2023-12-11 14:31:38 +01:00
12 changed files with 133 additions and 90 deletions
--- a/components/oidc-test/kustomization.yaml
+++ b/components/oidc-test/kustomization.yaml
@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - ./resources/deployment.yaml
+  - ./resources/service.yaml
+  - ./resources/oauth2-client.yaml
+
+configMapGenerator:
+  - name: oidc-test
+    literals:
+      - LOG_LEVEL=0
+      - HTTP_ADDRESS=0.0.0.0:8080
+      - OIDC_CLIENT_ID=oidc-test
+      - OIDC_CLIENT_SECRET=NotSoSecret
+      - OIDC_ISSUER_URL=http://hydra:4444
+      - OIDC_REDIRECT_URL=https://example.net/oauth2/callback
+      - OIDC_POST_LOGOUT_REDIRECT_URL=https://example.net
+      - OIDC_SKIP_ISSUER_VERIFICATION="true"
+      - OIDC_INSECURE_SKIP_VERIFY="true"
--- a/components/oidc-test/resources/deployment.yaml
+++ b/components/oidc-test/resources/deployment.yaml
@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: oidc-test
+  name: oidc-test
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oidc-test
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oidc-test
+    spec:
+      containers:
+        - image: reg.cadoles.com/cadoles/oidc-test:2023.12.6-stable.1502.ebfd504
+          name: oidc-test
+          ports:
+            - containerPort: 8080
+          resources: {}
+          envFrom:
+          - configMapRef:
+              name: oidc-test
+          env:
+          - name: OIDC_CLIENT_ID
+            valueFrom:
+              secretKeyRef:
+                name: oidc-test-oauth2-client
+                key: client_id
+          - name: OIDC_CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: oidc-test-oauth2-client
+                key: client_secret
+      restartPolicy: Always
--- a/examples/authenticated-app/resources/oauth2-client.yaml
+++ b/examples/authenticated-app/resources/oauth2-client.yaml
@ -1,9 +1,9 @@
 apiVersion: hydra.ory.sh/v1alpha1
 kind: OAuth2Client
 metadata:
-  name: app-oauth2-client
+  name: oidc-test-oauth2-client
 spec:
-  clientName: "app"
+  clientName: "oidc-test"
  tokenEndpointAuthMethod: "client_secret_basic"
  grantTypes:
  - authorization_code
@ -11,8 +11,8 @@ spec:
  responseTypes:
  - code
  scope: "openid email"
-  secretName: app-oidc-secret
+  secretName: oidc-test-oauth2-client
  redirectUris:
-  - https://ssokustom/oauth2/callback
+  - https://example.net/oauth2/callback
  postLogoutRedirectUris:
-  - https://ssokustom
+  - https://example.net
--- a/components/oidc-test/resources/service.yaml
+++ b/components/oidc-test/resources/service.yaml
@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: oidc-test
+  name: oidc-test
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+  selector:
+    app.kubernetes.io/name: oidc-test
+status:
+  loadBalancer: {}
--- a/examples/authenticated-app/kustomization.yaml
+++ b/examples/authenticated-app/kustomization.yaml
@ -2,20 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
-  - ../../resources/hydra
-  - ../../resources/hydra-dispatcher
-  - ./resources/app.yaml
+  - ../../overlays/full
  - ./resources/ingress.yaml
-  - ./resources/oauth2-client.yaml
  - ./resources/saml-idp.yaml
  - ./resources/self-signed-issuer.yaml
  - ./resources/port-forwarder.yaml

-components:
-  - ../../components/hydra-cnpg-database
-  #- ../../components/hydra-oidc
-  - ../../components/hydra-saml
-
 patchesJson6902:
  - target:
      version: v1
@ -37,3 +29,13 @@ patchesJson6902:
      kind: Secret
      name: hydra-secret
    path: patches/hydra-secret.yaml
+  - target:
+      version: v1
+      kind: ConfigMap
+      name: oidc-test
+    path: patches/oidc-test.yaml
+  - target:
+      version: v1alpha1
+      kind: OAuth2Client
+      name: oidc-test-oauth2-client
