Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

step 1: move to OSS, update imports #179

Merged
merged 8 commits into from
Oct 2, 2023
Merged

step 1: move to OSS, update imports #179

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
2f6f253
step 1: move to OSS, update imports
sfunkhouser Sep 30, 2023
1af9ff7
move trivy to buildkite, dockerifle.dev not needed
sfunkhouser Oct 1, 2023
5edf795
APP_NAME
sfunkhouser Oct 1, 2023
20e6b8a
APP_NAME
sfunkhouser Oct 1, 2023
c6fc9dd
fixup
sfunkhouser Oct 1, 2023
62eb39b
moar fixes
sfunkhouser Oct 1, 2023
6f0ae80
bump trivy version
sfunkhouser Oct 1, 2023
e40bbcc
use non-root user
sfunkhouser Oct 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 26 additions & 16 deletions .buildkite/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
env:
ARTIFACT_NAME: gov-okta-addon
APP_NAME: gov-okta-addon
GOPRIVATE: github.com/equinixmetal/*,go.equinixmetal.net
QUAY_REPO: quay.io/equinixmetal/gov-okta-addon
IMAGE_REPO: quay.io/equinixmetal/gov-okta-addon
IMAGE_TAG: ${BUILDKITE_BUILD_NUMBER}-${BUILDKITE_COMMIT:0:8}
DEPLOYMENT_REPO: k8s-gov-okta-addon

Expand Down Expand Up @@ -31,7 +31,7 @@ steps:

- label: ":golang: build"
key: "gobuild"
artifact_paths: "${ARTIFACT_NAME}-bin"
artifact_paths: "bin/${APP_NAME}"
plugins:
- ssh://git@github.com/packethost/ssm-buildkite-plugin#v1.0.4:
parameters:
Expand All @@ -44,28 +44,38 @@ steps:
- CGO_ENABLED=0
- GOOS=linux
entrypoint: ./scripts/ci_entrypoint.sh
command: ["go", "build", "-buildvcs=false", "-mod=mod", "-a", "-o", "gov-okta-addon-bin"]
command: ["go", "build", "-buildvcs=false", "-mod=mod", "-a", "-o", "bin/$APP_NAME"]

- label: ":docker: docker build and publish"
key: "build"
depends_on: ["lint", "test", "gobuild"]
env:
BUILDKITE_PLUGINS_ALWAYS_CLONE_FRESH: "true"
commands: |
#!/bin/bash
echo --- Retrieve Artifacts
buildkite-agent artifact download "${ARTIFACT_NAME}-bin" .

# work around buildkite stripping the path if the artifact is the same name as the build
echo -- Rename artifact
mv ${ARTIFACT_NAME}-bin ${ARTIFACT_NAME}
buildkite-agent artifact download "bin/${APP_NAME}" .

# make sure it is executable
chmod +x ${ARTIFACT_NAME}

echo --- Build Docker Image
docker build . -t "$QUAY_REPO:$IMAGE_TAG"

echo --- Push Docker Image
docker push "$QUAY_REPO:$IMAGE_TAG"
chmod +x bin/${APP_NAME}
plugins:
# - docker-login#v2.1.0:
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will be needed when flipping to metal-toolbox

# username: metal-buildkite
# password-env: SECRET_GHCR_PUBLISH_TOKEN
# server: ghcr.io
- equinixmetal-buildkite/docker-metadata#v1.0.0:
images:
- "${IMAGE_REPO}"
extra_tags:
- "${IMAGE_TAG}"
- equinixmetal-buildkite/docker-build#v1.1.0:
push: true
build-args:
- NAME=${APP_NAME}
- equinixmetal-buildkite/trivy#v1.18.3:
severity: CRITICAL,HIGH
ignore-unfixed: true
security-checks: config,secret,vuln

# For main commits, pull-requests will be created to bump the image in the deployment manifest
- label: "Bump image tag for main branch builds"
Expand Down
41 changes: 0 additions & 41 deletions .github/workflows/scan-trivy.yml
View file
Open in desktop

This file was deleted.

7 changes: 5 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
FROM gcr.io/distroless/static
FROM gcr.io/distroless/static:nonroot

COPY ./gov-okta-addon /addon
# `nonroot` coming from distroless
USER 65532:65532

COPY ./bin/gov-okta-addon /addon

# Run the web service on container startup.
ENTRYPOINT ["/addon"]
Expand Down
32 changes: 0 additions & 32 deletions Dockerfile.dev
View file
Open in desktop

This file was deleted.

6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ accordingly in Okta.

`gov-okta-addon` subscribes to the Governor event stream where change events are published. The events published
by Governor contain the group and/or user id that changed and the type of action. Events are published on NATS subjects
dedicated to the resource type ie. `equinixmetal.governor.events.groups` for group events. When `gov-okta-addon` receives
dedicated to the resource type ie. `governor.events.groups` for group events. When `gov-okta-addon` receives
an event, it reacts by requesting information from Governor about the included resource IDs and making the required
changes in Okta.

Expand Down Expand Up @@ -62,7 +62,7 @@ be removed from the group. The groups and users must already exist in governor o

### Prereq to running locally with governor-api devcontainer

Follow the directions [here](https://github.com/equinixmetal/governor/blob/main/README.md#running-governor-locally) for starting the governor-api devcontainer.
Follow the directions [here](https://github.com/metal-toolbox/governor-api#running-governor-api-locally) for starting the governor-api devcontainer.

The **first time** you'll need to create a local hydra client for `gov-okta-addon-governor` and copy the nats creds file. After that you can just export the env variables.

Expand Down Expand Up @@ -102,7 +102,7 @@ Export the following in the terminal where you will run gov-okta-addon:
```sh
export GOA_NATS_URL="nats://127.0.0.1:4222"
export GOA_OKTA_NOCACHE=true
export GOA_OKTA_URL="https://equinixmetal.oktapreview.com"
export GOA_OKTA_URL="https://example.oktapreview.com"
export GOA_GOVERNOR_URL="http://127.0.0.1:3001"
export GOA_GOVERNOR_AUDIENCE="http://api:3001/"
export GOA_GOVERNOR_TOKEN_URL="http://127.0.0.1:4444/oauth2/token"
Expand Down
14 changes: 7 additions & 7 deletions cmd/serve.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,17 @@ import (
"time"

"github.com/equinixmetal/addonx/natslock"
"github.com/equinixmetal/gov-okta-addon/internal/okta"
"github.com/equinixmetal/gov-okta-addon/internal/reconciler"
"github.com/equinixmetal/gov-okta-addon/internal/srv"
"github.com/metal-toolbox/auditevent"
audithelpers "github.com/metal-toolbox/auditevent/helpers"
"github.com/nats-io/nats.go"
"github.com/spf13/cobra"
"github.com/spf13/viper"
"go.equinixmetal.net/gov-okta-addon/internal/okta"
"go.equinixmetal.net/gov-okta-addon/internal/reconciler"
"go.equinixmetal.net/gov-okta-addon/internal/srv"
"golang.org/x/oauth2/clientcredentials"

governor "go.equinixmetal.net/governor-api/pkg/client"
governor "github.com/metal-toolbox/governor-api/pkg/client"
)

const (
Expand Down Expand Up @@ -52,9 +52,9 @@ func init() {
viperBindFlag("nats.url", serveCmd.Flags().Lookup("nats-url"))
serveCmd.PersistentFlags().String("nats-creds-file", "", "Path to the file containing the NATS credentials file")
viperBindFlag("nats.creds-file", serveCmd.PersistentFlags().Lookup("nats-creds-file"))
serveCmd.Flags().String("nats-subject-prefix", "equinixmetal.governor.events", "prefix for NATS subjects")
serveCmd.Flags().String("nats-subject-prefix", "governor.events", "prefix for NATS subjects")
viperBindFlag("nats.subject-prefix", serveCmd.Flags().Lookup("nats-subject-prefix"))
serveCmd.Flags().String("nats-queue-group", "equinixmetal.governor.addons.gov-okta-addon", "queue group for load balancing messages across NATS consumers")
serveCmd.Flags().String("nats-queue-group", "governor.addons.gov-okta-addon", "queue group for load balancing messages across NATS consumers")
viperBindFlag("nats.queue-group", serveCmd.Flags().Lookup("nats-queue-group"))
serveCmd.Flags().Int("nats-queue-size", defaultNATSQueueSize, "queue size for load balancing messages across NATS consumers")
viperBindFlag("nats.queue-size", serveCmd.Flags().Lookup("nats-queue-size"))
Expand All @@ -73,7 +73,7 @@ func init() {
viperBindFlag("audit.log-path", serveCmd.Flags().Lookup("audit-log-path"))

// Okta related flags
serveCmd.Flags().String("okta-url", "https://equinixmetal.okta.com", "url for Okta client calls")
serveCmd.Flags().String("okta-url", "https://example.okta.com", "url for Okta client calls")
viperBindFlag("okta.url", serveCmd.Flags().Lookup("okta-url"))
serveCmd.Flags().String("okta-token", "", "token for access to the Okta API")
viperBindFlag("okta.token", serveCmd.Flags().Lookup("okta-token"))
Expand Down
2 changes: 1 addition & 1 deletion cmd/sync.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ func init() {
viperBindFlag("sync.dryrun", syncCmd.PersistentFlags().Lookup("dry-run"))

// Okta related flags
syncCmd.PersistentFlags().String("okta-url", "https://equinixmetal.okta.com", "url for Okta client calls")
syncCmd.PersistentFlags().String("okta-url", "https://example.okta.com", "url for Okta client calls")
viperBindFlag("okta.url", syncCmd.PersistentFlags().Lookup("okta-url"))
syncCmd.PersistentFlags().String("okta-token", "", "token for access to the Okta API")
viperBindFlag("okta.token", syncCmd.PersistentFlags().Lookup("okta-token"))
Expand Down
6 changes: 3 additions & 3 deletions cmd/sync_groups.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,14 @@ import (
"net/url"
"strings"

"github.com/equinixmetal/gov-okta-addon/internal/okta"
"github.com/gosimple/slug"
"github.com/metal-toolbox/governor-api/pkg/api/v1alpha1"
governor "github.com/metal-toolbox/governor-api/pkg/client"
okt "github.com/okta/okta-sdk-golang/v2/okta"
"github.com/okta/okta-sdk-golang/v2/okta/query"
"github.com/spf13/cobra"
"github.com/spf13/viper"
"go.equinixmetal.net/gov-okta-addon/internal/okta"
"go.equinixmetal.net/governor-api/pkg/api/v1alpha1"
governor "go.equinixmetal.net/governor-api/pkg/client"
"go.uber.org/zap"
"golang.org/x/oauth2/clientcredentials"
)
Expand Down
6 changes: 3 additions & 3 deletions cmd/sync_members.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,12 @@ import (
"fmt"
"net/url"

"github.com/equinixmetal/gov-okta-addon/internal/okta"
"github.com/metal-toolbox/governor-api/pkg/api/v1alpha1"
governor "github.com/metal-toolbox/governor-api/pkg/client"
okt "github.com/okta/okta-sdk-golang/v2/okta"
"github.com/spf13/cobra"
"github.com/spf13/viper"
"go.equinixmetal.net/gov-okta-addon/internal/okta"
"go.equinixmetal.net/governor-api/pkg/api/v1alpha1"
governor "go.equinixmetal.net/governor-api/pkg/client"

"go.uber.org/zap"
"golang.org/x/oauth2/clientcredentials"
Expand Down
6 changes: 3 additions & 3 deletions cmd/sync_users.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,13 @@ import (
"fmt"
"net/url"

"github.com/equinixmetal/gov-okta-addon/internal/okta"
"github.com/metal-toolbox/governor-api/pkg/api/v1alpha1"
governor "github.com/metal-toolbox/governor-api/pkg/client"
okt "github.com/okta/okta-sdk-golang/v2/okta"
"github.com/okta/okta-sdk-golang/v2/okta/query"
"github.com/spf13/cobra"
"github.com/spf13/viper"
"go.equinixmetal.net/gov-okta-addon/internal/okta"
"go.equinixmetal.net/governor-api/pkg/api/v1alpha1"
governor "go.equinixmetal.net/governor-api/pkg/client"
"go.uber.org/zap"
"golang.org/x/oauth2/clientcredentials"
)
Expand Down
Loading