Skip to content

[installer] Remove OIDC secret from public-api WEB-206 #17331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Apr 24, 2023
Merged

[installer] Remove OIDC secret from public-api WEB-206 #17331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
23e42bd
Fix
easyCZ Apr 22, 2023
3fe86d0
retest
easyCZ Apr 22, 2023
fcfc235
[installer] Remove OIDC secret from public-api
easyCZ Apr 23, 2023
eaf109e
fix
easyCZ Apr 23, 2023
4b5a658
remove ci secret
easyCZ Apr 23, 2023
0028773
fix
easyCZ Apr 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions components/public-api/go/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,6 @@ type Configuration struct {
// StripeWebhookSigningSecretPath is a filepath to a secret used to validate incoming webhooks from Stripe
StripeWebhookSigningSecretPath string `json:"stripeWebhookSigningSecretPath"`

// OIDCClientJWTSigningSecretPath is a filepath to a secret used to sign and validate JWTs used for OIDC flows
OIDCClientJWTSigningSecretPath string `json:"oidcClientJWTSigningSecretPath"`

// Path to file which contains personal access token singing key
PersonalAccessTokenSigningKeyPath string `json:"personalAccessTokenSigningKeyPath"`

Expand Down
5 changes: 0 additions & 5 deletions dev/preview/workflow/preview/deploy-gitpod.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -426,11 +426,6 @@ yq w -i "${INSTALLER_CONFIG_PATH}" experimental.webapp.configcatKey "WBLaCPtkjkq
yq w -i "${INSTALLER_CONFIG_PATH}" experimental.webapp.proxy.configcat.baseUrl "https://cdn-global.configcat.com"
yq w -i "${INSTALLER_CONFIG_PATH}" experimental.webapp.proxy.configcat.pollInterval "1m"

#
# configure JWT signign key
#
yq w -i "${INSTALLER_CONFIG_PATH}" experimental.webapp.publicApi.oidcClientJWTSigningKeySecretName "oidc-client-jwt-signing-key"

#
# configure Personal Access Token signign key
#
Expand Down
39 changes: 0 additions & 39 deletions install/installer/pkg/components/public-api-server/configmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,15 +28,9 @@ const (
)

func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
var oidcClientJWTSigningSecretPath string
var stripeSecretPath string
var personalAccessTokenSigningKeyPath string

_ = ctx.WithExperimental(func(cfg *experimental.Config) error {
_, _, oidcClientJWTSigningSecretPath, _ = getOIDCClientJWTSecretConfig(cfg)
return nil
})

_ = ctx.WithExperimental(func(cfg *experimental.Config) error {
_, _, stripeSecretPath, _ = getStripeConfig(cfg)
return nil
Expand All @@ -54,7 +48,6 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
cfg := config.Configuration{
PublicURL: fmt.Sprintf("https://api.%s", ctx.Config.Domain),
GitpodServiceURL: common.ClusterURL("ws", server.Component, ctx.Namespace, server.ContainerPort),
OIDCClientJWTSigningSecretPath: oidcClientJWTSigningSecretPath,
StripeWebhookSigningSecretPath: stripeSecretPath,
PersonalAccessTokenSigningKeyPath: personalAccessTokenSigningKeyPath,
BillingServiceAddress: common.ClusterAddress(usage.Component, ctx.Namespace, usage.GRPCServicePort),
Expand Down Expand Up @@ -141,38 +134,6 @@ func getStripeConfig(cfg *experimental.Config) (corev1.Volume, corev1.VolumeMoun
return volume, mount, path, true
}

func getOIDCClientJWTSecretConfig(cfg *experimental.Config) (corev1.Volume, corev1.VolumeMount, string, bool) {
var volume corev1.Volume
var mount corev1.VolumeMount
var path string

if cfg == nil || cfg.WebApp == nil || cfg.WebApp.PublicAPI == nil || cfg.WebApp.PublicAPI.OIDCClientJWTSigningKeySecretName == "" {
return volume, mount, path, false
}

oidcClientJWTSigningKeySecretName := cfg.WebApp.PublicAPI.OIDCClientJWTSigningKeySecretName
path = oidcClientJWTSigningKeyMountPath

volume = corev1.Volume{
Name: "oidc-client-jwt-signing-key",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: oidcClientJWTSigningKeySecretName,
Optional: pointer.Bool(true),
},
},
}

