From cc7121e021cf8f569ced4a6dd767f9fdf5c32da9 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Mon, 27 Feb 2023 19:01:04 -0800 Subject: [PATCH 1/4] Add ingress support for OIDC discovery provider This patch enables exposing the oidc server out with an ingress along with tests to ensure it works. Signed-off-by: Kevin Fox Co-authored-by: Marco Franssen --- .../tests/spire-oidc-insecure/pre-install.sh | 3 ++ .github/tests/spire-oidc-insecure/values.yaml | 11 ++++- .../spiffe-oidc-discovery-provider/README.md | 7 ++++ .../templates/ingress.yaml | 41 +++++++++++++++++++ .../templates/tests/test-connection.yaml | 8 ++++ .../values.yaml | 16 ++++++++ 6 files changed, 85 insertions(+), 1 deletion(-) create mode 100755 .github/tests/spire-oidc-insecure/pre-install.sh create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml diff --git a/.github/tests/spire-oidc-insecure/pre-install.sh b/.github/tests/spire-oidc-insecure/pre-install.sh new file mode 100755 index 0000000..e2541a9 --- /dev/null +++ b/.github/tests/spire-oidc-insecure/pre-install.sh @@ -0,0 +1,3 @@ +#!/bin/bash +helm install ingress-nginx ingress-nginx --version 4.5.2 --repo https://kubernetes.github.io/ingress-nginx -n "$VALUES" --set controller.extraArgs.enable-ssl-passthrough= +kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$VALUES" diff --git a/.github/tests/spire-oidc-insecure/values.yaml b/.github/tests/spire-oidc-insecure/values.yaml index 7b1a720..76693c8 100644 --- a/.github/tests/spire-oidc-insecure/values.yaml +++ b/.github/tests/spire-oidc-insecure/values.yaml @@ -6,7 +6,16 @@ spiffe-oidc-discovery-provider: config: domains: - - oidc-discovery.example.org + - ingress-nginx-controller acme: tosAccepted: false + + ingress: + enabled: true + className: "nginx" + hosts: + - host: ingress-nginx-controller + paths: + - path: / + pathType: Prefix diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index f350d02..5beb0b7 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -34,6 +34,13 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | image.repository | string | `"spiffe/oidc-discovery-provider"` | | | image.version | string | `""` | | | imagePullSecrets | list | `[]` | | +| ingress.annotations | object | `{}` | | +| ingress.className | string | `""` | | +| ingress.enabled | bool | `false` | | +| ingress.hosts[0].host | string | `"chart-example.local"` | | +| ingress.hosts[0].paths[0].path | string | `"/"` | | +| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | +| ingress.tls | list | `[]` | | | insecureScheme.enabled | bool | `false` | | | insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | | insecureScheme.nginx.image.registry | string | `"docker.io"` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml new file mode 100644 index 0000000..e8f2e87 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml @@ -0,0 +1,41 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }} +{{- $port := .Values.service.port }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + ingressClassName: {{ .Values.ingress.className }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ $fullName }} + port: + number: {{ $port }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index 7c222c5..4734612 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -29,4 +29,12 @@ spec: args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} + {{- if and .Values.ingress.enabled .Values.ingress.test.enabled }} + - name: wget-ingress + image: busybox + command: ['wget'] + args: ['{{ index .Values.config.domains 0 }}/.well-known/openid-configuration'] + securityContext: + {{- toYaml .Values.securityContext | nindent 8 }} + {{- end }} restartPolicy: Never diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 7b33987..c1ecf89 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -137,3 +137,19 @@ telemetry: # limits: # cpu: 100m # memory: 64Mi + +ingress: + enabled: false + className: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: Prefix + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local From e970d52ea470374a80fff64272c4e6cd681b742b Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 16 Mar 2023 10:05:33 +0100 Subject: [PATCH 2/4] Align ingress hostname with jwtIssues in spire-server chart Signed-off-by: Marco Franssen --- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index