Skip to content

Commit e5070ec

Browse files
duanhongyiduanhongyi
committed
chore(passport): add initApplications to charts
1 parent b0314b0 commit e5070ec

6 files changed

Lines changed: 92 additions & 114 deletions

File tree

‎charts/passport/templates/_helpers.tpl‎

Lines changed: 10 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -16,75 +16,16 @@ rbac.authorization.k8s.io/v1
1616
env:
1717
- name: "TZ"
1818
value: {{ .Values.time_zone | default "UTC" | quote }}
19-
{{- if (.Values.initGrafanaKey) }}
20-
- name: "DRYCC_GRAFANA_DOMAIN"
21-
{{- if .Values.global.certManagerEnabled }}
22-
value: https://drycc-monitor-grafana.{{ .Values.global.platformDomain }}
23-
{{- else }}
24-
value: http://drycc-monitor-grafana.{{ .Values.global.platformDomain }}
25-
{{- end }}
26-
- name: DRYCC_PASSPORT_GRAFANA_KEY
27-
valueFrom:
28-
secretKeyRef:
29-
name: passport-creds
30-
key: drycc-passport-grafana-key
31-
- name: DRYCC_PASSPORT_GRAFANA_SECRET
32-
valueFrom:
33-
secretKeyRef:
34-
name: passport-creds
35-
key: drycc-passport-grafana-secret
36-
{{- end }}
37-
{{- if (.Values.initManagerKey) }}
38-
- name: "DRYCC_MANAGER_DOMAIN"
39-
{{- if .Values.global.certManagerEnabled }}
40-
value: https://drycc-manager.{{ .Values.global.platformDomain }}
41-
{{- else }}
42-
value: http://drycc-manager.{{ .Values.global.platformDomain }}
43-
{{- end }}
44-
- name: DRYCC_PASSPORT_MANAGER_KEY
45-
valueFrom:
46-
secretKeyRef:
47-
name: passport-creds
48-
key: drycc-passport-manager-key
49-
- name: DRYCC_PASSPORT_MANAGER_SECRET
50-
valueFrom:
51-
secretKeyRef:
52-
name: passport-creds
53-
key: drycc-passport-manager-secret
54-
{{- end }}
55-
{{- if (.Values.initControllerKey) }}
56-
- name: "DRYCC_CONTROLLER_DOMAIN"
57-
{{- if .Values.global.certManagerEnabled }}
58-
value: https://drycc.{{ .Values.global.platformDomain }}
59-
{{- else }}
60-
value: http://drycc.{{ .Values.global.platformDomain }}
61-
{{- end }}
62-
- name: DRYCC_SECRET_KEY
63-
valueFrom:
64-
secretKeyRef:
65-
name: passport-creds
66-
key: django-secret-key
67-
- name: DRYCC_PASSPORT_CONTROLLER_KEY
68-
valueFrom:
69-
secretKeyRef:
70-
name: passport-creds
71-
key: drycc-passport-controller-key
72-
- name: DRYCC_PASSPORT_CONTROLLER_SECRET
73-
valueFrom:
74-
secretKeyRef:
75-
name: passport-creds
76-
key: drycc-passport-controller-secret
77-
{{- end }}
78-
- name: WORKFLOW_NAMESPACE
79-
valueFrom:
80-
fieldRef:
81-
fieldPath: metadata.namespace
8219
- name: ADMIN_USERNAME
8320
value: {{ .Values.adminUsername | default "admin" | quote }}
8421
- name: ADMIN_PASSWORD
8522
value: {{ .Values.adminPassword | default "admin" | quote }}
8623
- name: ADMIN_EMAIL
8724
value: {{ .Values.adminEmail | default "admin@email.com" | quote }}
25+
- name: PLATFORM_DOMAIN
26+
value: {{ .Values.global.platformDomain }}
27+
- name: CERT_MANAGER_ENABLED
28+
value: "{{ .Values.global.certManagerEnabled }}"
8829
{{- if (.Values.databaseUrl) }}
8930
- name: DRYCC_DATABASE_URL
9031
valueFrom:
@@ -152,6 +93,9 @@ volumeMounts:
15293
- name: passport-creds
15394
mountPath: /var/run/secrets/drycc/passport
15495
readOnly: true
96+
- name: passport-config
97+
mountPath: /etc/drycc/passport
98+
readOnly: true
15599
{{- end }}
156100

