Skip to content

Commit

Permalink
Oauth server: Route external traffic through guest cluster
Browse files Browse the repository at this point in the history 
This change makes the oauth server route external traffic through the
guest cluster, in order to enable communication with IDPs that are only
accessible from the guest cluster network.

https://issues.redhat.com/browse/HOSTEDCP-421
  • Loading branch information
@alvaroaleman
alvaroaleman committed Jul 6, 2022
1 parent eba1271 commit 8372ffd
Show file tree
Hide file tree
Showing 3 changed files with 50 additions and 4 deletions.
2 changes: 1 addition & 1 deletion control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
View file
Expand Up @@ -1814,7 +1814,7 @@ func (r *HostedControlPlaneReconciler) reconcileOAuthServer(ctx context.Context,

deployment := manifests.OAuthServerDeployment(hcp.Namespace)
if _, err := r.CreateOrUpdate(ctx, r, deployment, func() error {
return oauth.ReconcileDeployment(ctx, r, deployment, p.OwnerRef, oauthConfig, p.OAuthServerImage, p.DeploymentConfig, p.IdentityProviders(), p.OauthConfigOverrides, p.AvailabilityProberImage, hcp.Spec.APIPort, p.NamedCertificates())
return oauth.ReconcileDeployment(ctx, r, deployment, p.OwnerRef, oauthConfig, p.OAuthServerImage, p.DeploymentConfig, p.IdentityProviders(), p.OauthConfigOverrides, p.AvailabilityProberImage, hcp.Spec.APIPort, p.NamedCertificates(), p.Socks5ProxyImage)
}); err != nil {
return fmt.Errorf("failed to reconcile oauth deployment: %w", err)
}
Expand Down
50 changes: 47 additions & 3 deletions control-plane-operator/controllers/hostedcontrolplane/oauth/deployment.go
View file
Expand Up @@ -9,21 +9,24 @@ import (
"github.com/openshift/hypershift/support/globalconfig"
appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/resource"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/utils/pointer"
"sigs.k8s.io/controller-runtime/pkg/client"

configv1 "github.com/openshift/api/config/v1"
"github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/kas"
"github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/konnectivity"
"github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/manifests"
"github.com/openshift/hypershift/support/config"
"github.com/openshift/hypershift/support/util"
utilpointer "k8s.io/utils/pointer"
)

const (
configHashAnnotation = "oauth.hypershift.openshift.io/config-hash"
oauthNamedCertificateMountPathPrefix = "/etc/kubernetes/certs/named"
socks5ProxyContainerName = "socks-proxy"
)

var (
Expand All @@ -48,7 +51,7 @@ func oauthLabels() map[string]string {
}
}

func ReconcileDeployment(ctx context.Context, client client.Client, deployment *appsv1.Deployment, ownerRef config.OwnerRef, config *corev1.ConfigMap, image string, deploymentConfig config.DeploymentConfig, identityProviders []configv1.IdentityProvider, providerOverrides map[string]*ConfigOverride, availabilityProberImage string, apiPort *int32, namedCertificates []configv1.APIServerNamedServingCert) error {
func ReconcileDeployment(ctx context.Context, client client.Client, deployment *appsv1.Deployment, ownerRef config.OwnerRef, config *corev1.ConfigMap, image string, deploymentConfig config.DeploymentConfig, identityProviders []configv1.IdentityProvider, providerOverrides map[string]*ConfigOverride, availabilityProberImage string, apiPort *int32, namedCertificates []configv1.APIServerNamedServingCert, socks5ProxyImage string) error {
ownerRef.ApplyTo(deployment)

