Skip to content

Commit 432fcf1

Browse files
bert-ebert-e
committed
Merge branch 'feature/MK8S-140-Salt-deploy-oidc-proxy-resources' into q/133.0
2 parents a8cae1a + cad8035 commit 432fcf1

File tree

9 files changed

+478
-4
lines changed

9 files changed

+478
-4
lines changed

‎buildchain/buildchain/salt_tree.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,11 @@ def _download_ui_operator_crds() -> str:
407407
Path("salt/metalk8s/addons/prometheus-operator/deployed/service-configuration.sls"),
408408
Path("salt/metalk8s/addons/prometheus-operator/deployed/thanos-chart.sls"),
409409
Path("salt/metalk8s/addons/prometheus-operator/deployed/thanos-query-sd-files.sls"),
410+
Path("salt/metalk8s/addons/prometheus-operator/deployed/oidc-proxy-rbac.sls"),
411+
Path("salt/metalk8s/addons/prometheus-operator/deployed/oidc-proxy-prometheus.sls"),
412+
Path(
413+
"salt/metalk8s/addons/prometheus-operator/deployed/oidc-proxy-alertmanager.sls"
414+
),
410415
Path("salt/metalk8s/addons/ui/deployed/dependencies.sls"),
411416
Path("salt/metalk8s/addons/ui/deployed/ingress.sls"),
412417
Path("salt/metalk8s/addons/ui/deployed/init.sls"),

‎salt/metalk8s/addons/prometheus-operator/config/alertmanager.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ spec:
2020
audience: "" # Expected audience claim in the token
2121
groupsClaim: "" # JWT claim name that carries user groups/roles
2222
authorizedGroups: [] # Groups/roles allowed to access Alertmanager
23+
caSecret:
24+
namespace: "" # Namespace of the secret containing the CA certificate (must be labeled with metalk8s.scality.com/oidc-ca: "true")
25+
name: "" # Name of the secret containing the CA certificate
2326
notification:
2427
config:
2528
global:

‎salt/metalk8s/addons/prometheus-operator/config/prometheus.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ spec:
1717
audience: "" # Expected audience claim in the token
1818
groupsClaim: "" # JWT claim name that carries user groups/roles
1919
authorizedGroups: [] # Groups/roles allowed to access Prometheus
20+
caSecret:
21+
namespace: "" # Namespace of the secret containing the CA certificate (must be labeled with metalk8s.scality.com/oidc-ca: "true")
22+
name: "" # Name of the secret containing the CA certificate
2023
serviceMonitor:
2124
kubelet:
2225
scrapeTimeout: 10s

‎salt/metalk8s/addons/prometheus-operator/deployed/init.sls‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,6 @@ include:
1010
- .kube-alerts-rules
1111
- .thanos-query-sd-files
1212
- .thanos-chart
13+
- .oidc-proxy-rbac
14+
- .oidc-proxy-prometheus
15+
- .oidc-proxy-alertmanager

