Skip to content

Commit f15db70

Browse files
michaelwmichaelw
authored
feat(deploy): add existing-gateway GKE platform and app profiles (#176)
* feat(deploy): add existing-gateway GKE profiles * fix(deploy): honor GKE Gateway section name * fix(deploy): secure GKE platform callout * fix(deploy): parse GKE extension status portably * fix(deploy): support externally terminated TLS * feat(deploy): add GKE platform demo fixture * docs: add GKE platform demo quickstart * fix(devspace): forward dashboard arguments * perf(dashboard): reduce repeated cluster reads
1 parent 8925e3f commit f15db70

40 files changed

Lines changed: 2534 additions & 232 deletions

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,14 +103,19 @@ jobs:
103103
uses: ./.github/actions/setup-helm
104104

105105
- name: Build chart dependencies
106-
run: helm dependency build charts/ext-authz-token-exchange
106+
run: |
107+
helm dependency build charts/ext-authz-token-exchange
108+
helm dependency build charts/keycloak
107109
108110
- name: Lint production chart
109111
run: helm lint charts/ext-authz-token-exchange
110112

111113
- name: Lint e2e chart
112114
run: helm lint charts/ext-authz-token-exchange-e2e
113115

116+
- name: Lint Keycloak chart
117+
run: helm lint charts/keycloak
118+
114119
- name: Render manifests
115120
run: |
116121
mkdir -p artifacts/manifests
@@ -121,6 +126,9 @@ jobs:
121126
--namespace ext-authz-token-exchange-e2e \
122127
> artifacts/manifests/ext-authz-token-exchange-e2e.yaml
123128
129+
- name: Verify GKE platform and app renders
130+
run: ./scripts/verify-gke-deployment-model.sh
131+
124132
- name: Upload rendered manifests
125133
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
126134
with:

