feat: add oidc-test app component

Reviewed-on: #6

components/hydra-ldap/kustomization.yaml

@@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - ./resources/deployment.yaml
+  - ./resources/service.yaml
+
+configMapGenerator:
+  - name: hydra-ldap-env
+    literals:
+      - WERTHER_DEV_MODE=false
+      - WERTHER_LDAP_ROLE_CLAIM="https://hydra/claims/roles"
+      - WERTHER_SKIP_SSL_VERIFICATIONS=false
+      - WERTHER_IDENTP_CLAIM_SCOPES="name:profile,family_name:profile,given_name:profile,email:email,https%3A%2F%2Fhydra%2Fclaims%2Froles:roles"
+      - WERTHER_IDENTP_HYDRA_URL="http://hydra:4444"
+      - WERTHER_LDAP_ENDPOINTS="ldap.test.fr:636"
+      - WERTHER_LDAP_IS_TLS=true
+      - WERTHER_LDAP_BASEDN="o=test,c=fr"
+      - WERTHER_LDAP_ROLE_BASEDN="ou=groups,o=test,c=fr"
+      - WERTHER_LDAP_CONNECTION_TIMEOUT="10s"
+
+secretGenerator:
+  - name: hydra-ldap-sc
+    literals:
+      - WERTHER_LDAP_BINDDN="cn=reader,o=test,c=fr"
+      - WERTHER_LDAP_BINDPW=ThisMustBeAbsolutelyChanged

components/hydra-ldap/resources/deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hydra-ldap
+  namespace: default
+  labels:
+    app.kubernetes.io/name: hydra-ldap
+    app.kubernetes.io/version: "v1.2.2"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hydra-ldap
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hydra-ldap
+        app.kubernetes.io/version: "v1.2.2"
+    spec:
+      containers:
+        - name: werther
+          image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: hydra-ldap-env
+          env:
+            - name: WERTHER_WEB_DIR
+              value: "/usr/share/werther/login/"
+            - name: WERTHER_LDAP_BINDDN
+              valueFrom:
+                secretKeyRef:
+                  name: hydra-ldap-sc
+                  key: WERTHER_LDAP_BINDDN
+            - name: WERTHER_LDAP_BINDPW
+              valueFrom:
+                secretKeyRef:
+                  name: hydra-ldap-sc
+                  key: WERTHER_LDAP_BINDPW
+          ports:
+            - containerPort: 8080
+              name: hydra-ldap-http
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 100

components/hydra-ldap/resources/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: hydra-ldap
+  name: hydra-ldap
+spec:
+  type: ClusterIP
+  ports:
+    - name: hydra-ldap
+      port: 8080
+      targetPort: hydra-ldap-http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: hydra-ldap
+status:
+  loadBalancer: {}

components/hydra-oidc/files/hydra/oidc.yaml

@@ -10,3 +10,4 @@ hydra:
       login_url: "%env(string:HYDRA_DISPATCHER_OIDC_LOGIN_URL)%"
       consent_url: "%env(string:HYDRA_DISPATCHER_OIDC_CONSENT_URL)%"
       logout_url: "%env(string:HYDRA_DISPATCHER_OIDC_LOGOUT_URL)%"
+      attributes_rewrite_configuration: []

components/hydra-oidc/kustomization.yaml

@@ -10,6 +10,8 @@ configMapGenerator:
     literals:
       - APP_ENV=prod
       - APP_DEBUG=false
+      - PHP_FPM_MEMORY_LIMIT=256m
+      - NGINX_APP_SERVER_LISTEN=80
       - HYDRA_ADMIN_BASE_URL=http://hydra-dispatcher
       - OIC_AUTHORIZE_ENDPOINT=https://oidc-idp/api/v1/authorize
       - OIDC_TOKEN_ENDPOINT=https://oidc-idp/api/v1/token
@@ -24,10 +26,10 @@ configMapGenerator:
       - CLIENT_SECRET_FC=MyClientSecret
       - COOKIE_PATH=/
       - TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
-  - name: hydra-dispatcher-apps
-    behavior: merge
-    files:
-      - ./files/hydra/oidc.yaml
+  # - name: hydra-dispatcher-apps
+  #   behavior: merge
+  #   files:
+  #     - apps.yaml=./files/hydra/oidc.yaml
 