// preserve existing resource requirements for main oauth container
Expand Down Expand Up @@ -83,9 +86,10 @@ func ReconcileDeployment(ctx context.Context, client client.Client, deployment *
}
deployment.Spec.Template.ObjectMeta.Annotations[configHashAnnotation] = util.ComputeHash(configBytes)
deployment.Spec.Template.Spec = corev1.PodSpec{
AutomountServiceAccountToken: pointer.BoolPtr(false),
AutomountServiceAccountToken: utilpointer.BoolPtr(false),
Containers: []corev1.Container{
util.BuildContainer(oauthContainerMain(), buildOAuthContainerMain(image)),
socks5ProxyContainer(socks5ProxyImage),
},
Volumes: []corev1.Volume{
util.BuildVolume(oauthVolumeConfig(), buildOAuthVolumeConfig),
Expand All @@ -96,6 +100,8 @@ func ReconcileDeployment(ctx context.Context, client client.Client, deployment *
util.BuildVolume(oauthVolumeLoginTemplate(), buildOAuthVolumeLoginTemplate),
util.BuildVolume(oauthVolumeProvidersTemplate(), buildOAuthVolumeProvidersTemplate),
util.BuildVolume(oauthVolumeWorkLogs(), buildOAuthVolumeWorkLogs),
{Name: "admin-kubeconfig", VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: "service-network-admin-kubeconfig", DefaultMode: utilpointer.Int32Ptr(416)}}},
{Name: "konnectivity-proxy-cert", VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: manifests.KonnectivityClientSecret("").Name, DefaultMode: utilpointer.Int32Ptr(416)}}},
},
}
deploymentConfig.ApplyTo(deployment)
Expand Down Expand Up @@ -127,6 +133,20 @@ func buildOAuthContainerMain(image string) func(c *corev1.Container) {
}
c.VolumeMounts = volumeMounts.ContainerMounts(c.Name)
c.WorkingDir = volumeMounts.Path(c.Name, oauthVolumeWorkLogs().Name)
c.Env = []corev1.EnvVar{
{
Name: "HTTP_PROXY",
Value: fmt.Sprintf("socks5://127.0.0.1:%d", konnectivity.KonnectivityServerLocalPort),
},
{
Name: "HTTPS_PROXY",
Value: fmt.Sprintf("socks5://127.0.0.1:%d", konnectivity.KonnectivityServerLocalPort),
},
{
Name: "NO_PROXY",
Value: manifests.KubeAPIServerService("").Name,
},
}
}
}

Expand Down Expand Up @@ -221,3 +241,27 @@ func buildOAuthVolumeProvidersTemplate(v *corev1.Volume) {
SecretName: manifests.OAuthServerDefaultProviderSelectionTemplateSecret("").Name,
}
}

func socks5ProxyContainer(socks5ProxyImage string) corev1.Container {
c := corev1.Container{
Name: socks5ProxyContainerName,
Image: socks5ProxyImage,
Command: []string{"/usr/bin/control-plane-operator", "konnectivity-socks5-proxy"},
Args: []string{"run"},
Env: []corev1.EnvVar{{
Name: "KUBECONFIG",
Value: "/etc/kubernetes/kubeconfig",
}},
Resources: corev1.ResourceRequirements{
Requests: corev1.ResourceList{
corev1.ResourceCPU: resource.MustParse("10m"),
corev1.ResourceMemory: resource.MustParse("10Mi"),
},
},
VolumeMounts: []corev1.VolumeMount{
{Name: "admin-kubeconfig", MountPath: "/etc/kubernetes"},
{Name: "konnectivity-proxy-cert", MountPath: "/etc/konnectivity-proxy-tls"},
},
}
return c
}
2 changes: 2 additions & 0 deletions control-plane-operator/controllers/hostedcontrolplane/oauth/params.go
View file
Expand Up @@ -39,6 +39,7 @@ type OAuthServerParams struct {
LoginURLOverride string
AvailabilityProberImage string `json:"availabilityProberImage"`
Availability hyperv1.AvailabilityPolicy
Socks5ProxyImage string
}

type OAuthConfigParams struct {
Expand Down Expand Up @@ -80,6 +81,7 @@ func NewOAuthServerParams(hcp *hyperv1.HostedControlPlane, images map[string]str
OAuthServerImage: images["oauth-server"],
AvailabilityProberImage: images[util.AvailabilityProberImageName],
Availability: hcp.Spec.ControllerAvailabilityPolicy,
Socks5ProxyImage: images["socks5-proxy"],
}
if hcp.Spec.Configuration != nil {
p.APIServer = hcp.Spec.Configuration.APIServer
Expand Down

0 comments on commit 8372ffd

Please sign in to comment.