
9-
{{- $hasOauth2 := or $hasKeycloak (hasKey $v.oidc "oauth2") }}
109
{{- $appsDomain := printf "apps.%s" $v.cluster.domain }}
1110
{{- $slackTpl := tpl (readFile "../../helmfile.d/snippets/slack.gotmpl") $v | toString }}
12-
{{- $grafanaIni := tpl (readFile "../../helmfile.d/snippets/grafana.gotmpl") (dict "keycloakBase" $keycloakBase "hasKeycloak" $hasKeycloak "hasOauth2" $hasOauth2 "oidc" $v.oidc "stage" $stage "keycloak" ($k | get "idp")) | toString }}
11+
{{- $grafanaIni := tpl (readFile "../../helmfile.d/snippets/grafana.gotmpl") (dict "keycloakBase" $keycloakBase "hasKeycloak" $hasKeycloak "oidc" $v.oidc "stage" $stage "keycloak" ($k | get "idp")) | toString }}
1312
nameOverride: po
1413
fullnameOverride: po
1514
coreDns:

0 commit comments

Comments
 (0)