Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security via operator, OIDC trusted certificates #1314

Merged
merged 14 commits into from
Jan 9, 2025
Merged

Security via operator, OIDC trusted certificates #1314

merged 14 commits into from
Jan 9, 2025

Conversation

MikeEdgar
Copy link
Member

@MikeEdgar MikeEdgar commented Dec 17, 2024 •
edited
Loading

  1. Enable security to be configured via operator/Console CR. This allows an OIDC provider, security subjects (users or groups), and roles with access rules to be given in the CR using the same structure as the API server's YAML configuration file.
  2. Support the use of a truststore for the OIDC identity provider. The truststore must be passed to both the API and the UI in potentially different formats. The API supports and of JKS, P12, or PEM truststores, but the UI must have it provided as a PEM chain.
  3. Modify API integration tests to use TLS with Keycloak instance.
  4. Move configuration mapping in operator code from ConsoleSecret dependent resource to new ConfigurationProcessor "virtual" resource upon which all other dependent resources depend on. This provides a single point of validation at the start of each reconcile process.
  5. Improve deployment ready condition in operator, taking behavior from kubectl's deployment rollout status check.

Closes #1247
Closes #1248

Issue #1335 will further refine how truststores are configured in the API server by avoiding the use of quarkus.tls.* configuration properties and supporting configuration in the console's own YAML file.

@MikeEdgar MikeEdgar force-pushed the issue-1247 branch 2 times, most recently from 8e8da27 to ca9b92d Compare December 20, 2024 15:08
@MikeEdgar MikeEdgar force-pushed the issue-1247 branch 2 times, most recently from 6d4dd5e to e15b8a0 Compare January 3, 2025 12:17
@MikeEdgar MikeEdgar changed the title [WIP] Update operator for security configuration Security via operator, OIDC trusted certificates Jan 3, 2025
@MikeEdgar MikeEdgar added this to the 0.6.0 milestone Jan 3, 2025
@MikeEdgar MikeEdgar marked this pull request as ready for review January 6, 2025 14:00
@MikeEdgar MikeEdgar requested a review from a team January 6, 2025 14:00
MikeEdgar
MikeEdgar commented Jan 6, 2025
View reviewed changes
api/src/main/resources/application.properties
@@ -68,6 +68,7 @@ quarkus.arc.exclude-types=io.apicurio.registry.rest.JacksonDateTimeCustomizer
quarkus.index-dependency.strimzi-api.group-id=io.strimzi
quarkus.index-dependency.strimzi-api.artifact-id=api

console.work-path=${java.io.tmpdir}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The operator overrides this to use an emptydir volume in Kube, maintaining a read-only root container filesystem.

MikeEdgar
MikeEdgar commented Jan 6, 2025
View reviewed changes
operator/src/main/java/com/github/streamshub/console/dependents/ConsoleDeployment.java
Comment on lines +140 to +142
private String pullPolicy(String image) {
return image.contains("sha256:") ? "IfNotPresent" : "Always";
}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea here is there is no point re-pulling an image that uses a SHA, but a tagged image may have changed and should be re-pulled. Default configuration in the released operator will use image SHAs.

@MikeEdgar MikeEdgar requested a review from k-wall January 6, 2025 15:28
MikeEdgar added 10 commits January 8, 2025 07:08
@MikeEdgar
[WIP] Update operator for security configuration
15d3651 
Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
Validate configuration earlier in reconciliation, set conditions
0a0187a 
Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
add security testing, minor re-factoring
fd611a0 
Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
fix Sonar issues
58217f8 
Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
[WIP] Configure truststore for OIDC provider
644bfc6 
Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
Exclude auth for non-API paths, fix status update, fix dep status chk
0ef9a00 
- map UI variable for PEM truststore
- always pull images without SHAs

Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
fix: default replica values in deployment status to zero
5ac5e3f 
Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
Add test for OIDC truststore w/JKS to PEM conversion
b76f5c8 
Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
Remove dead code, additional testing for invalid CR scenario
56b1053 
Signed-off-by: Michael Edgar <[email protected]>
@MikeEdgar
Use TLS + truststore with Keycloak for API OIDC tests
4831808 
Signed-off-by: Michael Edgar <[email protected]>
@k-wall
Copy link

k-wall commented Jan 8, 2025

Could you expand on the "Enable security to be configured via operator/Console CR" bullet in the PR's description. I'm lacking some context.

@MikeEdgar
Copy link
Member Author

Could you expand on the "Enable security to be configured via operator/Console CR" bullet in the PR's description. I'm lacking some context.

Updated. Let me know if you have any questions on it.

  1. Enable security to be configured via operator/Console CR. This allows an OIDC provider, security subjects (users or groups), and roles with access rules to be given in the CR using the same structure as the API server's YAML configuration file.

@k-wall
Copy link

k-wall commented Jan 9, 2025

It is a big PR, so reviewing has been tough going. LGTM.
In future, if it is possible to decompose into smaller PRs reviews will be easier.

@k-wall
Copy link

k-wall commented Jan 9, 2025

Thanks for the update, lgtm

@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Jan 9, 2025

Quality Gate Passed Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
89.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@MikeEdgar MikeEdgar merged commit 49e2ad1 into streamshub:main Jan 9, 2025
6 checks passed
@MikeEdgar MikeEdgar deleted the issue-1247 branch January 9, 2025 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@k-wall k-wall k-wall approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
0.6.0
Development

Successfully merging this pull request may close these issues.

Allow use of self-signed certificates for an OIDC provider Support security configuration via the operator
2 participants
@MikeEdgar @k-wall