 patchesJson6902:
   - target:

components/hydra-oidc/resources/hydra-oidc-deployment.yaml

@@ -17,13 +17,70 @@ spec:
         io.kompose.service: hydra-oidc
     spec:
       containers:
-        - name: hydra-oidc
-          image: reg.cadoles.com/cadoles/hydra-oidc-v1:v0.0.0-170-g485b138
+        - name: hydra-oidc-php-fpm
+          image: reg.cadoles.com/cadoles/hydra-oidc-base:2023.11.17-develop.1657.761e035
+          imagePullPolicy: Always
+          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          readinessProbe:
+            exec:
+              command:
+              - sh
+              - -c
+              - test -f /etc/php81/php-fpm.d/www.conf
+          livenessProbe:
+            exec:
+              command:
+              - php
+              - bin/console
+              - -V
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          env:
+          - name: PHP_FPM_LISTEN
+            value: 127.0.0.1:9000
+          - name: PHP_MEMORY_LIMIT
+            value: 128m
+          - name: PHP_FPM_MEMORY_LIMIT
+            value: 128m
           envFrom:
             - configMapRef:
                 name: hydra-oidc-env
+          resources: {}
+
+        - image: reg.cadoles.com/cadoles/hydra-oidc-base:2023.11.17-develop.1657.761e035
+          imagePullPolicy: Always
+          name: hydra-oidc-nginx
+          args: ["/usr/sbin/nginx"]
+          readinessProbe:
+            httpGet:
+              path: /healthy
+              port: 80
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthy
+              port: 80
+            initialDelaySeconds: 15
+            timeoutSeconds: 5
+            periodSeconds: 15
+          envFrom:
+            - configMapRef:
+                name: hydra-oidc-env
+          env:
+          - name: NGINX_APP_UPSTREAM_BACKEND_SERVER
+            value: 127.0.0.1:9000
+          - name: NGINX_APP_ROOT
+            value: "/public/"
+          - name: NGINX_APP_PHP_INDEX
+            value: "/index.php"
+          - name: NGINX_ERROR_LOG_LEVEL
+            value: "warn"
+          - name: NGINX_APP_PHP_NON_FILE_PATTERN
+            value: "^/index\\.php(/|$)"
           ports:
-            - containerPort: 80
+          - containerPort: 8080
           resources: {}
       restartPolicy: Always
 

components/hydra-sql/files/sql_login.yaml

@@ -0,0 +1,7 @@
+sql_login:
+  login_column_name: mail
+  password_column_name: password
+  salt_column_name: salt
+  table_name: user
+  data_to_fetch:
+  - mail

components/hydra-sql/kustomization.yaml

@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- ./resources/hydra-sql-service.yaml
+- ./resources/hydra-sql-deployment.yaml
+
+configMapGenerator:
+- name: hydra-sql-env
+  literals:
+  - ISSUER_URL="http://localhost:8000"
+  - BASE_URL='http://localhost:8080'
+  - HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
+  - APP_LOCALES="fr,en"
+  - HASH_ALGO_LEGACY="sha256, bcrypt"
+  - SECURITY_PATTERN="password,salt,pepper"
+  - DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
+  - DB_USER="makeMeASecret"
+  - DB_PASSWORD="makeMeASecret"
+  - PEPPER="MakeMeABigSecret"
+- name: sql-login-config
+  files:
+  - ./files/sql_login.yaml