157101

@@ -161,4 +105,7 @@ volumes:
161105
- name: passport-creds
162106
secret:
163107
secretName: passport-creds
108+
- name: passport-config
109+
configMap:
110+
name: passport-config
164111
{{- end }}

‎charts/passport/templates/passport-configmap.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if eq .Values.global.passportLocation "on-cluster" }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: passport-config
6+
labels:
7+
heritage: drycc
8+
data:
9+
data:
10+
init-applications.json: |-
11+
{{ toPrettyJson .Values.initApplications | indent 4 }}
12+
{{- end }}

‎charts/passport/templates/passport-secret-creds.yaml‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,10 @@ data:
1616
{{- end }}
1717
django-secret-key: {{ randAscii 64 | b64enc }}
1818
oidc-rsa-private-key: "{{genPrivateKey "rsa" | b64enc}}"
19-
{{- if (.Values.initGrafanaKey) }}
20-
drycc-passport-grafana-key: {{ randAlphaNum 40 | b64enc }}
21-
drycc-passport-grafana-secret: {{ randAlphaNum 64 | b64enc }}
19+
{{- range $item := .Values.initApplications }}
20+
{{- if ($item.prefix) }}
21+
drycc-passport-{{$item.name | replace " " "-" | lower}}-key: {{ if $item.key | default "" | ne "" }}{{ $item.key | b64enc }}{{ else }}{{ randAlphaNum 40 | b64enc }}{{ end }}
22+
drycc-passport-{{$item.name | replace " " "-" | lower}}-secret: {{ if $item.secret | default "" | ne "" }}{{ $item.secret | b64enc }}{{ else }}{{ randAlphaNum 64 | b64enc }}{{ end }}
2223
{{- end }}
23-
{{- if (.Values.initManagerKey) }}
24-
drycc-passport-manager-key: {{ randAlphaNum 40 | b64enc }}
25-
drycc-passport-manager-secret: {{ randAlphaNum 64 | b64enc }}
26-
{{- end }}
27-
{{- if (.Values.initControllerKey) }}
28-
drycc-passport-controller-key: {{ randAlphaNum 40 | b64enc }}
29-
drycc-passport-controller-secret: {{ randAlphaNum 64 | b64enc }}
3024
{{- end }}
3125
{{- end }}

‎charts/passport/values.yaml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,22 @@ adminUsername: "admin"
6666
adminPassword: "admin"
6767
adminEmail: "admin@email.com"
6868

69-
# The following configurations represent whether to initialize oauth2 application key
70-
initGrafanaKey: true
71-
initManagerKey: false
72-
initControllerKey: true
69+
# The following configurations to initialize oauth2 application
70+
# Names are all lowercase letters
71+
# The key and secret are generated automatically if they are empty
72+
# If prefix is not empty, it represents internal application.
73+
#
74+
initApplications:
75+
- name: "controller"
76+
key: ""
77+
secret: ""
78+
prefix: "drycc"
79+
redirect_uri: "/v2/complete/drycc/"
80+
- name: "grafana"
81+
key: ""
82+
secret: ""
83+
prefix: "drycc-monitor-grafana"
84+
redirect_uri: "/login/generic_oauth"
7385

7486
# Service
7587
service:

‎rootfs/api/management/commands/create_oauth2_application.py‎

Lines changed: 49 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,70 @@
11
import os
2+
import json
3+
import random
4+
import string
5+
import pathlib
26
from django.contrib.auth import get_user_model
37
from django.core.management.base import BaseCommand
48
from oauth2_provider.models import Application
59

10+
611
User = get_user_model()
12+
secrets_path = "/var/run/secrets/drycc/passport"
713

814

915
class Command(BaseCommand):
1016
"""Management command for create Oauth2 application"""
1117

