Skip to content

Commit e10e35d

Browse files
philipgoughphilipgough
authored
Use pre-shared key in rhelemeter component (#611)
* jb update telemeter * Generate template for rhelemeter that uses client info file * Update test for rhelemeter
1 parent 7d88c2b commit e10e35d

File tree

10 files changed

+50
-46
lines changed

10 files changed

+50
-46
lines changed

‎jsonnetfile.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@
8282
"subdir": "jsonnet/lib"
8383
}
8484
},
85-
"version": "master",
85+
"version": "main",
8686
"name": "thanos-receive-controller"
8787
},
8888
{
@@ -92,7 +92,7 @@
9292
"subdir": "jsonnet/thanos-receive-controller-mixin"
9393
}
9494
},
95-
"version": "master"
95+
"version": "main"
9696
},
9797
{
9898
"source": {

‎jsonnetfile.lock.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -303,8 +303,8 @@
303303
"subdir": "jsonnet/telemeter"
304304
}
305305
},
306-
"version": "36999a33bdeb42c6f25d099985c98f346f83c1f3",
307-
"sum": "uXGo7tcHOkLNS53J0o64vhrNl+dc1SYY4hkrBoxitz8="
306+
"version": "5923762c315758d64e0a3ebebb15943ebf0c2a80",
307+
"sum": "C8wxoobehWU7ykPDhCMiCmSWTe/8jGjOJvcS+rxzp2U="
308308
},
309309
{
310310
"source": {

‎resources/services/rhelemeter-template.yaml

Lines changed: 27 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,23 @@ kind: Template
33
metadata:
44
name: rhelemeter
55
objects:
6+
- apiVersion: v1
7+
kind: Secret
8+
metadata:
9+
labels:
10+
k8s-app: rhelemeter-server
11+
name: rhelemeter-server-client-info
12+
stringData:
13+
client-info.json: |-
14+
{
15+
"config": {
16+
"common_name_header": "x-rh-certauth-cn",
17+
"issuer_header": "x-rh-certauth-issuer",
18+
"secret_header": "x-rh-rhelemeter-gateway-secret"
19+
},
20+
"secret": "${RHELEMETER_CLIENT_INFO_PSK}"
21+
}
22+
type: Opaque
623
- apiVersion: apps/v1
724
kind: Deployment
825
metadata:
@@ -22,11 +39,11 @@ objects:
2239
- /usr/bin/rhelemeter-server
2340
- --listen=0.0.0.0:8443
2441
- --listen-internal=0.0.0.0:8081
25-
- --tls-key=/etc/pki/external/tls.key
26-
- --tls-crt=/etc/pki/external/tls.crt
27-
- --tls-ca-crt=/etc/pki/external/ca.crt
42+
- --tls-key=/etc/pki/service/tls.key
43+
- --tls-crt=/etc/pki/service/tls.crt
2844
- --internal-tls-key=/etc/pki/service/tls.key
2945
- --internal-tls-crt=/etc/pki/service/tls.crt
46+
- --client-info-data-file=/etc/external/client-info.json
3047
- --oidc-issuer=$(OIDC_ISSUER)
3148
- --client-id=$(CLIENT_ID)
3249
- --client-secret=$(CLIENT_SECRET)
@@ -78,8 +95,8 @@ objects:
7895
- mountPath: /etc/pki/service
7996
name: rhelemeter-server-tls
8097
readOnly: false
81-
- mountPath: /etc/pki/external
82-
name: rhelemeter-server-external-mtls
98+
- mountPath: /etc/external
99+
name: rhelemeter-server-client-info
83100
readOnly: false
84101
serviceAccountName: rhelemeter-server
85102
volumes:
@@ -89,20 +106,9 @@ objects:
89106
- name: rhelemeter-server-tls
90107
secret:
91108
secretName: rhelemeter-server-shared
92-
- name: rhelemeter-server-external-mtls
109+
- name: rhelemeter-server-client-info
93110
secret:
94-
secretName: rhelemeter-server-external-mtls
95-
- apiVersion: v1
96-
kind: Secret
97-
metadata:
98-
labels:
99-
k8s-app: rhelemeter-server
100-
name: rhelemeter-server-external-mtls
101-
stringData:
102-
ca.crt: ${RHELEMETER_EXTERNAL_MTLS_CA}
103-
tls.crt: ${RHELEMETER_EXTERNAL_MTLS_CRT}
104-
tls.key: ${RHELEMETER_EXTERNAL_MTLS_KEY}
105-
type: Opaque
111+
secretName: rhelemeter-server-client-info
106112
- apiVersion: v1
107113
kind: Secret
108114
metadata:
@@ -163,7 +169,7 @@ parameters:
163169
- name: NAMESPACE
164170
value: rhelemeter
165171
- name: IMAGE_TAG
166-
value: 82f71d3
172+
value: "5923762"
167173
- name: IMAGE
168174
value: quay.io/app-sre/telemeter
169175
- name: REPLICAS
@@ -173,16 +179,12 @@ parameters:
173179
- name: RHELEMETER_FORWARD_URL
174180
value: ""
175181
- name: RHELEMETER_OIDC_ISSUER
176-
value: ""
182+
value: https://sso.redhat.com/auth/realms/redhat-external
177183
- name: RHELEMETER_CLIENT_ID
178184
value: ""
179185
- name: RHELEMETER_CLIENT_SECRET
180186
value: ""
181-
- name: RHELEMETER_EXTERNAL_MTLS_CA
182-
value: ""
183-
- name: RHELEMETER_EXTERNAL_MTLS_CRT
184-
value: ""
185-
- name: RHELEMETER_EXTERNAL_MTLS_KEY
187+
- name: RHELEMETER_CLIENT_INFO_PSK
186188
value: ""
187189
- name: RHELEMETER_LOG_LEVEL
188190
value: warn