components/hydra-sql/resources/hydra-sql-deployment.yaml

@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    io.kompose.service: hydra-sql
+  name: hydra-sql
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      io.kompose.service: hydra-sql
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        io.kompose.service: hydra-sql
+    spec:
+      containers:
+      - name: hydra-sql-fpm
+        image: reg.cadoles.com/cadoles/hydra-sql-base:0.0.1
+        imagePullPolicy: Always
+        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        readinessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - test -f /etc/php81/php-fpm.d/www.conf
+        livenessProbe:
+          exec:
+            command:
+            - php
+            - bin/console
+            - -V
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        resources: {}
+        envFrom:
+        - configMapRef:
+            name: hydra-sql-env
+        env:
+        - name: PHP_FPM_LISTEN
+          value: 127.0.0.1:9000
+        - name: PHP_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_LOG_LEVEL
+          value: warning
+        volumeMounts:
+        - name: sql-login-config
+          mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
+          subPath: "sql_login.yaml"
+
+      - name: hydra-sql-nginx
+        image: reg.cadoles.com/cadoles/hydra-sql-base:0.0.1
+        imagePullPolicy: Always
+        args: ["/usr/sbin/nginx"]
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+          periodSeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 15
+          timeoutSeconds: 5
+          periodSeconds: 15
+        envFrom:
+        - configMapRef:
+            name: hydra-sql-env
+        env:
+        - name: NGINX_APP_UPSTREAM_BACKEND_SERVER
+          value: 127.0.0.1:9000
+        - name: NGINX_APP_ROOT
+          value: "/public"
+        - name: NGINX_APP_PHP_INDEX
+          value: "/index.php"
+        - name: NGINX_ERROR_LOG_LEVEL
+          value: "warn"
+        - name: NGINX_APP_PHP_NON_FILE_PATTERN
+          value: "^/index\\.php(/|$)"
+        resources: {}
+        ports:
+        - containerPort: 8080
+        volumeMounts:
+        - name: sql-login-config
+          mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
+          subPath: "sql_login.yaml"
+      volumes:
+      - name: sql-login-config
+        configMap:
+          name: sql-login-config
+
+      restartPolicy: Always

components/hydra-sql/resources/hydra-sql-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: hydra-sql
+  name: hydra-sql
+spec:
+  ports:
+  - name: hydra-sql
+    port: 8080
+  selector:
+    io.kompose.service: hydra-sql
+status:
+  loadBalancer: {}

components/oidc-test/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - ./resources/deployment.yaml
+  - ./resources/service.yaml
+  - ./resources/oauth2-client.yaml
+
+configMapGenerator:
+  - name: oidc-test
+    literals:
+      - LOG_LEVEL=0
+      - HTTP_ADDRESS=0.0.0.0:8080
+      - OIDC_CLIENT_ID=oidc-test
+      - OIDC_CLIENT_SECRET=NotSoSecret
+      - OIDC_ISSUER_URL=http://hydra:4444
+      - OIDC_REDIRECT_URL=https://example.net/oauth2/callback
+      - OIDC_POST_LOGOUT_REDIRECT_URL=https://example.net
+      - OIDC_SKIP_ISSUER_VERIFICATION="true"
+      - OIDC_INSECURE_SKIP_VERIFY="true"

components/oidc-test/resources/deployment.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: oidc-test
+  name: oidc-test
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oidc-test
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oidc-test
+    spec:
+      containers:
+        - image: reg.cadoles.com/cadoles/oidc-test:2023.12.6-stable.1502.ebfd504
+          name: oidc-test
+          ports:
+            - containerPort: 8080
+          resources: {}
+          envFrom:
+          - configMapRef:
+              name: oidc-test
+          env:
+          - name: OIDC_CLIENT_ID
+            valueFrom:
+              secretKeyRef:
+                name: oidc-test-oauth2-client
+                key: client_id
+          - name: OIDC_CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: oidc-test-oauth2-client
+                key: client_secret
+      restartPolicy: Always