‎salt/metalk8s/addons/prometheus-operator/deployed/oidc-proxy-alertmanager.sls‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
{%- from "metalk8s/repo/macro.sls" import build_image_name with context %}
2+
{%- from "metalk8s/map.jinja" import coredns with context %}
3+
4+
{%- set alertmanager_defaults = salt.slsutil.renderer(
5+
'salt://metalk8s/addons/prometheus-operator/config/alertmanager.yaml',
6+
saltenv=saltenv
7+
)
8+
%}
9+
10+
{%- set alertmanager = salt.metalk8s_service_configuration.get_service_conf(
11+
'metalk8s-monitoring', 'metalk8s-alertmanager-config', alertmanager_defaults
12+
)
13+
%}
14+
15+
{%- set alertmanager_oidc_enabled = alertmanager.spec.get('config', {}).get('enable_oidc_authentication', False) %}
16+
{%- set alertmanager_oidc = alertmanager.spec.get('config', {}).get('oidc', {}) %}
17+
18+
{%- set alertmanager_oidc_ca = alertmanager_oidc.get('caSecret', {}) %}
19+
{%- set ca_namespace = alertmanager_oidc_ca.get('namespace', 'metalk8s-ingress') %}
20+
{%- set ca_name = alertmanager_oidc_ca.get('name', 'ingress-control-plane-default-certificate') %}
21+
22+
{%- set ca_file = 'namespace_' ~ ca_namespace ~ '.secret_' ~ ca_name ~ '.tls.crt' %}
23+
24+
{%- if alertmanager_oidc_enabled %}
25+
26+
Create oauth2-proxy-alertmanager Deployment:
27+
metalk8s_kubernetes.object_present:
28+
- manifest:
29+
apiVersion: apps/v1
30+
kind: Deployment
31+
metadata:
32+
name: oauth2-proxy-alertmanager
33+
namespace: metalk8s-monitoring
34+
labels:
35+
app: oauth2-proxy-alertmanager
36+
spec:
37+
replicas: 1
38+
selector:
39+
matchLabels:
40+
app: oauth2-proxy-alertmanager
41+
template:
42+
metadata:
43+
labels:
44+
app: oauth2-proxy-alertmanager
45+
spec:
46+
serviceAccountName: oidc-proxy-alertmanager
47+
initContainers:
48+
- name: k8s-sidecar
49+
image: {{ build_image_name("k8s-sidecar") }}
50+
imagePullPolicy: IfNotPresent
51+
restartPolicy: Always
52+
env:
53+
- name: LABEL
54+
value: metalk8s.scality.com/oidc-ca
55+
- name: FOLDER
56+
value: /tmp/secrets
57+
- name: NAMESPACE
58+
value: {{ ca_namespace }}
59+
- name: RESOURCE
60+
value: secret
61+
- name: UNIQUE_FILENAMES
62+
value: "true"
63+
volumeMounts:
64+
- name: secrets-volume
65+
mountPath: /tmp/secrets
66+
containers:
67+
- name: oauth2-proxy
68+
image: {{ build_image_name("oauth2-proxy") }}
69+
args:
70+
- --provider=oidc
71+
- --oidc-issuer-url={{ alertmanager_oidc.get('issuer', '') }}
72+
- --client-id={{ alertmanager_oidc.get('audience', '') }}
73+