+    path: patches/oidc-test-oauth2-client.yaml
--- a/examples/authenticated-app/patches/oidc-test-oauth2-client.yaml
+++ b/examples/authenticated-app/patches/oidc-test-oauth2-client.yaml
@ -0,0 +1,6 @@
+- op: replace
+  path: "/spec/redirectUris/0"
+  value: https://ssokustom/oauth2/callback
+- op: replace
+  path: "/spec/postLogoutRedirectUris/0"
+  value: https://ssokustom
--- a/examples/authenticated-app/patches/oidc-test.yaml
+++ b/examples/authenticated-app/patches/oidc-test.yaml
@ -0,0 +1,6 @@
+- op: replace
+  path: "/data/OIDC_REDIRECT_URL"
+  value: https://ssokustom/oauth2/callback
+- op: replace
+  path: "/data/OIDC_POST_LOGOUT_REDIRECT_URL"
+  value: https://ssokustom
--- a/examples/authenticated-app/resources/app.yaml
+++ b/examples/authenticated-app/resources/app.yaml
@ -1,66 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    io.kompose.service: app
-  name: app
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      io.kompose.service: app
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        io.kompose.service: app
-    spec:
-      containers:
-        - image: reg.cadoles.com/cadoles/oidc-test:2023.11.6-stable.1557.e16b905
-          name: app
-          ports:
-            - containerPort: 8080
-          resources: {}
-          env:
-            - name: LOG_LEVEL
-              value: "0"
-            - name: HTTP_ADDRESS
-              value: 0.0.0.0:8080
-            - name: OIDC_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: app-oidc-secret
-                  key: client_id
-            - name: OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: app-oidc-secret
-                  key: client_secret
-            - name: OIDC_ISSUER_URL
-              value: http://hydra:4444
-            - name: OIDC_REDIRECT_URL
-              value: https://ssokustom/oauth2/callback
-            - name: OIDC_POST_LOGOUT_REDIRECT_URL
-              value: https://ssokustom
-            - name: OIDC_SKIP_ISSUER_VERIFICATION
-              value: "true"
-            - name: OIDC_INSECURE_SKIP_VERIFY
-              value: "true"
-      restartPolicy: Always
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    io.kompose.service: app
-  name: app
-spec:
-  ports:
-    - name: http
-      port: 8080
-      targetPort: 8080
-  selector:
-    io.kompose.service: app
-status:
-  loadBalancer: {}
--- a/examples/authenticated-app/resources/ingress.yaml
+++ b/examples/authenticated-app/resources/ingress.yaml
@ -20,7 +20,7 @@ spec:
        pathType: Prefix
        backend:
          service:
-            name: app
+            name: oidc-test
            port:
              name: http
 ---
--- a/kustomization.yaml
+++ b/kustomization.yaml
@ -2,11 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
- ./resources/hydra
- ./resources/hydra-dispatcher
-
-components:
- ./components/hydra-cnpg-database
- ./components/hydra-oidc
- ./components/hydra-saml
- ./components/hydra-sql
+- ./overlays/base
--- a/overlays/base/kustomization.yaml
+++ b/overlays/base/kustomization.yaml
@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../resources/hydra
+- ../../resources/hydra-dispatcher
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: sso-kustom
+      app.kubernetes.io/component: auth
--- a/overlays/full/kustomization.yaml
+++ b/overlays/full/kustomization.yaml
@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../base
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: sso-kustom
+      app.kubernetes.io/component: auth
+
+components:
+- ../../components/hydra-cnpg-database
+- ../../components/hydra-oidc
+- ../../components/hydra-saml
+- ../../components/hydra-sql
+- ../../components/oidc-test