components/oidc-test/resources/oauth2-client.yaml

@@ -1,9 +1,9 @@
 apiVersion: hydra.ory.sh/v1alpha1
 kind: OAuth2Client
 metadata:
-  name: app-oauth2-client
+  name: oidc-test-oauth2-client
 spec:
-  clientName: "app"
+  clientName: "oidc-test"
   tokenEndpointAuthMethod: "client_secret_basic"
   grantTypes:
   - authorization_code
@@ -11,8 +11,8 @@ spec:
   responseTypes:
   - code
   scope: "openid email"
-  secretName: app-oidc-secret
+  secretName: oidc-test-oauth2-client
   redirectUris:
-  - https://ssokustom/oauth2/callback
+  - https://example.net/oauth2/callback
   postLogoutRedirectUris:
-  - https://ssokustom
+  - https://example.net

components/oidc-test/resources/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: oidc-test
+  name: oidc-test
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+  selector:
+    app.kubernetes.io/name: oidc-test
+status:
+  loadBalancer: {}

examples/authenticated-app/kustomization.yaml

@@ -2,20 +2,19 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../resources/hydra
-  - ../../resources/hydra-dispatcher
-  - ./resources/app.yaml
+  - ../../overlays/base
   - ./resources/ingress.yaml
-  - ./resources/oauth2-client.yaml
   - ./resources/saml-idp.yaml
   - ./resources/self-signed-issuer.yaml
   - ./resources/port-forwarder.yaml
 
 components:
   - ../../components/hydra-cnpg-database
+  - ../../components/oidc-test
   #- ../../components/hydra-oidc
   - ../../components/hydra-saml
 
+
 patchesJson6902:
   - target:
       version: v1
@@ -37,3 +36,13 @@ patchesJson6902:
       kind: Secret
       name: hydra-secret
     path: patches/hydra-secret.yaml
+  - target:
+      version: v1
+      kind: Secret
+      name: oidc-test
+    path: patches/oidc-test.yaml
+  - target:
+      version: v1alpha1
+      kind: OAuth2Client
+      name: oidc-test-oauth2-client
+    path: patches/oidc-test-oauth2-client.yaml

examples/authenticated-app/patches/oidc-test-oauth2-client.yaml

@@ -0,0 +1,6 @@
+- op: replace
+  path: "/spec/redirectUris/0"
+  value: https://ssokustom/oauth2/callback
+- op: replace
+  path: "/spec/postLogoutRedirectUris/0"
+  value: https://ssokustom/oauth2/callback

examples/authenticated-app/patches/oidc-test.yaml

@@ -0,0 +1,9 @@
+- op: replace
+  path: "/data/LOG_LEVEL"
+  value: 0
+- op: replace
+  path: "/data/OIDC_REDIRECT_URL"
+  value: https://ssokustom/oauth2/callback
+- op: replace
+  path: "/data/OIDC_POST_LOGOUT_REDIRECT_URL"
+  value: https://ssokustom

examples/authenticated-app/resources/app.yaml

@@ -1,66 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    io.kompose.service: app
-  name: app
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      io.kompose.service: app
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        io.kompose.service: app
-    spec:
-      containers:
-        - image: reg.cadoles.com/cadoles/oidc-test:2023.11.6-stable.1557.e16b905
-          name: app
-          ports:
-            - containerPort: 8080
-          resources: {}
-          env:
-            - name: LOG_LEVEL
-              value: "0"
-            - name: HTTP_ADDRESS
-              value: 0.0.0.0:8080
-            - name: OIDC_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: app-oidc-secret
-                  key: client_id
-            - name: OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: app-oidc-secret
-                  key: client_secret
-            - name: OIDC_ISSUER_URL
-              value: http://hydra:4444
-            - name: OIDC_REDIRECT_URL
-              value: https://ssokustom/oauth2/callback
-            - name: OIDC_POST_LOGOUT_REDIRECT_URL
-              value: https://ssokustom
-            - name: OIDC_SKIP_ISSUER_VERIFICATION
-              value: "true"
-            - name: OIDC_INSECURE_SKIP_VERIFY
-              value: "true"
-      restartPolicy: Always
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    io.kompose.service: app
-  name: app
-spec:
-  ports:
-    - name: http
-      port: 8080
-      targetPort: 8080
-  selector:
-    io.kompose.service: app
-status:
-  loadBalancer: {}