‎DEVELOPMENT.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,10 +183,13 @@ go test ./...
183183
go test -coverprofile=coverage.out ./...
184184
go build ./cmd/...
185185
helm dependency build charts/ext-authz-token-exchange
186+
helm dependency build charts/keycloak
186187
helm lint charts/ext-authz-token-exchange
187188
helm lint charts/ext-authz-token-exchange-e2e
189+
helm lint charts/keycloak
188190
helm template ext-authz-token-exchange charts/ext-authz-token-exchange --namespace ext-authz-token-exchange
189191
helm template ext-authz-token-exchange-e2e charts/ext-authz-token-exchange-e2e --namespace ext-authz-token-exchange-e2e
192+
./scripts/verify-gke-deployment-model.sh
190193
```
191194

192195
Go coverage is uploaded to Codecov and `coverage.out` remains available as a

‎README.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,10 @@ Profiles are composable. On a fresh cluster, use `devspace deploy -p with-infra`
124124
to install required starter-pack infrastructure, including starter-pack's
125125
`with-test` httpbin routes, plus this repo's demo/e2e stack.
126126

127-
Refer to the [DevSpace](docs/devspace.md) and [devspace-starter-pack](https://github.com/michaelw/devspace-starter-pack) documentation
128-
for more information.
127+
Refer to the [DevSpace](docs/devspace.md),
128+
[GKE Platform Demo Quickstart](docs/gke-platform-demo.md), and
129+
[devspace-starter-pack](https://github.com/michaelw/devspace-starter-pack)
130+
documentation for more information.
129131

130132
### Uninstall
131133

‎charts/ext-authz-token-exchange-e2e/templates/_helpers.tpl‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,11 @@ helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | quote }}
55
{{- end }}
66

77
{{- define "ext-authz-token-exchange-e2e.teamNamespace" -}}
8-
{{- printf "%s-%s" $.Values.namespacePrefix .color -}}
8+
{{- .namespace | default (printf "%s-%s" $.Values.namespacePrefix .color) -}}
9+
{{- end }}
10+
11+
{{- define "ext-authz-token-exchange-e2e.teamPathPrefix" -}}
12+
{{- .pathPrefix | default (printf "/anything/%s" .color) -}}
913
{{- end }}
1014

1115
{{- define "ext-authz-token-exchange-e2e.fakeTokenEndpointConfigMapName" -}}
@@ -63,9 +67,17 @@ local
6367

6468
{{- define "ext-authz-token-exchange-e2e.policyConfig" -}}
6569
{{- $resources := .resources }}
70+
{{- if .resourcePaths }}
71+
{{- $resources = list }}
72+
{{- range $path := .resourcePaths }}
73+
{{- $resources = append $resources (printf "%s%s" $.Values.policy.httpbinResourceBase $path) }}
74+
{{- end }}
75+
{{- end }}
6676
{{- if not (hasKey . "resources") }}
77+
{{- if not .resourcePaths }}
6778
{{- $resources = list (printf "%s%s" $.Values.policy.httpbinResourceBase .pathPrefix) }}
6879
{{- end }}
80+
{{- end }}
6981
{{- $audiences := .audiences }}
7082
{{- if and (not (hasKey . "audiences")) .audience }}
7183
{{- $audiences = list .audience }}

‎charts/ext-authz-token-exchange-e2e/templates/demo-route.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{{- if .Values.demoRoute.enabled }}
2+
apiVersion: gateway.networking.k8s.io/v1
3+
kind: HTTPRoute
4+
metadata:
5+
name: txe-demo
6+
namespace: {{ .Values.demoRoute.gatewayNamespace | quote }}
7+
labels:
8+
{{ include "ext-authz-token-exchange-e2e.labels" . | indent 4 }}
9+
ext-authz-token-exchange.magneticflux.net/deployment-model: gke-platform
10+
ext-authz-token-exchange.magneticflux.net/fixture: demo
11+
spec:
12+
parentRefs:
13+
- name: {{ .Values.demoRoute.gatewayName | quote }}
14+
sectionName: {{ .Values.demoRoute.gatewaySectionName | quote }}
15+
hostnames:
16+
- {{ .Values.demoRoute.host | quote }}
17+
rules:
18+
- matches:
19+
- path:
20+
type: PathPrefix
21+
value: {{ .Values.demoRoute.pathPrefix | quote }}
22+
backendRefs:
23+
- name: {{ .Values.demoRoute.serviceName | quote }}
24+
namespace: {{ .Values.demoRoute.backendNamespace | quote }}
25+
port: {{ .Values.demoRoute.servicePort }}
26+
{{- end }}

‎charts/ext-authz-token-exchange-e2e/templates/fake-token-endpoint.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if .Values.fakeTokenEndpoint.enabled }}
12
{{- if .Values.fakeTokenEndpoint.routes }}
23
apiVersion: v1
34
kind: ConfigMap
@@ -94,3 +95,4 @@ spec:
9495
- name: http
9596
port: {{ .Values.fakeTokenEndpoint.port }}
9697
targetPort: http
98+
{{- end }}

‎charts/ext-authz-token-exchange-e2e/templates/platform-routes.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{{- if .Values.platformRoutes.enabled }}
2+
{{- $root := trimSuffix "/" .Values.platformRoutes.teamPathRoot }}
3+
{{- range $rawTeam := splitList "," .Values.platformRoutes.teamNames }}
4+
{{- $team := trim $rawTeam }}
5+
{{- if $team }}
6+
apiVersion: gateway.networking.k8s.io/v1
7+
kind: HTTPRoute
8+
metadata:
9+
name: {{ printf "txe-team-%s" $team | trunc 63 | trimSuffix "-" | quote }}
10+
namespace: {{ $.Values.platformRoutes.gatewayNamespace | quote }}
11+
labels:
12+
{{ include "ext-authz-token-exchange-e2e.labels" $ | indent 4 }}
13+