18+
def add_arguments(self, parser):
19+
super(Command, self).add_arguments(parser)
20+
parser.add_argument(
21+
'--path', dest='path', default=None,
22+
help='Specifies the path for the secret.',
23+
)
24+
1225
def handle(self, *args, **options):
13-
app_list = []
14-
if os.environ.get('DRYCC_GRAFANA_DOMAIN'):
15-
app_list.append({
16-
"name": "GRAFANA",
17-
"redirect_uri": f"{os.environ.get('DRYCC_GRAFANA_DOMAIN')}/login/generic_oauth" # noqa
18-
})
19-
if os.environ.get('DRYCC_MANAGER_DOMAIN'):
20-
app_list.append({
21-
"name": "MANAGER",
22-
"redirect_uri": f"{os.environ.get('DRYCC_MANAGER_DOMAIN')}/v1/complete/drycc/" # noqa
23-
})
24-
if os.environ.get('DRYCC_CONTROLLER_DOMAIN'):
25-
app_list.append({
26-
"name": "CONTROLLER",
27-
"redirect_uri": f"{os.environ.get('DRYCC_CONTROLLER_DOMAIN')}/v2/complete/drycc/" # noqa
28-
})
29-
for app in app_list:
30-
client_id = os.environ.get(
31-
f'DRYCC_PASSPORT_{app["name"]}_KEY') if os.environ.get(
32-
f'DRYCC_PASSPORT_{app["name"]}_KEY') else None
33-
client_secret = os.environ.get(
34-
f'DRYCC_PASSPORT_{app["name"]}_SECRET') if os.environ.get(
35-
f'DRYCC_PASSPORT_{app["name"]}_SECRET') else None
36-
if not all([client_id, client_secret]):
37-
self.stdout.write('client_id or client_secret non-existent')
38-
return
39-
user = User.objects.filter(is_superuser=True).first()
40-
if not user:
41-
self.stdout.write("Cannot create because there is no superuser")
26+
base_path = options.get('path', '')
27+
user = User.objects.filter(is_superuser=True).first()
28+
for item in json.loads(pathlib.Path(base_path).read_text()):
29+
name = item["name"]
30+
key = self._get_creds(item, "key", 40)
31+
secret = self._get_creds(item, "secret", 60)
32+
redirect_uri = self._get_redirect_uri(item)
4233
_, updated = Application.objects.update_or_create(
43-
name='Drycc ' + app["name"].title(),
34+
name=name.lower(),
4435
defaults={
45-
'client_id': client_id,
46-
'client_secret': client_secret,
36+
'client_id': key,
37+
'client_secret': secret,
4738
'user': user,
48-
'redirect_uris': app["redirect_uri"],
39+
'redirect_uris': redirect_uri,
4940
'authorization_grant_type': 'authorization-code',
50-
'client_type': 'Public',
41+
'client_type': 'public',
5142
'algorithm': 'RS256'
5243
}
5344
)
5445
if updated:
55-
self.stdout.write(f'Drycc {app["name"]} app created')
46+
self.stdout.write('Drycc % app created' % name)
47+
else:
48+
self.stdout.write('Drycc % app updated' % name)
49+
50+
def _get_creds(self, item, suffix, size):
51+
name, secret, prefix = item["name"], item[suffix], item["prefix"]
52+
if not secret:
53+
default_secret_path = os.path.join(
54+
secrets_path, "drycc-passport-%s-%s" % (name, suffix))
55+
if prefix and os.path.exists(default_secret_path):
56+
secret = pathlib.Path(default_secret_path).read_text()
57+
else:
58+
secret = ''.join([random.choice(string.ascii_letters) for _ in range(size)])
59+
return secret
60+
61+
def _get_redirect_uri(self, item):
62+
prefix = item["prefix"]
63+
domain = os.environ.get("PLATFORM_DOMAIN")
64+
redirect_uri = item["redirect_uri"]
65+
if prefix:
66+
if os.environ.get("CERT_MANAGER_ENABLED") == "true":
67+
redirect_uri = f"https://{prefix}.{domain}{redirect_uri}"
5668
else:
57-
self.stdout.write(f'Drycc {app["name"]} app updated')
69+
redirect_uri = f"http://{prefix}.{domain}{redirect_uri}"
70+
return redirect_uri

‎rootfs/bin/boot‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ fi
3838

3939
echo ""
4040
echo "Create application for drycc controller "
41-
python /workspace/manage.py create_oauth2_application
41+
python /workspace/manage.py create_oauth2_application --path /etc/drycc/passport/init-applications.json
4242

4343
# spawn a gunicorn server in the background
4444
echo ""

0 commit comments

Comments
 (0)