wip: integrate hydra-sql in example environment

components/hydra-ldap/resources/deployment.yaml

@@ -17,34 +17,34 @@ spec:
         app.kubernetes.io/version: "v1.2.2"
     spec:
       containers:
-      - name: werther
-        image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
-        imagePullPolicy: IfNotPresent
-        envFrom:
-        - configMapRef:
-            name: hydra-ldap-env
-        env:
-        - name: WERTHER_WEB_DIR
-          value: "/usr/share/werther/login/"
-        - name: WERTHER_LDAP_BINDDN
-          valueFrom:
-            secretKeyRef:
-              name: hydra-ldap-sc
-              key: WERTHER_LDAP_BINDDN
-        - name: WERTHER_LDAP_BINDPW
-          valueFrom:
-            secretKeyRef:
-              name: hydra-ldap-sc
-              key: WERTHER_LDAP_BINDPW
-        ports:
-        - containerPort: 8080
-          name: hydra-ldap-http
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 100
+        - name: werther
+          image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: hydra-ldap-env
+          env:
+            - name: WERTHER_WEB_DIR
+              value: "/usr/share/werther/login/"
+            - name: WERTHER_LDAP_BINDDN
+              valueFrom:
+                secretKeyRef:
+                  name: hydra-ldap-sc
+                  key: WERTHER_LDAP_BINDDN
+            - name: WERTHER_LDAP_BINDPW
+              valueFrom:
+                secretKeyRef:
+                  name: hydra-ldap-sc
+                  key: WERTHER_LDAP_BINDPW
+          ports:
+            - containerPort: 8080
+              name: http
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 100

components/hydra-ldap/resources/service.yaml

@@ -7,9 +7,9 @@ metadata:
 spec:
   type: ClusterIP
   ports:
-    - name: hydra-ldap
+    - name: http
       port: 8080
-      targetPort: hydra-ldap-http
+      targetPort: http
       protocol: TCP
   selector:
     app.kubernetes.io/name: hydra-ldap

components/hydra-oidc/resources/hydra-oidc-deployment.yaml

@@ -17,86 +17,86 @@ spec:
         app.kubernetes.io/name: hydra-oidc
     spec:
       containers:
-      - name: hydra-oidc-php-fpm
-        image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
-        imagePullPolicy: Always
-        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
-        readinessProbe:
-          exec:
-            command:
-              - sh
-              - -c
-              - test -f /etc/php81/php-fpm.d/www.conf
-        livenessProbe:
-          exec:
-            command:
-              - php
-              - bin/console
-              - -V
-          initialDelaySeconds: 10
-          periodSeconds: 30
-        env:
-          - name: PHP_FPM_LISTEN
-            value: 127.0.0.1:9000
-          - name: PHP_MEMORY_LIMIT
-            value: 128m
-          - name: PHP_FPM_MEMORY_LIMIT
-            value: 128m
-        envFrom:
-          - configMapRef:
-              name: hydra-oidc-env
-        resources: {}
-        securityContext:
-          runAsNonRoot: true
-          runAsGroup: 1000
-          runAsUser: 1000
+        - name: hydra-oidc-php-fpm
+          image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
+          imagePullPolicy: Always
+          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - test -f /etc/php81/php-fpm.d/www.conf
+          livenessProbe:
+            exec:
+              command:
+                - php
+                - bin/console
+                - -V
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          env:
+            - name: PHP_FPM_LISTEN
+              value: 127.0.0.1:9000
+            - name: PHP_MEMORY_LIMIT
+              value: 128m
+            - name: PHP_FPM_MEMORY_LIMIT
+              value: 128m
+          envFrom:
+            - configMapRef:
+                name: hydra-oidc-env
+          resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
 
-      - name: hydra-oidc-caddy
-        image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
-        imagePullPolicy: Always
-        args:
-          [
-            "/usr/sbin/caddy",
-            "run",
-            "--adapter",
-            "caddyfile",
-            "--config",
-            "/etc/caddy/Caddyfile",
-          ]
-        readinessProbe:
-          httpGet:
-            path: /healthy
-            port: 8080
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-          periodSeconds: 10
-        livenessProbe:
-          httpGet:
-            path: /healthy
-            port: 8080
-          initialDelaySeconds: 15
-          timeoutSeconds: 5
-          periodSeconds: 15
-        ports:
-          - containerPort: 8080
-            name: http
-        envFrom:
-          - configMapRef:
-              name: hydra-oidc-env
-        env:
-          - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
-            value: 127.0.0.1:9000
-          - name: CADDY_HTTPS_PORT
-            value: "8443"
-          - name: CADDY_HTTP_PORT
-            value: "8080"
-          - name: CADDY_DATA_FS
-            value: "/tmp/caddy"
-          - name: CADDY_APP_ROOT_PUBLIC
-            value: "/app/public/"
-        resources: {}
-        securityContext:
-          runAsNonRoot: true
-          runAsGroup: 1000
-          runAsUser: 1000
+        - name: hydra-oidc-caddy
+          image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
+          imagePullPolicy: Always
+          args:
+            [
+              "/usr/sbin/caddy",
+              "run",
+              "--adapter",
+              "caddyfile",
+              "--config",
+              "/etc/caddy/Caddyfile",
+            ]
+          readinessProbe:
+            httpGet:
+              path: /healthy
+              port: 8080
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthy
+              port: 8080
+            initialDelaySeconds: 15
+            timeoutSeconds: 5
+            periodSeconds: 15
+          ports:
+            - containerPort: 8080
+              name: http
+          envFrom:
+            - configMapRef:
+                name: hydra-oidc-env
+          env:
+            - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+              value: 127.0.0.1:9000
+            - name: CADDY_HTTPS_PORT
+              value: "8443"
+            - name: CADDY_HTTP_PORT
+              value: "8080"
+            - name: CADDY_DATA_FS
+              value: "/tmp/caddy"
+            - name: CADDY_APP_ROOT_PUBLIC
+              value: "/app/public/"
+          resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
       restartPolicy: Always