ext-authz-token-exchange.magneticflux.net/deployment-model: gke-platform
14+
ext-authz-token-exchange.magneticflux.net/team: {{ $team | quote }}
15+
spec:
16+
parentRefs:
17+
- name: {{ $.Values.platformRoutes.gatewayName | quote }}
18+
sectionName: {{ $.Values.platformRoutes.gatewaySectionName | quote }}
19+
hostnames:
20+
- {{ $.Values.platformRoutes.host | quote }}
21+
rules:
22+
- matches:
23+
- path:
24+
type: PathPrefix
25+
value: {{ printf "%s/%s" $root $team | quote }}
26+
backendRefs:
27+
- name: {{ $.Values.platformRoutes.serviceName | quote }}
28+
namespace: {{ printf "%s-%s" $.Values.platformRoutes.teamNamespacePrefix $team | quote }}
29+
port: {{ $.Values.platformRoutes.servicePort }}
30+
---
31+
{{- end }}
32+
{{- end }}
33+
{{- end }}

‎charts/ext-authz-token-exchange-e2e/templates/policies.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{{- range $team := .Values.teams }}
2-
{{- $namespace := include "ext-authz-token-exchange-e2e.teamNamespace" (dict "Values" $.Values "color" $team.color) }}
2+
{{- $namespace := include "ext-authz-token-exchange-e2e.teamNamespace" (dict "Values" $.Values "color" $team.color "namespace" $team.namespace) }}
33
{{- $audience := printf "httpbin-%s" $team.color }}
4-
{{- $baseScenario := mergeOverwrite (dict "scope" $team.color "pathPrefix" (printf "/anything/%s" $team.color) "audience" $audience) (omit $team "color" "scenarios") }}
4+
{{- $baseScenario := mergeOverwrite (dict "scope" $team.color "pathPrefix" (include "ext-authz-token-exchange-e2e.teamPathPrefix" $team) "audience" $audience) (omit $team "color" "namespace" "scenarios") }}
55
apiVersion: v1
66
kind: ConfigMap
77
metadata:
@@ -31,7 +31,7 @@ data:
3131
{{- end }}
3232
{{- end }}
3333
{{- range $group := .Values.additionalScenarios }}
34-
{{- $namespace := include "ext-authz-token-exchange-e2e.teamNamespace" (dict "Values" $.Values "color" $group.color) }}
34+
{{- $namespace := include "ext-authz-token-exchange-e2e.teamNamespace" (dict "Values" $.Values "color" $group.color "namespace" $group.namespace) }}
3535
{{- $audience := printf "httpbin-%s" $group.color }}
3636
{{- range $scenario := $group.scenarios }}
3737
{{- $scenarioConfig := merge (dict "audience" $audience) $scenario }}

‎charts/ext-authz-token-exchange-e2e/templates/team-apps.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{{- if .Values.teamApp.enabled }}
2+
{{- range $team := .Values.teams }}
3+
{{- $namespace := include "ext-authz-token-exchange-e2e.teamNamespace" (dict "Values" $.Values "color" $team.color "namespace" $team.namespace) }}
4+
apiVersion: apps/v1
5+
kind: Deployment
6+
metadata:
7+
name: {{ $.Values.teamApp.name | quote }}
8+
namespace: {{ $namespace | quote }}
9+
labels:
10+
{{ include "ext-authz-token-exchange-e2e.labels" $ | indent 4 }}
11+
app.kubernetes.io/name: {{ $.Values.teamApp.name | quote }}
12+
spec:
13+
replicas: 1
14+
selector:
15+
matchLabels:
16+
app.kubernetes.io/name: {{ $.Values.teamApp.name | quote }}
17+
template:
18+
metadata:
19+
labels:
20+
{{ include "ext-authz-token-exchange-e2e.labels" $ | indent 8 }}
21+
app.kubernetes.io/name: {{ $.Values.teamApp.name | quote }}
22+
spec:
23+
containers:
24+
- name: httpbin
25+
image: {{ $.Values.teamApp.image | quote }}
26+
imagePullPolicy: {{ $.Values.teamApp.imagePullPolicy | quote }}
27+
ports:
28+
- name: http
29+
containerPort: {{ $.Values.teamApp.port }}
30+
readinessProbe:
31+
httpGet:
32+
path: /status/204
33+
port: http
34+
resources:
35+
{{ toYaml $.Values.teamApp.resources | indent 12 }}
36+
---
37+
apiVersion: v1
38+
kind: Service
39+
metadata:
40+
name: {{ $.Values.teamApp.name | quote }}
41+
namespace: {{ $namespace | quote }}
42+
labels:
43+
{{ include "ext-authz-token-exchange-e2e.labels" $ | indent 4 }}
44+
app.kubernetes.io/name: {{ $.Values.teamApp.name | quote }}
45+
spec:
46+
selector:
47+
app.kubernetes.io/name: {{ $.Values.teamApp.name | quote }}
48+
ports:
49+
- name: http
50+
port: {{ $.Values.teamApp.port }}
51+
targetPort: http
52+
appProtocol: http
53+
---
54+
apiVersion: gateway.networking.k8s.io/v1beta1
55+
kind: ReferenceGrant
56+
metadata:
57+
name: {{ printf "%s-from-%s" $.Values.teamApp.name $.Values.teamApp.gatewayNamespace | trunc 63 | trimSuffix "-" | quote }}
58+
namespace: {{ $namespace | quote }}
59+
labels:
60+
{{ include "ext-authz-token-exchange-e2e.labels" $ | indent 4 }}
61+
spec:
62+
from:
63+
- group: gateway.networking.k8s.io
64+
kind: HTTPRoute
65+
namespace: {{ $.Values.teamApp.gatewayNamespace | quote }}
66+
to:
67+
- group: ""
68+
kind: Service
69+
name: {{ $.Values.teamApp.name | quote }}
70+
---
71+
{{- end }}
72+
{{- end }}

‎charts/ext-authz-token-exchange-e2e/templates/unselected-namespaces.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- range $namespace := .Values.unselectedNamespaces }}
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: {{ $namespace | quote }}
6+
labels:
7+
{{ include "ext-authz-token-exchange-e2e.labels" $ | indent 4 }}
8+
---
9+
{{- end }}

0 commit comments

Comments
 (0)