‎services/rhelemeter-template.jsonnet

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,7 @@ local rhelemeter = (import 'rhelemeter.libsonnet') {
1111
oidcIssuer: '${RHELEMETER_OIDC_ISSUER}',
1212
clientID: '${RHELEMETER_CLIENT_ID}',
1313
clientSecret: '${RHELEMETER_CLIENT_SECRET}',
14-
externalMtlsCa: '${RHELEMETER_EXTERNAL_MTLS_CA}',
15-
externalMtlsCrt: '${RHELEMETER_EXTERNAL_MTLS_CRT}',
16-
externalMtlsKey: '${RHELEMETER_EXTERNAL_MTLS_KEY}',
14+
clientInfoPSK: '${RHELEMETER_CLIENT_INFO_PSK}',
1715
resourceLimits:: {
1816
cpu: '${RHELEMETER_SERVER_CPU_LIMIT}',
1917
memory: '${RHELEMETER_SERVER_MEMORY_LIMIT}',
@@ -38,17 +36,15 @@ local rhelemeter = (import 'rhelemeter.libsonnet') {
3836
],
3937
parameters: [
4038
{ name: 'NAMESPACE', value: 'rhelemeter' },
41-
{ name: 'IMAGE_TAG', value: '82f71d3' },
39+
{ name: 'IMAGE_TAG', value: '5923762' },
4240
{ name: 'IMAGE', value: 'quay.io/app-sre/telemeter' },
4341
{ name: 'REPLICAS', value: '2' },
4442
{ name: 'RHELEMETER_TENANT_ID', value: 'rhel' },
4543
{ name: 'RHELEMETER_FORWARD_URL', value: '' },
46-
{ name: 'RHELEMETER_OIDC_ISSUER', value: '' },
44+
{ name: 'RHELEMETER_OIDC_ISSUER', value: 'https://sso.redhat.com/auth/realms/redhat-external' },
4745
{ name: 'RHELEMETER_CLIENT_ID', value: '' },
4846
{ name: 'RHELEMETER_CLIENT_SECRET', value: '' },
49-
{ name: 'RHELEMETER_EXTERNAL_MTLS_CA', value: '' },
50-
{ name: 'RHELEMETER_EXTERNAL_MTLS_CRT', value: '' },
51-
{ name: 'RHELEMETER_EXTERNAL_MTLS_KEY', value: '' },
47+
{ name: 'RHELEMETER_CLIENT_INFO_PSK', value: '' },
5248
{ name: 'RHELEMETER_LOG_LEVEL', value: 'warn' },
5349
{ name: 'RHELEMETER_SERVER_CPU_LIMIT', value: '1' },
5450
{ name: 'RHELEMETER_SERVER_CPU_REQUEST', value: '100m' },

‎services/rhelemeter.libsonnet

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,15 @@
55
namespace: 'rhelemeter',
66

