Skip to content

feat: add support for Keycloak/Cognito to OCP deployment profile #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Strum355 wants to merge 1 commit into
base: 0.0.3
Choose a base branch
from
+66 −42
Open

feat: add support for Keycloak/Cognito to OCP deployment profile #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions internal/resources/webapp/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ const (
// EnvDockerConfig points to the Docker config directory.
EnvDockerConfig = "DOCKER_CONFIG"
// EnvQuarkusRestClientExploitIQURL is the URL for the ExploitIQ REST client.
EnvQuarkusRestClientExploitIQURL = "QUARKUS_REST-CLIENT_EXPLOIT_IQ_URL"
EnvQuarkusRestClientExploitIQURL = "QUARKUS_REST_CLIENT_EXPLOIT_IQ_URL"
// EnvQuarkusMongoDBHosts lists MongoDB hosts.
EnvQuarkusMongoDBHosts = "QUARKUS_MONGODB_HOSTS"
// EnvQuarkusMongoDBDatabase is the MongoDB database name.
Expand All @@ -85,13 +85,13 @@ const (
// EnvQuarkusHTTPSSLCertificateFiles is a list of TLS certificate files.
EnvQuarkusHTTPSSLCertificateFiles = "QUARKUS_HTTP_SSL_CERTIFICATE_FILES"
// EnvQuarkusHTTPSSLCertificateKeyFiles is a list of TLS key files.
EnvQuarkusHTTPSSLCertificateKeyFiles = "QUARKUS_HTTP_SSL_CERTIFICATE_KEY-FILES"
EnvQuarkusHTTPSSLCertificateKeyFiles = "QUARKUS_HTTP_SSL_CERTIFICATE_KEY_FILES"
// EnvQuarkusHTTPSSLPort is the HTTPS port for Quarkus.
EnvQuarkusHTTPSSLPort = "QUARKUS_HTTP_SSL-PORT"
EnvQuarkusHTTPSSLPort = "QUARKUS_HTTP_SSL_PORT"
// EnvQuarkusHTTPInsecureRequests controls insecure request policy.
EnvQuarkusHTTPInsecureRequests = "QUARKUS_HTTP_INSECURE-REQUESTS"
EnvQuarkusHTTPInsecureRequests = "QUARKUS_HTTP_INSECURE_REQUESTS"
// EnvQuarkusHTTPSSLCertificateReloadPeriod is the reload period for TLS certs.
EnvQuarkusHTTPSSLCertificateReloadPeriod = "QUARKUS_HTTP_SSL_CERTIFICATE_RELOAD-PERIOD"
EnvQuarkusHTTPSSLCertificateReloadPeriod = "QUARKUS_HTTP_SSL_CERTIFICATE_RELOAD_PERIOD"
// EnvExploitIQUIIncludesPath points to includes.json path.
EnvExploitIQUIIncludesPath = "EXPLOIT_IQ_UI_INCLUDES_PATH"
// EnvExploitIQUIExcludesPath points to excludes.json path.
Expand Down
91 changes: 58 additions & 33 deletions internal/resources/webapp/deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,8 @@ func buildWebAppEnv(

// OIDC CA bundle — inject trust store env vars when a custom CA ConfigMap is provided.
if cr.Spec.WebApp.OIDCCaBundleConfigMapRef != nil {
envs = append(envs,
envs = append(
envs,
corev1.EnvVar{
Name: "QUARKUS_OIDC_TLS_TLS_CONFIGURATION_NAME",
Value: "oidc",
Expand All @@ -186,48 +187,68 @@ func buildWebAppEnv(

if profile.IsOpenShift() {
envs = append(
envs,
envs, corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_CERTIFICATE_FILES", Value: "/etc/tls/tls.crt"},
corev1.EnvVar{
Name: "OAUTH_CLIENT_SECRET",
ValueFrom: &corev1.EnvVarSource{
SecretKeyRef: &corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{Name: SecretName},
Key: SecretKeyOAuthClient,
Name: "QUARKUS_HTTP_SSL_CERTIFICATE_KEY_FILES",
Value: "/etc/tls/tls.key",
},
corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_PORT", Value: "8443"},
corev1.EnvVar{Name: "QUARKUS_HTTP_INSECURE_REQUESTS", Value: "disabled"},
corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_CERTIFICATE_RELOAD_PERIOD", Value: "30m"},
)