examples/authenticated-app/resources/ingress.yaml

@@ -20,7 +20,7 @@ spec:
         pathType: Prefix
         backend:
           service:
-            name: app
+            name: oidc-test
             port:
               name: http
 ---

kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-- ./resources/hydra
-- ./resources/hydra-dispatcher
-
-components:
-- ./components/hydra-cnpg-database
-- ./components/hydra-oidc
-- ./components/hydra-saml

overlays/base/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../resources/hydra
+- ../../resources/hydra-dispatcher
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: sso-kustom
+      app.kubernetes.io/component: auth

overlays/full/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../base
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: sso-kustom
+      app.kubernetes.io/component: auth
+
+components:
+- ../../components/hydra-cnpg-database
+- ../../components/hydra-oidc
+- ../../components/hydra-saml
+- ../../components/hydra-sql

resources/hydra-dispatcher/kustomization.yaml

@@ -10,6 +10,8 @@ configMapGenerator:
   literals:
   - APP_ENV=prod
   - APP_DEBUG=false
+  - PHP_FPM_MEMORY_LIMIT=256m
+  - NGINX_APP_SERVER_LISTEN=80
   - HYDRA_BASE_URL=http://hydra:4444
   - HYDRA_ADMIN_BASE_URL=http://hydra:4445
   - HYDRA_REWRITE_ISSUER=yes
@@ -21,4 +23,4 @@ configMapGenerator:
   - APP_LOCALES=fr,en
 - name: hydra-dispatcher-apps
   files:
-  - ./files/hydra/default.yaml
+  - apps.yaml=./files/hydra/default.yaml

resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml

@@ -17,20 +17,75 @@ spec:
         io.kompose.service: hydra-dispatcher
     spec:
       containers:
-      - name: hydra-dispatcher
-        image: reg.cadoles.com/cadoles/hydra-dispatcher-v1:v0.0.0-238-g7236416
+      - name: hydra-dispatcher-php-fpm
+        image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2023.11.17-develop.1408.ad93359
+        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        readinessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - test -f /etc/php81/php-fpm.d/www.conf
+        livenessProbe:
+          exec:
+            command:
+            - php
+            - bin/console
+            - -V
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        env:
+        - name: PHP_FPM_LISTEN
+          value: 127.0.0.1:9000
+        - name: PHP_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_MEMORY_LIMIT
+          value: 128m
         envFrom:
         - configMapRef:
             name: hydra-dispatcher-env
         volumeMounts:
-        - mountPath: /var/www/config/hydra
+        - mountPath: /app/config/hydra
           name: hydra-dispatcher-apps
+        resources: {}
+
+      - image:  reg.cadoles.com/cadoles/hydra-dispatcher-base:2023.11.17-develop.1408.ad93359
+        imagePullPolicy: Always
+        name: hydra-dispatcher-nginx
+        args: ["/usr/sbin/nginx"]
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 80
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+          periodSeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 80
+          initialDelaySeconds: 15
+          timeoutSeconds: 5
+          periodSeconds: 15
+        envFrom:
+        - configMapRef:
+            name: hydra-dispatcher-env
+        env:
+        - name: NGINX_APP_UPSTREAM_BACKEND_SERVER
+          value: 127.0.0.1:9000
+        - name: NGINX_APP_ROOT
+          value: "/public/"
+        - name: NGINX_APP_PHP_INDEX
+          value: "/index.php"
+        - name: NGINX_ERROR_LOG_LEVEL
+          value: "warn"
+        - name: NGINX_APP_PHP_NON_FILE_PATTERN
+          value: "^/index\\.php(/|$)"
         ports:
-        - containerPort: 80
+        - containerPort: 8080
         resources: {}
       restartPolicy: Always
       volumes:
       - name: hydra-dispatcher-apps
         configMap:
           name: hydra-dispatcher-apps
-