mount = corev1.VolumeMount{
Name: "oidc-client-jwt-signing-key",
MountPath: oidcClientJWTSigningKeyMountPath,
SubPath: "oidc-client-jwt-signing-key",
ReadOnly: true,
}

return volume, mount, path, true
}

func getPersonalAccessTokenSigningKey(cfg *experimental.Config) (corev1.Volume, corev1.VolumeMount, string, bool) {
var volume corev1.Volume
var mount corev1.VolumeMount
Expand Down
7 changes: 0 additions & 7 deletions install/installer/pkg/components/public-api-server/configmap_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,6 @@ func TestConfigMap(t *testing.T) {
return nil
})

var oidcClientJWTSigningSecretPath string
_ = ctx.WithExperimental(func(ucfg *experimental.Config) error {
_, _, oidcClientJWTSigningSecretPath, _ = getOIDCClientJWTSecretConfig(ucfg)
return nil
})

var personalAccessTokenSigningKeyPath string
_ = ctx.WithExperimental(func(ucfg *experimental.Config) error {
_, _, personalAccessTokenSigningKeyPath, _ = getPersonalAccessTokenSigningKey(ucfg)
Expand All @@ -51,7 +45,6 @@ func TestConfigMap(t *testing.T) {
GitpodServiceURL: fmt.Sprintf("ws://server.%s.svc.cluster.local:3000", ctx.Namespace),
BillingServiceAddress: fmt.Sprintf("usage.%s.svc.cluster.local:9001", ctx.Namespace),
SessionServiceAddress: fmt.Sprintf("server.%s.svc.cluster.local:9876", ctx.Namespace),
OIDCClientJWTSigningSecretPath: oidcClientJWTSigningSecretPath,
StripeWebhookSigningSecretPath: stripeSecretPath,
PersonalAccessTokenSigningKeyPath: personalAccessTokenSigningKeyPath,
DatabaseConfigPath: "/secrets/database-config",
Expand Down
11 changes: 0 additions & 11 deletions install/installer/pkg/components/public-api-server/deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,17 +59,6 @@ func deployment(ctx *common.RenderContext) ([]runtime.Object, error) {
databaseSecretMount,
}

_ = ctx.WithExperimental(func(cfg *experimental.Config) error {
volume, mount, _, ok := getOIDCClientJWTSecretConfig(cfg)
if !ok {
return nil
}

volumes = append(volumes, volume)
volumeMounts = append(volumeMounts, mount)
return nil
})

_ = ctx.WithExperimental(func(cfg *experimental.Config) error {
volume, mount, _, ok := getStripeConfig(cfg)
if !ok {
Expand Down
9 changes: 0 additions & 9 deletions install/installer/pkg/components/public-api-server/deployment_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,15 +64,6 @@ func TestDeployment_ServerArguments(t *testing.T) {
},
},
},
{
Name: "oidc-client-jwt-signing-key",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: "oidc-client-jwt-signing-key",
Optional: pointer.Bool(true),
},
},
},
{
Name: "stripe-secret",
VolumeSource: corev1.VolumeSource{
Expand Down
1 change: 0 additions & 1 deletion install/installer/pkg/components/public-api-server/objects_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ func renderContextWithPublicAPI(t *testing.T) *common.RenderContext {
WebApp: &experimental.WebAppConfig{
PublicAPI: &experimental.PublicAPIConfig{
StripeSecretName: "stripe-webhook-secret",
OIDCClientJWTSigningKeySecretName: "oidc-client-jwt-signing-key",
PersonalAccessTokenSigningKeySecretName: "personal-access-token-signing-key",
},
},
Expand Down
3 changes: 0 additions & 3 deletions install/installer/pkg/config/v1/experimental/experimental.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -301,9 +301,6 @@ type PublicAPIConfig struct {
// Name of the kubernetes secret to use for Stripe secrets
StripeSecretName string `json:"stripeSecretName"`

// Name of the kubernetes secret to use for signing JWTs
OIDCClientJWTSigningKeySecretName string `json:"oidcClientJWTSigningKeySecretName"`

// Name of the kubernetes secret to use for signature of Personal Access Tokens
PersonalAccessTokenSigningKeySecretName string `json:"personalAccessTokenSigningKeySecretName"`
}
Expand Down