if cr.Spec.Auth.OIDC != nil {
// Activate the external-idp Quarkus profile for generic OIDC discovery.
envs = append(
envs,
corev1.EnvVar{Name: "QUARKUS_PROFILE", Value: "external-idp"},
corev1.EnvVar{Name: "QUARKUS_OIDC_AUTH_SERVER_URL", Value: cr.Spec.Auth.OIDC.IssuerURL},
corev1.EnvVar{Name: "QUARKUS_OIDC_CLIENT_ID", Value: cr.Spec.Auth.OIDC.ClientID},
corev1.EnvVar{
Name: "QUARKUS_OIDC_CREDENTIALS_SECRET",
ValueFrom: &corev1.EnvVarSource{
SecretKeyRef: &cr.Spec.Auth.OIDC.ClientSecretRef,
},
},
},
corev1.EnvVar{
Name: "OPENSHIFT_DOMAIN",
ValueFrom: &corev1.EnvVarSource{
SecretKeyRef: &corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{Name: SecretName},
Key: SecretKeyOpenshiftDomain,
)
} else {
envs = append(
envs,
corev1.EnvVar{
Name: "OAUTH_CLIENT_SECRET",
ValueFrom: &corev1.EnvVarSource{
SecretKeyRef: &corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{Name: SecretName},
Key: SecretKeyOAuthClient,
},
},
},
},
corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_CERTIFICATE_FILES", Value: "/etc/tls/tls.crt"},
corev1.EnvVar{
Name: "QUARKUS_HTTP_SSL_CERTIFICATE_KEY-FILES",
Value: "/etc/tls/tls.key",
},
corev1.EnvVar{Name: "QUARKUS_HTTP_SSL-PORT", Value: "8443"},
corev1.EnvVar{Name: "QUARKUS_HTTP_INSECURE-REQUESTS", Value: "disabled"},
corev1.EnvVar{Name: "QUARKUS_HTTP_SSL_CERTIFICATE_RELOAD-PERIOD", Value: "30m"},
corev1.EnvVar{Name: "QUARKUS_OIDC_CLIENT-ID", Value: OAuthClientName},
)
corev1.EnvVar{
Name: "OPENSHIFT_DOMAIN",
ValueFrom: &corev1.EnvVarSource{
SecretKeyRef: &corev1.SecretKeySelector{
LocalObjectReference: corev1.LocalObjectReference{Name: SecretName},
Key: SecretKeyOpenshiftDomain,
},
},
},
corev1.EnvVar{Name: "QUARKUS_OIDC_CLIENT_ID", Value: OAuthClientName},
)
}
}

if profile.IsKubernetes() {
envs = append(
envs,
corev1.EnvVar{Name: "OAUTH_CLIENT_SECRET", Value: "disabled"},
corev1.EnvVar{Name: "OPENSHIFT_DOMAIN", Value: "disabled"},
corev1.EnvVar{Name: "QUARKUS_HTTP_INSECURE-REQUESTS", Value: "enabled"},
corev1.EnvVar{Name: "QUARKUS_HTTP_INSECURE_REQUESTS", Value: "enabled"},
)

if cr.Spec.Auth.OIDC != nil {
// Activate the external-idp Quarkus profile for generic OIDC discovery.
envs = append(envs,
envs = append(
envs,
corev1.EnvVar{Name: "QUARKUS_PROFILE", Value: "external-idp"},
corev1.EnvVar{Name: "QUARKUS_OIDC_AUTH_SERVER_URL", Value: cr.Spec.Auth.OIDC.IssuerURL},
corev1.EnvVar{Name: "QUARKUS_OIDC_CLIENT_ID", Value: cr.Spec.Auth.OIDC.ClientID},
Expand All @@ -239,7 +260,8 @@ func buildWebAppEnv(
},
)
} else {
envs = append(envs,
envs = append(
envs,
corev1.EnvVar{Name: "QUARKUS_OIDC_TENANT_ENABLED", Value: "false"},
corev1.EnvVar{
Name: "QUARKUS_HTTP_AUTH_PERMISSION_AUTHENTICATED_POLICY",
Expand Down Expand Up @@ -377,7 +399,8 @@ func buildMongoDBEnv(cr *exploitiqv1alpha1.ExploitIQStack) []corev1.EnvVar {
var envs []corev1.EnvVar

