Support groups claims in dex static connector

[piotrmsc]

Description
Currently, our RBAC roles are bound to static users via email, which is fine but tedious. In order to simulate production use case and enable proper e2e tests we need gorup claim in JWT.

• We have to check if the latest version of dex support it, if so, then upgrade dex in kyma.
• If it still does not support it (previously They did not want that in the static connector) then we need to fork it and add our implementation. Fork should be placed in kyma-incubator (if not already done in Browser cache needs to be cleared before opening console after kyma restart #2203).
• Add "kyma-admins" group to admin user in dex-users-secrets.yaml and "kyma-developers" group to developer static user.
• Remove the clusterrolebinding to "admin@kyma.cx" user and replace it with binding to group "kyma-admins". Note we do not create a binding for cluster role "kyma-developer" here. This is done by the admin to a specific namespace by role binding in the console.

You can use our old implementation as a reference from here dexidp/dex#1080

Reasons

Currently, Dex version used in Kyma does not support groups in JWT claims in static connector. With groups claim in JWT we can easily test integration scenarios for example in apiserver-proxy simulating production use of roles assigned to groups instead of user emails.

Attachments

[stale]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.

[piotrmsc]

We will not implement this, currently we are aiming to get rid of our fork of dex. Ticket should be reopened if we decide that we a) still need that b) we will maintain the fork