# cookie-secret is required by oauth2-proxy but never used since all
74+
# authentication goes through JWT bearer tokens (--skip-jwt-bearer-tokens=true).
75+
# Any valid base64-encoded 32-byte value works here.
76+
- --cookie-secret=MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXY=
77+
- --client-secret=unused-but-required
78+
- --skip-jwt-bearer-tokens=true
79+
- --email-domain=*
80+
- --upstream=http://prometheus-operator-alertmanager.metalk8s-monitoring.svc:9093
81+
- --oidc-groups-claim={{ alertmanager_oidc.get('groupsClaim', 'roles') }}
82+
{%- for group in alertmanager_oidc.get('authorizedGroups', []) %}
83+
- --allowed-group={{ group }}
84+
{%- endfor %}
85+
- --provider-ca-file=/tmp/secrets/{{ ca_file }}
86+
- --http-address=0.0.0.0:9093
87+
ports:
88+
- containerPort: 9093
89+
volumeMounts:
90+
- name: secrets-volume
91+
mountPath: /tmp/secrets
92+
readOnly: true
93+
volumes:
94+
- name: secrets-volume
95+
emptyDir: {}
96+
97+
Create oauth2-proxy-alertmanager Service:
98+
metalk8s_kubernetes.object_present:
99+
- manifest:
100+
apiVersion: v1
101+
kind: Service
102+
metadata:
103+
name: oauth2-proxy-alertmanager
104+
namespace: metalk8s-monitoring
105+
labels:
106+
app: oauth2-proxy-alertmanager
107+
spec:
108+
selector:
109+
app: oauth2-proxy-alertmanager
110+
ports:
111+
- port: 9093
112+
113+
{%- else %}
114+
115+
Ensure oauth2-proxy-alertmanager Deployment does not exist:
116+
metalk8s_kubernetes.object_absent:
117+
- name: oauth2-proxy-alertmanager
118+
- namespace: metalk8s-monitoring
119+
- kind: Deployment
120+
- apiVersion: apps/v1
121+
122+
Ensure oauth2-proxy-alertmanager Service does not exist:
123+
metalk8s_kubernetes.object_absent:
124+
- name: oauth2-proxy-alertmanager
125+
- namespace: metalk8s-monitoring
126+
- kind: Service
127+
- apiVersion: v1
128+
129+
{%- endif %}
130+
131+
Create alertmanager-proxy Service:
132+
metalk8s_kubernetes.object_present:
133+
- manifest:
134+
apiVersion: v1
135+
kind: Service
136+
metadata:
137+
name: alertmanager-proxy
138+
namespace: metalk8s-monitoring
139+
labels:
140+
app.kubernetes.io/managed-by: salt
141+
app.kubernetes.io/part-of: metalk8s
142+
heritage: metalk8s
143+
spec:
144+
type: ExternalName
145+
{%- if alertmanager_oidc_enabled %}
146+
externalName: oauth2-proxy-alertmanager.metalk8s-monitoring.svc.{{ coredns.cluster_domain }}
147+
{%- else %}
148+
externalName: prometheus-operator-alertmanager.metalk8s-monitoring.svc.{{ coredns.cluster_domain }}
149+
{%- endif %}
150+
ports:
151+
- port: 9093

