Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(dex): Add correct dex service name and mux #1534

Merged
merged 2 commits into from
Apr 23, 2024

Conversation

sven-urbanski-freiheit-com
Copy link
Collaborator

  • The dex service is called kuberpult-dex
  • The dex routes are now added to the mux which is served -> before they were implicitly added to http.DefaultServeMux but the mux which was served was http.NewServeMux()

Now when you try to access any of

		"/environments",
		"/environments/",
		"/environment-groups",
		"/environment-groups/",
		"/release",

if c.DexEnabled you should get forwarded.

For setup of the values.yaml (I only paste dex-relevant stuff, of course you'd also need a manifest repo connected etc.):

auth:
  dexAuth:
    baseURL: https://kuberpult.example.com
    clientId: sample-id-kuberpult-dex
    clientSecret: sample-secret-kuberpult-dex
    enabled: true
    installDex: true
    policy_csv: |
      p, role:Developer, CreateLock, *:*, *, allow
      g, your-github-org:your-github-team, role:Developer
    scopes: "openid, groups, email, profile, federated:id"
dex:
  config:
    connectors:
    - config:
        clientID: GITHUB_OAUTH_CLIENT_ID
        clientSecret: GITHUB_OAUTH_CLIENT_SECRET
        orgs:
        - name: your-github-org
        redirectURI: https://kuberpult.example.com/dex/callback
      id: github
      name: GitHub
      type: github
    issuer: https://kuberpult.example.com/dex
    staticClients:
    - id: sample-id-kuberpult-dex
      name: kuberpult
      redirectURIs:
      - https://kuberpult.example.com/callback
      secret: sample-secret-kuberpult-dex
    storage:
      type: memory

Remark:

  • The scopes have to be a string with comma seperated values
  • The clientID in dex.config.connectors[0].config.clientID is used for authentication with e.g. GitHub
  • The clientID in auth.dexAuth.clientID is another one which matches the staticClient at dex.staticClients[0].id
  • The same goes for the secrets - I stumbled over this.

Now with this setup replacing:

  • kuberpult.example.com with your hostname
  • GITHUB_OAUTH_CLIENT_ID with your oauth client ID created in your GitHub Org
  • GITHUB_OAUTH_CLIENT_SECRET with your oauth client secret created in your GitHub Org
  • your-github-org with the name of your github-org
    image

It should also work for you.

And of course you need to switch the image in frontend-service to the version of this PR.
Which was a little tricky for testing as frontend.tag option is not allowed the values anymore. I just patched the deployment in my cluster afterwards manually.

Afterwards access kuberpult.example.com/environments -> you will get redirected to GitHub login:
image

Then a cookie will be set:
image

Which also contains the relevant information:
image

Originally opened by @jdvgh
Closes #1510

- Use `kuberpult-dex` as service name for dex setup as this is the name
  of the service inside the chart
- Rearrange the mux creation in the frontend, so the handleFunc calls to
  Dex-Endpoints are exposed correctly

REV: DSN-S3INPY
@jdvgh
Copy link
Contributor

jdvgh commented Apr 22, 2024

It looks like the failing step is something uncorrelated to my changes from the logs of the CI.

@sven-urbanski-freiheit-com
Copy link
Collaborator Author

sven-urbanski-freiheit-com commented Apr 22, 2024

@jdvgh should I merge it as it is now?
The integration test was successful

@sven-urbanski-freiheit-com sven-urbanski-freiheit-com changed the title feat(dex): Add correct dex service name and mux fix(dex): Add correct dex service name and mux Apr 22, 2024
@jdvgh
Copy link
Contributor

jdvgh commented Apr 22, 2024

Yeah, go ahead!🙂

@sven-urbanski-freiheit-com sven-urbanski-freiheit-com merged commit 55b6ffd into main Apr 23, 2024
12 checks passed
@sven-urbanski-freiheit-com sven-urbanski-freiheit-com deleted the feature/add-correct-dex-setup branch April 23, 2024 07:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants