Skip to content

Commit e2fe58a

Browse files
rjferguson21mjnagel
rjferguson21
and
mjnagel
authoredAug 19, 2024
feat: support authservice with redis, switch to pepr helm chart (defenseunicorns#658)
## Description * Updates Pepr to 0.34.0 * Uses Pepr Helm Chart * Adds support to configure redis as authservice memory store ## Related Issue Fixes defenseunicorns#518 ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Checklist before merging - [ ] Test, docs, adr added or updated as needed - [ ] [Contributor Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md) followed --------- Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
1 parent 5a34ce8 commit e2fe58a

File tree

19 files changed

+550
-329
lines changed

19 files changed

+550
-329
lines changed
 

‎.yamllint

+1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ ignore:
99
- '**/chart/templates**'
1010
- 'node_modules/**'
1111
- 'dist/**'
12+
- 'src/pepr/uds-operator-config/templates**'
1213

1314
rules:
1415
anchors: enable

‎docs/configuration/uds-operator.md

+11
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,17 @@ The UDS Operator uses the first `redirectUris` to populate the `match.prefix` ho
152152

153153
For a complete example, see [app-authservice-tenant.yaml](https://github.com/defenseunicorns/uds-core/blob/main/src/test/app-authservice-tenant.yaml)
154154

155+
#### External Session Store
156+
If you wish to scale Authservice horiztonally, Authservice supports using an [external redis session store](https://docs.tetrate.io/istio-authservice/configuration/oidc#session-store-configuration) which can be configured by setting [UDS_AUTHSERVICE_REDIS_URI](https://github.com/defenseunicorns/uds-core/blob/main/src/pepr/zarf.yaml#L20-L22).
157+
158+
You can also specify the `AUTHSERVICE_REDIS_URI` variable in your `uds-config.yaml`:
159+
160+
```yaml
161+
variables:
162+
core:
163+
AUTHSERVICE_REDIS_URI: redis://redis.redis.svc.cluster.local:6379
164+
```
165+
155166
#### Trusted Certificate Authority
156167

157168
Authservice can be configured with additional trusted certificate bundle in cases where UDS Core ingress gateways are deployed with private PKI.

‎package-lock.json

+310-301
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

+1-8
Original file line numberDiff line numberDiff line change
@@ -23,20 +23,13 @@
2323
"zarf"
2424
],
2525
"labels": []
26-
},
27-
"env": {
28-
"UDS_DOMAIN": "###ZARF_VAR_DOMAIN###",
29-
"UDS_CA_CERT": "###ZARF_VAR_CA_CERT###",
30-
"UDS_ALLOW_ALL_NS_EXEMPTIONS": "###ZARF_VAR_ALLOW_ALL_NS_EXEMPTIONS###",
31-
"UDS_SINGLE_TEST": "###ZARF_VAR_UDS_SINGLE_TEST###",
32-
"UDS_LOG_LEVEL": "###ZARF_VAR_UDS_LOG_LEVEL###"
3326
}
3427
},
3528
"scripts": {
3629
"k3d-setup": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0'"
3730
},
3831
"dependencies": {
39-
"pepr": "0.33.0"
32+
"pepr": "0.34.0"
4033
},
4134
"devDependencies": {
4235
"@jest/globals": "29.7.0",

‎packages/slim-dev/zarf.yaml

+6-7
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@ metadata:
77
version: "0.25.2"
88
# x-release-please-end
99

10-
variables:
11-
- name: CA_CERT
12-
description: "Base64 encoded CA cert that signed the domain wildcard certs used for Istio ingress"
13-
default: ""
14-
1510
components:
11+
- name: uds-operator-config
12+
required: true
13+
import:
14+
path: ../../src/pepr
15+
1616
# CRDs
1717
- name: prometheus-operator-crds
1818
required: true
@@ -44,8 +44,7 @@ components:
4444
- name: pepr-uds-core
4545
required: true
4646
import:
47-
path: ../../dist
48-
name: module
47+
path: ../../src/pepr
4948

5049
# Keycloak
5150
- name: keycloak

‎packages/standard/zarf.yaml

+6-7
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@ metadata:
77
version: "0.25.2"
88
# x-release-please-end
99

10-
variables:
11-
- name: CA_CERT
12-
description: "Base64 encoded CA cert that signed the domain wildcard certs used for Istio ingress"
13-
default: ""
14-
1510
components:
11+
- name: uds-operator-config
12+
required: true
13+
import:
14+
path: ../../src/pepr
15+
1616
# CRDs
1717
- name: prometheus-operator-crds
1818
required: true
@@ -44,8 +44,7 @@ components:
4444
- name: pepr-uds-core
4545
required: true
4646
import:
47-
path: ../../dist
48-
name: module
47+
path: ../../src/pepr
4948

5049
# Metrics Server
5150
- name: metrics-server

‎src/authservice/chart/templates/uds-package.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ spec:
1616
# Egress must be allowed to the external facing Keycloak endpoint
1717
- direction: Egress
1818
remoteGenerated: Anywhere
19-
description: "SSO Provider"
19+
description: "SSO Provider & Redis Session Store"
2020

2121
- direction: Ingress
2222
selector:

‎src/istio/common/manifests/pepr-istio-config.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,18 @@ spec:
2121
portLevelMtls:
2222
"3000":
2323
mode: PERMISSIVE
24+
---
25+
apiVersion: "security.istio.io/v1beta1"
26+
kind: PeerAuthentication
27+
metadata:
28+
name: permissive-pepr-webhook-watcher
29+
namespace: pepr-system
30+
spec:
31+
selector:
32+
matchLabels:
33+
pepr.dev/controller: watcher
34+
mtls:
35+
mode: STRICT
36+
portLevelMtls:
37+
"3000":
38+
mode: PERMISSIVE

‎src/pepr/config.ts

+7
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import { Component, setupLogger } from "./logger";
22

33
let domain = process.env.UDS_DOMAIN;
44
let caCert = process.env.UDS_CA_CERT;
5+
let authserviceRedisUri = process.env.AUTHSERVICE_REDIS_URI;
56

67
// We need to handle `npx pepr <>` commands that will not template the env vars
78
if (!domain || domain === "###ZARF_VAR_DOMAIN###") {
@@ -10,6 +11,9 @@ if (!domain || domain === "###ZARF_VAR_DOMAIN###") {
1011
if (!caCert || caCert === "###ZARF_VAR_CA_CERT###") {
1112
caCert = "";
1213
}
14+
if (!authserviceRedisUri || authserviceRedisUri === "###ZARF_VAR_AUTHSERVICE_REDIS_URI###") {
15+
authserviceRedisUri = "";
16+
}
1317

1418
export const UDSConfig = {
1519
// Ignore the UDS_DOMAIN if not deployed by Zarf
@@ -20,6 +24,9 @@ export const UDSConfig = {
2024
isSingleTest: process.env.UDS_SINGLE_TEST === "true",
2125
// Allow UDS policy exemptions to be used in any namespace
2226
allowAllNSExemptions: process.env.UDS_ALLOW_ALL_NS_EXEMPTIONS === "true",
27+
28+
// Redis URI for Authservice
29+
authserviceRedisUri,
2330
};
2431

2532
// configure subproject logger

‎src/pepr/operator/controllers/keycloak/authservice/config.ts

+9-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ export async function setupAuthserviceSecret() {
4343

4444
// this initial secret is only a placeholder until the first chain is created
4545
function buildInitialSecret(): AuthserviceConfig {
46-
return {
46+
const config: AuthserviceConfig = {
4747
allow_unmatched_requests: false,
4848
listen_address: "0.0.0.0",
4949
listen_port: "10003",
@@ -84,6 +84,14 @@ function buildInitialSecret(): AuthserviceConfig {
8484
}),
8585
],
8686
};
87+
88+
if (UDSConfig.authserviceRedisUri) {
89+
config.default_oidc_config.redis_session_store_config = {
90+
server_uri: UDSConfig.authserviceRedisUri!,
91+
};
92+
}
93+
94+
return config;
8795
}
8896

8997
export async function getAuthserviceConfig() {

‎src/pepr/operator/controllers/keycloak/authservice/types.ts

+1
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ interface OIDCConfig {
3737
absolute_session_timeout?: string;
3838
idle_session_timeout?: string;
3939
scopes: string[];
40+
redis_session_store_config?: { server_uri: string };
4041
}
4142

4243
interface JWKSFetcher {

‎src/pepr/uds-operator-config/Chart.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v2
2+
name: uds-operator-config
3+
description: UDS Core configuration for UDS Operator
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0

‎src/pepr/uds-operator-config/templates/_helpers.tpl

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "uds-operator-config.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "uds-operator-config.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "uds-operator-config.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "uds-operator-config.labels" -}}
37+
helm.sh/chart: {{ include "uds-operator-config.chart" . }}
38+
{{ include "uds-operator-config.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "uds-operator-config.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "uds-operator-config.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "uds-operator-config.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "uds-operator-config.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎src/pepr/uds-operator-config/templates/secret.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: uds-operator-config
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
{{- include "uds-operator-config.labels" . | nindent 4 }}
8+
type: Opaque
9+
data:
10+
{{- range $key, $value := .Values.operator }}
11+
{{ $key }}: {{ $value | b64enc | quote }}
12+
{{- end }}

‎src/pepr/uds-operator-config/values.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
operator:
2+
UDS_DOMAIN: "###ZARF_VAR_DOMAIN###"
3+
UDS_CA_CERT: "###ZARF_VAR_CA_CERT###"
4+
UDS_ALLOW_ALL_NS_EXEMPTIONS: "###ZARF_VAR_ALLOW_ALL_NS_EXEMPTIONS###"
5+
UDS_SINGLE_TEST: "###ZARF_VAR_UDS_SINGLE_TEST###"
6+
UDS_LOG_LEVEL: "###ZARF_VAR_UDS_LOG_LEVEL###"
7+
AUTHSERVICE_REDIS_URI: "###ZARF_VAR_AUTHSERVICE_REDIS_URI###"

‎src/pepr/values.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
watcher:
2+
serviceMonitor:
3+
enabled: ###ZARF_VAR_PEPR_SERVICE_MONITORS###
4+
envFrom:
5+
- secretRef:
6+
name: uds-operator-config
7+
admission:
8+
serviceMonitor:
9+
enabled: ###ZARF_VAR_PEPR_SERVICE_MONITORS###
10+
envFrom:
11+
- secretRef:
12+
name: uds-operator-config