‎salt/metalk8s/addons/prometheus-operator/deployed/oidc-proxy-prometheus.sls‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
{%- from "metalk8s/repo/macro.sls" import build_image_name with context %}
2+
{%- from "metalk8s/map.jinja" import coredns with context %}
3+
4+
{%- set prometheus_defaults = salt.slsutil.renderer(
5+
'salt://metalk8s/addons/prometheus-operator/config/prometheus.yaml',
6+
saltenv=saltenv
7+
)
8+
%}
9+
10+
{%- set prometheus = salt.metalk8s_service_configuration.get_service_conf(
11+
'metalk8s-monitoring', 'metalk8s-prometheus-config', prometheus_defaults
12+
)
13+
%}
14+
15+
{%- set prometheus_oidc_enabled = prometheus.spec.get('config', {}).get('enable_oidc_authentication', False) %}
16+
{%- set prometheus_oidc = prometheus.spec.get('config', {}).get('oidc', {}) %}
17+
18+
{%- set prometheus_oidc_ca = prometheus_oidc.get('caSecret', {}) %}
19+
{%- set ca_namespace = prometheus_oidc_ca.get('namespace', 'metalk8s-ingress') %}
20+
{%- set ca_name = prometheus_oidc_ca.get('name', 'ingress-control-plane-default-certificate') %}
21+
{%- set ca_file = 'namespace_' ~ ca_namespace ~ '.secret_' ~ ca_name ~ '.tls.crt' %}
22+
23+
{%- if prometheus_oidc_enabled %}
24+
25+
Create oauth2-proxy-prometheus Deployment:
26+
metalk8s_kubernetes.object_present:
27+
- manifest:
28+
apiVersion: apps/v1
29+
kind: Deployment
30+
metadata:
31+
name: oauth2-proxy-prometheus
32+
namespace: metalk8s-monitoring
33+
labels:
34+
app: oauth2-proxy-prometheus
35+
spec:
36+
replicas: 1
37+
selector:
38+
matchLabels:
39+
app: oauth2-proxy-prometheus
40+
template:
41+
metadata:
42+
labels:
43+
app: oauth2-proxy-prometheus
44+
spec:
45+
serviceAccountName: oidc-proxy-prometheus
46+
initContainers:
47+
- name: k8s-sidecar
48+
image: {{ build_image_name("k8s-sidecar") }}
49+
imagePullPolicy: IfNotPresent
50+
restartPolicy: Always
51+
env:
52+
- name: LABEL
53+
value: metalk8s.scality.com/oidc-ca
54+
- name: FOLDER
55+
value: /tmp/secrets
56+
- name: NAMESPACE
57+
value: {{ ca_namespace }}
58+
- name: RESOURCE
59+
value: secret
60+
- name: UNIQUE_FILENAMES
61+
value: "true"
62+
volumeMounts:
63+
- name: secrets-volume
64+
mountPath: /tmp/secrets
65+
containers:
66+
- name: oauth2-proxy
67+
image: {{ build_image_name("oauth2-proxy") }}
68+
args:
69+
- --provider=oidc
70+
- --oidc-issuer-url={{ prometheus_oidc.get('issuer', '') }}
71+
- --client-id={{ prometheus_oidc.get('audience', '') }}
72+
# cookie-secret is required by oauth2-proxy but never used since all
73+
# authentication goes through JWT bearer tokens (--skip-jwt-bearer-tokens=true).
74+
# Any valid base64-encoded 32-byte value works here.
75+
- --cookie-secret=MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXY=
76+
- --client-secret=unused-but-required
77+
- --skip-jwt-bearer-tokens=true
78+
- --email-domain=*
79+
- --upstream=http://thanos-query-http.metalk8s-monitoring.svc:10902
80+
- --oidc-groups-claim={{ prometheus_oidc.get('groupsClaim', 'roles') }}
81+
{%- for group in prometheus_oidc.get('authorizedGroups', []) %}
82+
- --allowed-group={{ group }}
83+
{%- endfor %}
84+
- --provider-ca-file=/tmp/secrets/{{ ca_file }}
85+
- --http-address=0.0.0.0:10902
86+
ports:
87+
- containerPort: 10902
88+
volumeMounts:
89+
- name: secrets-volume
90+
mountPath: /tmp/secrets
91+
readOnly: true
92+
volumes:
93+
- name: secrets-volume
94+
emptyDir: {}
95+
96+
Create oauth2-proxy-prometheus Service:
97+
metalk8s_kubernetes.object_present:
98+
- manifest:
99+
apiVersion: v1
100+
kind: Service
101+
metadata:
102+
name: oauth2-proxy-prometheus
103+
namespace: metalk8s-monitoring
104+
labels:
105+
app: oauth2-proxy-prometheus
106+
spec:
107+
selector:
108+
app: oauth2-proxy-prometheus
109+
ports:
110+
- port: 10902
111+
112+
{%- else %}
113+
114+
Ensure oauth2-proxy-prometheus Deployment does not exist:
115+
metalk8s_kubernetes.object_absent:
116+
- name: oauth2-proxy-prometheus
117+
- namespace: metalk8s-monitoring
118+
- kind: Deployment
119+
- apiVersion: apps/v1
120+
121+
Ensure oauth2-proxy-prometheus Service does not exist:
122+
metalk8s_kubernetes.object_absent:
123+
- name: oauth2-proxy-prometheus
124+
- namespace: metalk8s-monitoring
125+
- kind: Service
126+
- apiVersion: v1
127+
128+
{%- endif %}
129+
130+
Create prometheus-proxy Service:
131+
metalk8s_kubernetes.object_present:
132+
- manifest:
133+
apiVersion: v1
134+
kind: Service
135+
metadata:
136+
name: prometheus-proxy
137+
namespace: metalk8s-monitoring
138+
labels:
139+
app.kubernetes.io/managed-by: salt
140+
app.kubernetes.io/part-of: metalk8s
141+
heritage: metalk8s
142+
spec:
143+
type: ExternalName
144+
{%- if prometheus_oidc_enabled %}
145+
externalName: oauth2-proxy-prometheus.metalk8s-monitoring.svc.{{ coredns.cluster_domain }}
146+
{%- else %}
147+
externalName: thanos-query-http.metalk8s-monitoring.svc.{{ coredns.cluster_domain }}
148+
{%- endif %}
149+
ports:
150+
- port: 10902

0 commit comments

Comments
 (0)