c1ecf89..3ba782b 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -112,7 +112,7 @@ tolerations: [] affinity: {} -trustDomain: "example.org" +trustDomain: example.org telemetry: prometheus: @@ -145,11 +145,11 @@ ingress: # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" hosts: - - host: chart-example.local + - host: oidc-discovery.example.org paths: - path: / pathType: Prefix tls: [] # - secretName: chart-example-tls # hosts: - # - chart-example.local + # - oidc-discovery.example.org From a9b99febb335f6ffa57291d66ac571552e6609d8 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 16 Mar 2023 10:08:00 +0100 Subject: [PATCH 3/4] Add some commented lines for best practice annotations on ingress Signed-off-by: Marco Franssen --- charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 3ba782b..88f53b0 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -144,6 +144,8 @@ ingress: annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" + # nginx.ingress.kubernetes.io/ssl-redirect: "true" + # nginx.ingress.kubernetes.io/force-ssl-redirect: "true" hosts: - host: oidc-discovery.example.org paths: From 6322a9a1382cd85fb7584dbcbe9085d94bf2b637 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Thu, 16 Mar 2023 08:59:14 -0700 Subject: [PATCH 4/4] Fix tests Signed-off-by: Kevin Fox Co-authored-by: Marco Franssen --- .github/tests/spire-oidc-insecure/pre-install.sh | 7 ++++--- .github/tests/spire-oidc-insecure/values.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 2 +- .../spiffe-oidc-discovery-provider/templates/ingress.yaml | 1 + .../templates/tests/test-connection.yaml | 4 ++-- 5 files changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/tests/spire-oidc-insecure/pre-install.sh b/.github/tests/spire-oidc-insecure/pre-install.sh index e2541a9..939b1d8 100755 --- a/.github/tests/spire-oidc-insecure/pre-install.sh +++ b/.github/tests/spire-oidc-insecure/pre-install.sh @@ -1,3 +1,4 @@ -#!/bin/bash -helm install ingress-nginx ingress-nginx --version 4.5.2 --repo https://kubernetes.github.io/ingress-nginx -n "$VALUES" --set controller.extraArgs.enable-ssl-passthrough= -kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$VALUES" +#!/usr/bin/env bash + +helm install ingress-nginx ingress-nginx --version 4.5.2 --repo https://kubernetes.github.io/ingress-nginx -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough= +kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario" diff --git a/.github/tests/spire-oidc-insecure/values.yaml b/.github/tests/spire-oidc-insecure/values.yaml index 76693c8..4c1124e 100644 --- a/.github/tests/spire-oidc-insecure/values.yaml +++ b/.github/tests/spire-oidc-insecure/values.yaml @@ -13,7 +13,7 @@ spiffe-oidc-discovery-provider: ingress: enabled: true - className: "nginx" + className: nginx hosts: - host: ingress-nginx-controller paths: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 5beb0b7..5d5cc3b 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -37,7 +37,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | ingress.annotations | object | `{}` | | | ingress.className | string | `""` | | | ingress.enabled | bool | `false` | | -| ingress.hosts[0].host | string | `"chart-example.local"` | | +| ingress.hosts[0].host | string | `"oidc-discovery.example.org"` | | | ingress.hosts[0].paths[0].path | string | `"/"` | | | ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | | | ingress.tls | list | `[]` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml index e8f2e87..ba3cf8c 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml @@ -5,6 +5,7 @@ apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: {{ $fullName }} + namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} {{- with .Values.ingress.annotations }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index 4734612..70ab843 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -29,11 +29,11 @@ spec: args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} - {{- if and .Values.ingress.enabled .Values.ingress.test.enabled }} + {{- if .Values.ingress.enabled }} - name: wget-ingress image: busybox command: ['wget'] - args: ['{{ index .Values.config.domains 0 }}/.well-known/openid-configuration'] + args: ['-O', '/dev/null', '{{ index .Values.config.domains 0 }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- end }}