‎src/pepr/zarf.yaml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
kind: ZarfPackageConfig
2+
metadata:
3+
name: pepr-uds-core
4+
description: 'Pepr Module: A collection of capabilities for UDS Core'
5+
url: https://github.com/defenseunicorns/pepr
6+
7+
variables:
8+
- name: DOMAIN
9+
description: "Cluster domain"
10+
default: "uds.dev"
11+
12+
- name: CA_CERT
13+
description: "Base64 encoded CA cert that signed the domain wildcard certs used for Istio ingress"
14+
default: ""
15+
16+
- name: UDS_LOG_LEVEL
17+
description: "UDS Operator log level"
18+
default: "debug"
19+
20+
- name: AUTHSERVICE_REDIS_URI
21+
description: "UDS Authservice Redis URI"
22+
default: ""
23+
24+
- name: UDS_SINGLE_TEST
25+
description: "UDS Single package test"
26+
default: ""
27+
28+
- name: PEPR_SERVICE_MONITORS
29+
description: "Enables Service Monitors for Pepr services (watcher, admission)"
30+
default: "true"
31+
32+
components:
33+
- name: uds-operator-config
34+
required: true
35+
charts:
36+
- name: uds-operator-config
37+
namespace: pepr-system
38+
version: 0.1.0
39+
localPath: uds-operator-config
40+
valuesFiles:
41+
- uds-operator-config/values.yaml
42+
43+
- name: pepr-uds-core
44+
required: true
45+
import:
46+
name: module
47+
path: ../../dist
48+
charts:
49+
- name: module
50+
valuesFiles:
51+
- values.yaml
52+
actions:
53+
onDeploy:
54+
before:
55+
- cmd: ./zarf tools kubectl annotate secret -n pepr-system pepr-uds-core-api-token meta.helm.sh/release-name=module --overwrite || true
56+
- cmd: ./zarf tools kubectl annotate secret -n pepr-system pepr-uds-core-module meta.helm.sh/release-name=module --overwrite || true
57+
- cmd: ./zarf tools kubectl annotate secret -n pepr-system pepr-uds-core-tls meta.helm.sh/release-name=module --overwrite || true
58+
- cmd: ./zarf tools kubectl annotate serviceaccount -n pepr-system pepr-uds-core meta.helm.sh/release-name=module --overwrite || true
59+
- cmd: ./zarf tools kubectl annotate clusterrolebinding pepr-uds-core meta.helm.sh/release-name=module --overwrite || true
60+
- cmd: ./zarf tools kubectl annotate clusterrole pepr-uds-core meta.helm.sh/release-name=module --overwrite || true
61+
- cmd: ./zarf tools kubectl annotate role -n pepr-system pepr-uds-core-store meta.helm.sh/release-name=module --overwrite || true
62+
- cmd: ./zarf tools kubectl annotate rolebinding -n pepr-system pepr-uds-core-store meta.helm.sh/release-name=module --overwrite || true
63+
- cmd: ./zarf tools kubectl annotate service -n pepr-system pepr-uds-core meta.helm.sh/release-name=module --overwrite || true
64+
- cmd: ./zarf tools kubectl annotate service -n pepr-system pepr-uds-core-watcher meta.helm.sh/release-name=module --overwrite || true
65+
- cmd: ./zarf tools kubectl annotate deployment -n pepr-system pepr-uds-core meta.helm.sh/release-name=module --overwrite || true
66+
- cmd: ./zarf tools kubectl annotate deployment -n pepr-system pepr-uds-core-watcher meta.helm.sh/release-name=module --overwrite || true
67+
- cmd: ./zarf tools kubectl annotate mutatingwebhookconfiguration -n pepr-system pepr-uds-core meta.helm.sh/release-name=module --overwrite || true
68+
- cmd: ./zarf tools kubectl annotate validatingwebhookconfiguration -n pepr-system pepr-uds-core meta.helm.sh/release-name=module --overwrite || true

‎tasks/create.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ tasks:
4444
- task: pepr-build
4545

4646
- description: "Create the Pepr Zarf Package, if it exists"
47-
cmd: "uds zarf package create dist --confirm --no-progress"
47+
cmd: "uds zarf package create src/pepr --confirm --no-progress"
4848

4949
- description: "Create the requested Zarf Package (must set UDS_PKG environment variable)"
5050
cmd: "uds zarf package create src/${UDS_PKG} --confirm --no-progress --flavor ${FLAVOR}"
@@ -63,4 +63,4 @@ tasks:
6363
CUSTOM_PEPR_IMAGE=$( [ "${FLAVOR}" = "registry1" ] && echo "--custom-image ${REGISTRY1_PEPR_IMAGE}" ) || CUSTOM_PEPR_IMAGE=""
6464
rm -fr dist
6565
npm ci
66-
npx pepr build $CUSTOM_PEPR_IMAGE
66+
npx pepr build -z chart $CUSTOM_PEPR_IMAGE

‎tasks/deploy.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,7 @@ tasks:
3030
fi
3131
- description: "Deploy the Pepr Module"
3232
cmd: |
33-
PEPR_VERSION=$(npm pkg get version | tr -d '"')
34-
uds zarf package deploy build/zarf-package-pepr-uds-core-${UDS_ARCH}-${PEPR_VERSION}.tar.zst --confirm --no-progress --set UDS_SINGLE_TEST=true
33+
uds zarf package deploy build/zarf-package-pepr-uds-core-${UDS_ARCH}.tar.zst --confirm --no-progress --set UDS_SINGLE_TEST=true --set PEPR_SERVICE_MONITORS=false
3534
- description: "Deploy the requested Zarf Package (must set UDS_PKG environment variable)"
3635
cmd: uds zarf package deploy build/zarf-package-uds-core-${UDS_PKG}-${UDS_ARCH}.tar.zst --confirm --no-progress --components '*'
3736

0 commit comments

Comments
 (0)
Please sign in to comment.