Automation for identity provider management and dex configuration

[anvddriesch]

Coming from the RFC regarding management cluster access and the plan to use azure active directory as our default identity provider

We need automation in order to scale the management of dex connectors and the required application setup as well as rotation of client secrets.

requirements

• manage a list of identity providers with credentials that should be used in the automation
• manage an application on each configured identity provider for each dex app we run
• manage connector config for each of these dex apps with the data from the identity providers

Tasks

• implementation
  • implement app controller
  • implement idp resource
  • implement provider interface
  • add test suite
  • add helm chart and ensure dex operator can be deployed
  • implement azure provider
  • Update dex helm chart to support arrays of connectors for giant swarm and customers #1593
  • Add README to dex-operator
  • https://github.com/giantswarm/giantswarm/issues/21627
  • Implement dex-operator update logic #1629
  • https://github.com/giantswarm/giantswarm/issues/24386
  • Add support for a backup IdP to dex-app #603
    • Update kubectl gs to accept various Dex connectors on login #1592
    • Update happa to accept various dex connectors on login #1845
  • https://github.com/giantswarm/giantswarm/issues/25153
• initial roll out
  • Roll out dex-operator to all installations #1596
  • Consider alerts and metrics for dex-operator #1809
  • dex-operator documentation #1718
  • come up with dex automation "release" plan (announcements, blogpost?, customer intro etc) #1856
  • consider unified design for dex login page across services
• secret mamagement
  • Improve dex operator credential management #1764
  • Either manage existing github apps via dex-operator or clean them up somehow
• alignment
  • https://github.com/giantswarm/giantswarm/issues/24931
  • https://github.com/giantswarm/giantswarm/issues/23694
  • Align all our apps (prometheus, grafana, happa, kgs... etc) to use automated dex for logging in
• next steps
  • how to deal with merging of default dex connectors, user connectors and secrets vs configmaps #1810
  • Manage customers' dex instances using dex-operator #2486
  • keep github connector but automate it with dex-operator #1914
  • https://github.com/giantswarm/giantswarm/issues/24888
  • Revisit default SSO for all WCs

[anvddriesch]

sketch from today

[anvddriesch]

New operator lives here https://github.com/giantswarm/dex-operator
still WIP

[gawertm]

everything is in the epic already.