components/hydra-oidc/resources/hydra-oidc-service.yaml

@@ -6,9 +6,9 @@ metadata:
   name: hydra-oidc
 spec:
   ports:
-  - name: http
-    port: 80
-    targetPort: http
+    - name: http
+      port: 80
+      targetPort: http
   selector:
     app.kubernetes.io/name: hydra-oidc
 status:

components/hydra-sql/files/hydra/sql.yaml

@@ -0,0 +1,30 @@
+hydra:
+  apps:
+    - id: sql
+      title:
+        fr: Connexion SQL
+        en: Login SQL
+      description:
+        fr: Authentification avec SQL
+        en: Authentication with SQL
+      login_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGIN_URL)%"
+      consent_url: "%env(string:HYDRA_DISPATCHER_SQL_CONSENT_URL)%"
+      logout_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGOUT_URL)%"
+      attributes_rewrite_configuration:
+        uid:
+          rules:
+            - "property_exists(consent.session.id_token, 'uid') ? consent.session.id_token.uid : null"
+        email:
+          rules:
+            - "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
+        eduPersonAffiliation:
+          rules:
+            - "property_exists(consent.session.id_token, 'eduPersonAffiliation') ? consent.session.id_token.eduPersonAffiliation : null"
+  firewall:
+    rules:
+      email:
+        required: false
+      uid:
+        required: false
+      eduPersonAffiliation:
+        required: false

components/hydra-sql/kustomization.yaml

@@ -2,27 +2,38 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
 kind: Component
 
 resources:
-- ./resources/hydra-sql-service.yaml
-- ./resources/hydra-sql-deployment.yaml
+  - ./resources/hydra-sql-service.yaml
+  - ./resources/hydra-sql-deployment.yaml
 
 generatorOptions:
   labels:
-     com.cadoles.forge.sso-kustom/session: redis
+    com.cadoles.forge.sso-kustom/session: redis
 
 configMapGenerator:
-- name: hydra-sql-env
-  literals:
-  - ISSUER_URL="http://localhost:8000"
-  - BASE_URL='http://localhost:8080'
-  - HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
-  - APP_LOCALES="fr,en"
-  - HASH_ALGO_LEGACY="sha256, bcrypt"
-  - SECURITY_PATTERN="password,salt,pepper"
-  - DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
-  - DB_USER="makeMeASecret"
-  - DB_PASSWORD="makeMeASecret"
-  - REDIS_DSN="redis://redis:6379"
-  - PEPPER="MakeMeABigSecret"
-- name: sql-login-config
-  files:
-  - ./files/sql_login.yaml
+  - name: hydra-sql-env
+    literals:
+      - ISSUER_URL="http://localhost:8000"
+      - BASE_URL='http://localhost:8080'
+      - HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
+      - APP_LOCALES="fr,en"
+      - HASH_ALGO_LEGACY="sha256, bcrypt"
+      - SECURITY_PATTERN="password,salt,pepper"
+      - DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
+      - DB_USER="makeMeASecret"
+      - DB_PASSWORD="makeMeASecret"
+      - REDIS_DSN="redis://redis:6379"
+      - PEPPER="MakeMeABigSecret"
+  - name: sql-login-config
+    files:
+      - ./files/sql_login.yaml
+  - name: hydra-dispatcher-apps
+    behavior: merge
+    files:
+      - ./files/hydra/sql.yaml
+
+patchesJson6902:
+  - target:
+      version: v1
+      kind: ConfigMap
+      name: hydra-dispatcher-env
+    path: patches/hydra-dispatcher-env.yaml

components/hydra-sql/patches/hydra-dispatcher-env.yaml

@@ -0,0 +1,9 @@
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
+  value: http://hydra-sql/login
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
+  value: http://hydra-sql/consent
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
+  value: http://hydra-sql/logout

