Merge pull request #1912 from vmware-tanzu/ben/github/identity-provider/supervisor-hack-script

Add GitHub to Supervisor hack script

hack/prepare-supervisor-on-kind.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+# Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 #
@@ -42,6 +42,7 @@ source hack/lib/helpers.sh
 use_oidc_upstream=no
 use_ldap_upstream=no
 use_ad_upstream=no
+use_github_upstream=no
 use_flow=""
 while (("$#")); do
   case "$1" in
@@ -67,6 +68,10 @@ while (("$#")); do
     use_oidc_upstream=yes
     shift
     ;;
+  --github)
+    use_github_upstream=yes
+    shift
+    ;;
   --ad)
     # Use an ActiveDirectoryIdentityProvider.
     # This assumes that you used the --get-active-directory-vars flag with hack/prepare-for-integration-tests.sh.
@@ -84,11 +89,18 @@ while (("$#")); do
   esac
 done
 
-if [[ "$use_oidc_upstream" == "no" && "$use_ldap_upstream" == "no" && "$use_ad_upstream" == "no" ]]; then
-  log_error "Error: Please use --oidc, --ldap, or --ad to specify which type(s) of upstream identity provider(s) you would like. May use one or multiple."
+if [[ "$use_oidc_upstream" == "no" && "$use_ldap_upstream" == "no" && "$use_ad_upstream" == "no" && "$use_github_upstream" == "no" ]]; then
+  log_error "Error: Please use --oidc, --ldap, --ad, or --github to specify which type(s) of upstream identity provider(s) you would like. May use one or multiple."
   exit 1
 fi
 
+if [[ "$use_github_upstream" == "yes" ]]; then
+  if [[ "${PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_ID:-}" == "" || "${PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_SECRET:-}" == "" ]]; then
+    echo "Error: Please set environment vars PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_ID and PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_SECRET when using --github flag"
+    exit 1
+  fi
+fi
+
 # Read the env vars output by hack/prepare-for-integration-tests.sh
 source /tmp/integration-test-env
 
@@ -290,6 +302,34 @@ EOF
     --dry-run=client --output yaml | kubectl apply -f -
 fi
 
+if [[ "$use_github_upstream" == "yes" ]]; then
+  # Make an GitHubIdentityProvider.  Needs to be configured with an actual GitHub App or GitHub OAuth App.  
+  cat <<EOF | kubectl apply --namespace "$PINNIPED_TEST_SUPERVISOR_NAMESPACE" -f -
+apiVersion: idp.supervisor.pinniped.dev/v1alpha1
+kind: GitHubIdentityProvider
+metadata:
+  name: my-github-provider
+spec:
+  client:
+    secretName: my-github-provider-client-secret
+  allowAuthentication:
+    organizations:
+      policy: AllGitHubUsers
+EOF
+
+  # Make a Secret for the above GitHubIdentityProvider to describe the GitHub client configured.  
+  cat <<EOF | kubectl apply --namespace "$PINNIPED_TEST_SUPERVISOR_NAMESPACE" -f -
+apiVersion: v1
+kind: Secret
+type: "secrets.pinniped.dev/github-client"
+metadata:
+  name: my-github-provider-client-secret
+stringData:
+  clientID: "$PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_ID"
+  clientSecret: "$PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_SECRET"
+EOF
+fi
+
 # Create a CA and TLS serving certificates for the Supervisor's FederationDomain.
 if [[ ! -f "$root_ca_crt_path" ]]; then
   step certificate create \
@@ -406,7 +446,7 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
   # Indenting the heredoc by 4 spaces to make it indented the correct amount in the FederationDomain below.
   cat <<EOF >>$fd_file
 
-    - displayName: "My AD IDP"
+    - displayName: "My AD IDP 🚀"
       objectRef:
         apiGroup: idp.supervisor.pinniped.dev
         kind: ActiveDirectoryIdentityProvider
@@ -414,6 +454,18 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
 EOF
 fi
 
+if [[ "$use_github_upstream" == "yes" ]]; then
+  # Indenting the heredoc by 4 spaces to make it indented the correct amount in the FederationDomain below.
+  cat <<EOF >>$fd_file
+
+    - displayName: "My GitHub IDP 🚀"
+      objectRef:
+        apiGroup: idp.supervisor.pinniped.dev
+        kind: GitHubIdentityProvider
+        name: my-github-provider
+EOF
+fi
+
 # Apply the FederationDomain from the file created above.
 kubectl apply --namespace "$PINNIPED_TEST_SUPERVISOR_NAMESPACE" -f "$fd_file"
 
@@ -496,6 +548,11 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
   https_proxy="$proxy_server" no_proxy="$proxy_except" \
     ./pinniped get kubeconfig --oidc-skip-browser $flow_arg --upstream-identity-provider-type activedirectory >kubeconfig-ad.yaml
 fi
+if [[ "$use_github_upstream" == "yes" ]]; then
+  echo "Generating GitHub kubeconfig..."
+  https_proxy="$proxy_server" no_proxy="$proxy_except" \
+    ./pinniped get kubeconfig --oidc-skip-browser $flow_arg --upstream-identity-provider-type github >kubeconfig-github.yaml
+fi
 
 # Clear the local CLI cache to ensure that the kubectl command below will need to perform a fresh login.
 rm -f "$HOME/.config/pinniped/sessions.yaml"
@@ -552,3 +609,8 @@ if [[ "$use_ad_upstream" == "yes" ]]; then
   echo "PINNIPED_DEBUG=true ${proxy_env_vars}./pinniped whoami --kubeconfig ./kubeconfig-ad.yaml"
   echo
 fi
+if [[ "$use_github_upstream" == "yes" ]]; then
+  echo "To log in using GitHub, run:"
+  echo "PINNIPED_DEBUG=true ${proxy_env_vars}./pinniped whoami --kubeconfig ./kubeconfig-github.yaml"
+  echo
+fi