if db.Mode == exploitiqv1alpha1.DatabaseModeConnectionString {
envs = append(envs,
envs = append(
envs,
corev1.EnvVar{
Name: "QUARKUS_MONGODB_CONNECTION_STRING",
ValueFrom: &corev1.EnvVarSource{
Expand All @@ -390,11 +413,12 @@ func buildMongoDBEnv(cr *exploitiqv1alpha1.ExploitIQStack) []corev1.EnvVar {
corev1.EnvVar{Name: EnvQuarkusMongoDBDatabase, Value: dbName},
)
if db.AuthSource != "" {
envs = append(envs, corev1.EnvVar{Name: "QUARKUS_MONGODB_CREDENTIALS_AUTH-SOURCE", Value: authSource})
envs = append(envs, corev1.EnvVar{Name: "QUARKUS_MONGODB_CREDENTIALS_AUTH_SOURCE", Value: authSource})
}
} else {
// mode=hostPort (default)
envs = append(envs,
envs = append(
envs,
corev1.EnvVar{
Name: EnvQuarkusMongoDBHosts,
ValueFrom: &corev1.EnvVarSource{
Expand Down Expand Up @@ -423,7 +447,7 @@ func buildMongoDBEnv(cr *exploitiqv1alpha1.ExploitIQStack) []corev1.EnvVar {
},
},
},
corev1.EnvVar{Name: "QUARKUS_MONGODB_CREDENTIALS_AUTH-SOURCE", Value: authSource},
corev1.EnvVar{Name: "QUARKUS_MONGODB_CREDENTIALS_AUTH_SOURCE", Value: authSource},
corev1.EnvVar{Name: "QUARKUS_MONGODB_APPLICATION_NAME", Value: MongoDBDefaultDatabase},
)
}
Expand All @@ -435,7 +459,8 @@ func buildMongoDBEnv(cr *exploitiqv1alpha1.ExploitIQStack) []corev1.EnvVar {
if db.TLS.ConfigurationName != "" && db.TLS.TrustStorePEMConfigMapRef != nil {
mountPath := MongoDBTLSMountBase + "/" + db.TLS.ConfigurationName
envName := "QUARKUS_TLS_" + strings.ToUpper(strings.ReplaceAll(db.TLS.ConfigurationName, "-", "_")) + "_TRUST_STORE_PEM_CERTS"
envs = append(envs,
envs = append(
envs,
corev1.EnvVar{Name: "QUARKUS_MONGODB_TLS_CONFIGURATION_NAME", Value: db.TLS.ConfigurationName},
corev1.EnvVar{Name: envName, Value: mountPath + "/" + MongoDBTLSCACertKey},
)
Expand Down
7 changes: 3 additions & 4 deletions internal/resources/webapp/deployment_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,7 @@ func TestDeployment(t *testing.T) {
validateDeployment: func(t *testing.T, dep *appsv1.Deployment, cr *exploitiqv1alpha1.ExploitIQStack, prof *platform.PlatformProfile, params ManifestsParams) {
assert.Len(t, dep.Spec.Template.Spec.Containers, 1)
envMap := envToMap(dep.Spec.Template.Spec.Containers[0].Env)
assert.Equal(t, OAuthClientName, envMap["QUARKUS_OIDC_CLIENT-ID"])
assert.Equal(t, OAuthClientName, envMap["QUARKUS_OIDC_CLIENT_ID"])
assert.Contains(t, envMap, "OAUTH_CLIENT_SECRET")
assert.Contains(t, envMap, "OPENSHIFT_DOMAIN")
assert.Contains(t, envMap, "QUARKUS_HTTP_SSL_CERTIFICATE_FILES")
Expand Down Expand Up @@ -243,7 +243,7 @@ func TestDeployment(t *testing.T) {
assert.Equal(t, "secret:oidc-secret/client-secret", envMap["QUARKUS_OIDC_CREDENTIALS_SECRET"])
// Quarkus binds to 0.0.0.0 (no sidecar localhost binding)
assert.Equal(t, "0.0.0.0", envMap["QUARKUS_HTTP_HOST"])
assert.Equal(t, "enabled", envMap["QUARKUS_HTTP_INSECURE-REQUESTS"])
assert.Equal(t, "enabled", envMap["QUARKUS_HTTP_INSECURE_REQUESTS"])
},
expectError: false,
},
Expand Down Expand Up @@ -274,7 +274,7 @@ func TestDeployment(t *testing.T) {
assert.Len(t, dep.Spec.Template.Spec.Containers, 1)
envMap := envToMap(dep.Spec.Template.Spec.Containers[0].Env)
assert.Equal(t, "0.0.0.0", envMap["QUARKUS_HTTP_HOST"])
assert.Equal(t, "enabled", envMap["QUARKUS_HTTP_INSECURE-REQUESTS"])
assert.Equal(t, "enabled", envMap["QUARKUS_HTTP_INSECURE_REQUESTS"])
},
expectError: false,
},
Expand Down Expand Up @@ -705,7 +705,6 @@ func TestNewOAuth2ProxySidecar_Removed(t *testing.T) {
},
},
}

}

func TestGetMainContainerResources(t *testing.T) {
Expand Down