wip: integrate hydra-sql in example environment

examples/authenticated-app/README.md

@@ -8,35 +8,27 @@ L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
 
 1. Créer un cluster avec `kind`
 
-    ```
-    kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
-    ```
+   ```
+   kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
+   ```
 
 2. Déployer les opérateurs nécessaires au déploiement
 
-    ```
-    kubectl apply  -k ./examples/k8s/kind/cluster --server-side
-    ```
+   ```
+   kubectl apply  -k ./examples/k8s/kind/cluster --server-side
+   ```
 
 3. Déployer l'application
 
-    ```
-    kubectl apply -k ./examples/authenticated-app
-    ```
-
-   **Note** Il est possible d'avoir l'erreur suivante:
-
    ```
-   error: resource mapping not found for name: "app-oauth2-client" namespace: "" from "./examples/authenticated-app": no matches for kind "OAuth2Client" in version "hydra.ory.sh/v1alpha1"
+   kubectl apply -k ./examples/authenticated-app
    ```
 
-   Cette erreur est "normale" (voir https://github.com/kubernetes/kubectl/issues/1117). Dans ce cas, attendre la création de la CRD (voir ticket) puis relancer la commande.
-
 4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
 
-    ```
-    127.0.0.1 ssokustom
-    ```
+   ```
+   127.0.0.1 ssokustom
+   ```
 
 5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
 
@@ -55,7 +47,7 @@ kind delete cluster -n sso-kustom-example
 
 #### URL utiles
 
-|URL|Description|
-|---|-----------|
-|https://ssokustom/auth/saml/Shibboleth.sso/Session|Attributs de la session SP Shibboleth|
-|https://ssokustom/auth/saml/Shibboleth.sso/Metadata|Métadonnées du SP Shibboleth|
+| URL                                                 | Description                           |
+| --------------------------------------------------- | ------------------------------------- |
+| https://ssokustom/auth/saml/Shibboleth.sso/Session  | Attributs de la session SP Shibboleth |
+| https://ssokustom/auth/saml/Shibboleth.sso/Metadata | Métadonnées du SP Shibboleth          |

examples/authenticated-app/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
   - ./resources/self-signed-issuer.yaml
   - ./resources/port-forwarder.yaml
 
-patchesJson6902:
+patches:
   - target:
       version: v1
       kind: ConfigMap
@@ -38,4 +38,9 @@ patchesJson6902:
       version: v1alpha1
       kind: OAuth2Client
       name: oidc-test-oauth2-client
-    path: patches/oidc-test-oauth2-client.yaml
+    path: patches/oidc-test-oauth2-client.yaml
+  - target:
+      version: v1
+      kind: ConfigMap
+      name: hydra-sql-env
+    path: patches/hydra-sql-env.yaml

examples/authenticated-app/patches/hydra-dispatcher-env.yaml

@@ -27,4 +27,14 @@
 - op: replace
   path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
   value: https://ssokustom/auth/saml/logout
-  
+
+# Hydra SQL configuration
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
+  value: https://ssokustom/auth/sql/login
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
+  value: https://ssokustom/auth/sql/consent
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
+  value: https://ssokustom/auth/sql/logout

examples/authenticated-app/patches/hydra-sql-env.yaml

@@ -0,0 +1,24 @@
+- op: replace
+  path: "/data/BASE_URL"
+  value: https://ssokustom/auth/sql
+- op: replace
+  path: "/data/ISSUER_URL"
+  value: https://ssokustom
+- op: replace
+  path: "/data/ISSUER_URL"
+  value: https://ssokustom
+- op: replace
+  path: "/data/HYDRA_ADMIN_BASE_URL"
+  value: http://hydra-dispatcher
+- op: replace
+  path: "/data/DSN_REMOTE_DATABASE"
+  value: pgsql:host='postgres';port=5432;dbname=lasql
+- op: replace
+  path: "/data/REDIS_DSN"
+  value: redis://redis:6379
+- op: replace
+  path: "/data/DB_USER"
+  value: makeMeASecret
+- op: replace
+  path: "/data/DB_PASSWORD"
+  value: rmakeMeASecret

examples/authenticated-app/resources/ingress.yaml

@@ -10,19 +10,19 @@ metadata:
 spec:
   ingressClassName: nginx
   tls:
-  - hosts:
-    - ssokustom
-    secretName: ssokustom-example-tls
+    - hosts:
+        - ssokustom
+      secretName: ssokustom-example-tls
   rules:
-  - http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: oidc-test
-            port:
-              name: http
+    - http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oidc-test
+                port:
+                  name: http
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -34,19 +34,43 @@ metadata:
 spec:
   ingressClassName: nginx
   tls:
-  - hosts:
-    - ssokustom
-    secretName: ssokustom-example-tls
+    - hosts:
+        - ssokustom
+      secretName: ssokustom-example-tls
   rules:
-  - http:
-      paths:
-      - path: /auth/saml(/|$)(.*)
-        pathType: Prefix
-        backend:
-          service:
-            name: hydra-saml
-            port:
-              name: http
+    - http:
+        paths:
+          - path: /auth/saml(/|$)(.*)
+            pathType: Prefix
+            backend:
+              service:
+                name: hydra-saml
+                port:
+                  name: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth-sql
+  annotations:
+    cert-manager.io/issuer: "self-signed"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - ssokustom
+      secretName: ssokustom-example-tls
+  rules:
+    - http:
+        paths:
+          - path: /auth/sql(/|$)(.*)
+            pathType: Prefix
+            backend:
+              service:
+                name: hydra-sql
+                port:
+                  name: http
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -60,19 +84,19 @@ metadata:
 spec:
   ingressClassName: nginx
   tls:
-  - hosts:
-    - ssokustom
-    secretName: ssokustom-example-tls
+    - hosts:
+        - ssokustom
+      secretName: ssokustom-example-tls
   rules:
-  - http:
-      paths:      
-      - path: /auth/dispatcher(/|$)(.*)
-        pathType: Prefix
-        backend:
-          service:
-            name: hydra-dispatcher
-            port:
-              name: http
+    - http:
+        paths:
+          - path: /auth/dispatcher(/|$)(.*)
+            pathType: Prefix
+            backend:
+              service:
+                name: hydra-dispatcher
+                port:
+                  name: http
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -85,19 +109,19 @@ metadata:
 spec:
   ingressClassName: nginx
   tls:
-  - hosts:
-    - ssokustom
-    secretName: ssokustom-example-tls
+    - hosts:
+        - ssokustom
+      secretName: ssokustom-example-tls
   rules:
-  - http:
-      paths:      
-      - path: /auth(/|$)(.*)
-        pathType: Prefix
-        backend:
-          service:
-            name: hydra
-            port:
-              name: hydra-public
+    - http:
+        paths:
+          - path: /auth(/|$)(.*)
+            pathType: Prefix
+            backend:
+              service:
+                name: hydra
+                port:
+                  name: hydra-public
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -111,21 +135,16 @@ metadata:
 spec:
   ingressClassName: nginx
   tls:
-  - hosts:
-    - ssokustom
-    secretName: ssokustom-example-tls
+    - hosts:
+        - ssokustom
+      secretName: ssokustom-example-tls
   rules:
-  - http:
-      paths:     
-      - path: /simplesaml(/|$)(.*)
-        pathType: Prefix
-        backend:
-          service:
-            name: saml-idp
-            port:
-              name: https
-
-     
-
-      
-          
+    - http:
+        paths:
+          - path: /simplesaml(/|$)(.*)
+            pathType: Prefix
+            backend:
+              service:
+                name: saml-idp
+                port:
+                  name: https