Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enhance Dex Deployment to Pull Configuration from Catalogues for Target Cluster #135

Closed
lb4368 opened this issue May 5, 2021 · 10 comments
Closed

Enhance Dex Deployment to Pull Configuration from Catalogues for Target Cluster #135

lb4368 opened this issue May 5, 2021 · 10 comments
Assignees
@sshiba
Labels
2-Manifests Relates to manifest/document set related issues enhancement New feature or request priority/medium Default priority for items size m 2-5 days [moderate complexity, generic code, or enhancement to existing feature]]
Milestone
v2.1

Comments

@lb4368
Copy link

lb4368 commented May 5, 2021 •
edited
Loading

Problem description
Currently, the configuration for Dex (#19) in a target cluster has values hard-coded in function/type manifests.

Proposed change
Enhance Dex deployment such that configuration for Dex is set/overridden in site-specific catalogues and that sensitive information (CA certs/keys, passwords) are properly encrypted when saved.

Configuration includes:

  • The NodePort on the target cluster where the auth service will be exposed for HTTPS access
  • The LDAP back-end info (URL, credentials, search attributes, etc.)
  • Sub-cluster information needed to enable authentication (CA cert/key, API server port, VIP address(es), FQDN(s), etc.)
@lb4368 lb4368 added enhancement New feature or request triage labels May 5, 2021
@sshiba
Copy link
Contributor

sshiba commented May 6, 2021

You can assign this issue to me.

@lb4368 lb4368 mentioned this issue May 6, 2021
Closed
@jezogwza jezogwza added 2-Manifests Relates to manifest/document set related issues priority/medium Default priority for items and removed triage labels May 12, 2021
@jezogwza jezogwza added this to the v2.1 milestone May 12, 2021
@jezogwza
Copy link

Similar comment as #136

@sshiba
Copy link
Contributor

sshiba commented May 12, 2021

This feature can only be partially implemented. The replacement transformer can be applied to the dex-aio HelmRelease resource but cannot be applied to the API server OIDC configuration as the "kustomization" is done through JSON format patch.

The kustomize supported by the airshipctl command does not support the ability to add new elements to a list when using patchesStrategicMerge. Instead, it replaces the existing elements. which is needed, with the new elements specified in the yaml patch.

There is a new kustomize feature (in kustomize v4.1.2), OpenAPI Schema that supports this capability. The example provided works exactly as described but unfortunately, when I applied to the KubeadmControlPlane CR, it didn't work. This issues has already been reported in URLs listed below:

@lb4368
Copy link
Author

lb4368 commented May 13, 2021

@sshiba I removed "Replica counts for the Dex pods" as a configuration item in the catalogue. Rather than including replica counts as a catalogue item, if the default replica count need to be overridden, it can be done at the site level via a kustomize patch.

@eak13 eak13 added the size m 2-5 days [moderate complexity, generic code, or enhancement to existing feature]] label May 13, 2021
@sshiba
Copy link
Contributor

sshiba commented May 20, 2021

Feature being implemented in https://review.opendev.org/c/airship/treasuremap/+/791835.
Currently in testing & validation stage

@lb4368 lb4368 mentioned this issue May 20, 2021
Closed
@sshiba
Copy link
Contributor

sshiba commented May 26, 2021

Addressed comments in PS but still need to decide where to put strategic merge for dex/LDAP connector.

@sshiba
Copy link
Contributor

sshiba commented May 27, 2021

PS https://review.opendev.org/c/airship/treasuremap/+/791835 includes Dex/LDAP patch (patchesStrategicMerge) in treasuremap/manifests/type/subcluster/provide-infra, which will be invoked by lma and wordpress under /type/multi-tenant/subclusters

@sshiba
Copy link
Contributor

sshiba commented May 28, 2021

https://review.opendev.org/c/airship/treasuremap/+/791835 is ready for review. Just waiting for zuul to pass first.

@sshiba
Copy link
Contributor

sshiba commented Jun 2, 2021

https://review.opendev.org/c/airship/treasuremap/+/791835 is ready for review

airshipbot pushed a commit that referenced this issue Jun 9, 2021
@SaurabhArora86
Changes in Treasuremap for HelmRepository function
8f3a4e3 
As HelmRepository resource used by dex-aio was renamed and moved
airshipctl/manifest/function/helm-chart-repository,
airship-core (workload) and multi-tenant (workload) types were updated accordingly.

Relates-To: #135
Change-Id: Ia4bd9af2d388b921c18e62e770a2a6d0744cbee8
airshipbot pushed a commit that referenced this issue Jun 17, 2021
Treasuremap - Dex/API server w/ Catalogue Support
7e89d65 
This patchset introduces the VariableCatalogue and respective
Replacement transformers for the Dex/API server. It also implements the
kustomization of LDAP values through patches.

The VariableCatalogue for Dex/API server is located under
manifests/function/treasuremap-base-catalogues/utility-catalogue.yaml.

The replacement transformers for Dex HelmRelease and API server are
located at:
- Dex HelmRelease: manifests/function/dex-aio/replacements
- API Server: manifests/function/k8scontrol-ha/replacements

The API server replacement transformer is invoked when executing the
command "airshipctl phase run controlplane-ephemeral".

The dex-aio service replacement transformer is invoked when executing
the command "airshipctl phase run workload-target". During this phase
the LDAP values are also "kustomized" through patchesStrategicMerge.
Similar patch was add for the subclusters/provide-infra.
Also updated dex-aio nodeSelector to deploy pod on the worker node.

This patchset also supports the LDAP Group authentication.

It also updated
treasuremap/manifests/site/test-site/target/encrypted/results/imported/secrets.yaml
with the encrypted LDAP Binding password.

Relates-To: #135, #137, #128
Change-Id: Ie7eef44a8f0e9d02860a94a4140841d8662f8c85
@sshiba
Copy link
Contributor

sshiba commented Jun 17, 2021

PS https://review.opendev.org/c/airship/treasuremap/+/791835 has been merged completing this issue.

@lb4368 lb4368 closed this as completed Jun 17, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sshiba sshiba

Labels
2-Manifests Relates to manifest/document set related issues enhancement New feature or request priority/medium Default priority for items size m 2-5 days [moderate complexity, generic code, or enhancement to existing feature]]
Projects
None yet
Milestone
v2.1
Development

No branches or pull requests
4 participants
@lb4368 @sshiba @eak13 @jezogwza