components/hydra-sql/resources/hydra-sql-deployment.yaml

@@ -17,98 +17,98 @@ spec:
         app.kubernetes.io/name: hydra-sql
     spec:
       containers:
-      - name: hydra-sql-fpm
-        image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
-        imagePullPolicy: Always
-        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
-        readinessProbe:
-          exec:
-            command:
-              - sh
-              - -c
-              - test -f /etc/php81/php-fpm.d/www.conf
-        livenessProbe:
-          exec:
-            command:
-              - php
-              - bin/console
-              - -V
-          initialDelaySeconds: 10
-          periodSeconds: 30
-        resources: {}
-        securityContext:
-          runAsNonRoot: true
-          runAsGroup: 1000
-          runAsUser: 1000
-        envFrom:
-          - configMapRef:
-              name: hydra-sql-env
-        env:
-          - name: PHP_FPM_LISTEN
-            value: 127.0.0.1:9000
-          - name: PHP_MEMORY_LIMIT
-            value: 128m
-          - name: PHP_FPM_MEMORY_LIMIT
-            value: 128m
-          - name: PHP_FPM_LOG_LEVEL
-            value: warning
-        volumeMounts:
-          - name: sql-login-config
-            mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
-            subPath: "sql_login.yaml"
+        - name: hydra-sql-fpm
+          image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
+          imagePullPolicy: Always
+          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - test -f /etc/php81/php-fpm.d/www.conf
+          livenessProbe:
+            exec:
+              command:
+                - php
+                - bin/console
+                - -V
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
+          envFrom:
+            - configMapRef:
+                name: hydra-sql-env
+          env:
+            - name: PHP_FPM_LISTEN
+              value: 127.0.0.1:9000
+            - name: PHP_MEMORY_LIMIT
+              value: 128m
+            - name: PHP_FPM_MEMORY_LIMIT
+              value: 128m
+            - name: PHP_FPM_LOG_LEVEL
+              value: warning
+          volumeMounts:
+            - name: sql-login-config
+              mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
+              subPath: "sql_login.yaml"
 
-      - name: hydra-sql-caddy
-        image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
-        imagePullPolicy: Always
-        args:
-          [
-            "/usr/sbin/caddy",
-            "run",
-            "--adapter",
-            "caddyfile",
-            "--config",
-            "/etc/caddy/Caddyfile",
-          ]
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-          periodSeconds: 10
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 15
-          timeoutSeconds: 5
-          periodSeconds: 15
-        envFrom:
-          - configMapRef:
-              name: hydra-sql-env
-        env:
-          - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
-            value: 127.0.0.1:9000
-          - name: CADDY_HTTPS_PORT
-            value: "8443"
-          - name: CADDY_HTTP_PORT
-            value: "8080"
-          - name: CADDY_DATA_FS
-            value: "/tmp/caddy"
-          - name: CADDY_APP_ROOT_PUBLIC
-            value: "/app/public/"
-        resources: {}
-        securityContext:
-          runAsNonRoot: true
-          runAsGroup: 1000
-          runAsUser: 1000
-        ports:
-          - containerPort: 8080
-            name: http
-        volumeMounts:
-          - name: sql-login-config
-            mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
-            subPath: "sql_login.yaml"
+        - name: hydra-sql-caddy
+          image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
+          imagePullPolicy: Always
+          args:
+            [
+              "/usr/sbin/caddy",
+              "run",
+              "--adapter",
+              "caddyfile",
+              "--config",
+              "/etc/caddy/Caddyfile",
+            ]
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 15
+            timeoutSeconds: 5
+            periodSeconds: 15
+          envFrom:
+            - configMapRef:
+                name: hydra-sql-env
+          env:
+            - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+              value: 127.0.0.1:9000
+            - name: CADDY_HTTPS_PORT
+              value: "8443"
+            - name: CADDY_HTTP_PORT
+              value: "8080"
+            - name: CADDY_DATA_FS
+              value: "/tmp/caddy"
+            - name: CADDY_APP_ROOT_PUBLIC
+              value: "/app/public/"
+          resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
+          ports:
+            - containerPort: 8080
+              name: http
+          volumeMounts:
+            - name: sql-login-config
+              mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
+              subPath: "sql_login.yaml"
       volumes:
         - name: sql-login-config
           configMap:

components/hydra-sql/resources/hydra-sql-service.yaml

@@ -6,9 +6,9 @@ metadata:
   name: hydra-sql
 spec:
   ports:
-  - name: http
-    port: 80
-    targetPort: http
+    - name: http
+      port: 80
+      targetPort: http
   selector:
     app.kubernetes.io/name: hydra-sql
 status:

components/oidc-test/resources/deployment.yaml

@@ -23,17 +23,17 @@ spec:
             - containerPort: 8080
           resources: {}
           envFrom:
-          - configMapRef:
-              name: oidc-test-env
+            - configMapRef:
+                name: oidc-test-env
           env:
-          - name: OIDC_CLIENT_ID
-            valueFrom:
-              secretKeyRef:
-                name: oidc-test-oauth2-client
-                key: client_id
-          - name: OIDC_CLIENT_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: oidc-test-oauth2-client
-                key: client_secret
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-test-oauth2-client
+                  key: CLIENT_ID
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-test-oauth2-client
+                  key: CLIENT_SECRET
       restartPolicy: Always