77
rhelemeterServer+:: {
8-
image: 'quay.io/app-sre/telemeter:82f71d3',
8+
image: 'quay.io/app-sre/telemeter:5923762',
99
replicas: 3,
1010
logLevel: 'warn',
1111
oidcIssuer: error 'must provide telemeterForwardURL',
1212
clientID: error 'must provide clientID',
1313
clientSecret: error 'must provide clientSecret',
1414
rhelemeterForwardURL: error 'must provide telemeterForwardURL',
1515
rhelemeterTenantID: error 'must provide rhelemeterTenantID',
16-
externalMtlsCa: error 'must provide externalMtlsCa',
17-
externalMtlsKey: error 'must provide externalMtlsKey',
18-
externalMtlsCrt: error 'must provide externalMtlsCrt',
16+
clientInfoPSK: error 'must provide clientInfoPSK',
1917
},
2018

2119
},
@@ -27,7 +25,7 @@
2725
},
2826
},
2927

30-
externalMtlsSecret+: {
28+
clientInfoSecret+: {
3129
data+:: {
3230
},
3331
},

‎tests/ci/ci_test.sh

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,7 @@ telemeter() {
8282

8383
rhelemeter() {
8484
oc wait --for=jsonpath='{.status.phase}=Active' namespace/rhelemeter --timeout=5s
85-
oc process -f --param-file=env/rhelemeter.test.ci.env -p RHELEMETER_EXTERNAL_MTLS_CA="$(cat ../deploy/manifests/rhelemeter_certs/ca.crt)" \
86-
RHELEMETER_EXTERNAL_MTLS_CRT="$(cat ../deploy/manifests/rhelemeter_certs/tls.crt)" RHELEMETER_EXTERNAL_MTLS_KEY="$(cat ../deploy/manifests/rhelemeter_certs/tls.key)" \
85+
oc process -f --param-file=env/rhelemeter.test.ci.env -p RHELEMETER_CLIENT_INFO_PSK=ZXhhbXBsZS1hcHAtc2VjcmV0 \
8786
-f ../../resources/services/rhelemeter-template.yaml | oc apply --namespace rhelemeter -f -
8887
}
8988

‎tests/ci/env/rhelemeter.test.ci.env

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ RHELEMETER_OIDC_ISSUER=http://dex.dex.svc.cluster.local:5556/dex
77
RHELEMETER_CLIENT_ID=test
88
RHELEMETER_TENANT_ID=test
99
RHELEMETER_CLIENT_SECRET=ZXhhbXBsZS1hcHAtc2VjcmV0
10+
RHELEMETER_CLIENT_INFO_PSK=ZXhhbXBsZS1hcHAtc2VjcmV0

‎tests/deploy/env/rhelemeter.test.env

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ RHELEMETER_OIDC_ISSUER=http://dex.dex.svc.cluster.local:5556/dex
77
RHELEMETER_CLIENT_ID=test
88
RHELEMETER_TENANT_ID=test
99
RHELEMETER_CLIENT_SECRET=ZXhhbXBsZS1hcHAtc2VjcmV0
10+
RHELEMETER_CLIENT_INFO_PSK=ZXhhbXBsZS1hcHAtc2VjcmV0

‎tests/deploy/launch.sh

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,7 @@ telemeter() {
7878

7979
rhelemeter() {
8080
oc create ns rhelemeter || true
81-
oc process --param-file=env/rhelemeter.test.env -p RHELEMETER_EXTERNAL_MTLS_CA="$(cat manifests/rhelemeter_certs/ca.crt)" \
82-
RHELEMETER_EXTERNAL_MTLS_CRT="$(cat manifests/rhelemeter_certs/tls.crt)" RHELEMETER_EXTERNAL_MTLS_KEY="$(cat manifests/rhelemeter_certs/tls.key)" \
81+
oc process --param-file=env/rhelemeter.test.env -p RHELEMETER_CLIENT_INFO_PSK=super-secret \
8382
-f ../../resources/services/rhelemeter-template.yaml | oc apply --namespace rhelemeter -f -
8483
}
8584

‎tests/deploy/testdata/client-info.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"secret": "super-secret",
3+
"config": {
4+
"secret_header": "x-secret",
5+
"common_name_header": "x-common-name",
6+
"issuer_header": "x-issuer"
7+
}
8+
}

0 commit comments

Comments
 (0)