From 4c5d041c21553db301564470c18f204ffd270126 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Petersen" Date: Thu, 11 Apr 2024 13:02:03 -0400 Subject: [PATCH 1/5] Initial add Github to hack/prepare-supervisor-on-kind.sh --- hack/prepare-supervisor-on-kind.sh | 77 ++++++++++++++++++++++++++++-- 1 file changed, 73 insertions(+), 4 deletions(-) diff --git a/hack/prepare-supervisor-on-kind.sh b/hack/prepare-supervisor-on-kind.sh index 147a1869d..86c4190ce 100755 --- a/hack/prepare-supervisor-on-kind.sh +++ b/hack/prepare-supervisor-on-kind.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash -# Copyright 2021-2023 the Pinniped contributors. All Rights Reserved. +# Copyright 2021-2024 the Pinniped contributors. All Rights Reserved. # SPDX-License-Identifier: Apache-2.0 # @@ -42,6 +42,7 @@ source hack/lib/helpers.sh use_oidc_upstream=no use_ldap_upstream=no use_ad_upstream=no +use_github_upstream=no # TODO: there are two kinds of github apps, we may have to support args for this? use_flow="" while (("$#")); do case "$1" in @@ -67,6 +68,10 @@ while (("$#")); do use_oidc_upstream=yes shift ;; + --github) + use_github_upstream=yes + shift + ;; --ad) # Use an ActiveDirectoryIdentityProvider. # This assumes that you used the --get-active-directory-vars flag with hack/prepare-for-integration-tests.sh. @@ -84,8 +89,8 @@ while (("$#")); do esac done -if [[ "$use_oidc_upstream" == "no" && "$use_ldap_upstream" == "no" && "$use_ad_upstream" == "no" ]]; then - log_error "Error: Please use --oidc, --ldap, or --ad to specify which type(s) of upstream identity provider(s) you would like. May use one or multiple." +if [[ "$use_oidc_upstream" == "no" && "$use_ldap_upstream" == "no" && "$use_ad_upstream" == "no" && "$use_github_upstream" == "no" ]]; then + log_error "Error: Please use --oidc, --ldap, --ad, or --github to specify which type(s) of upstream identity provider(s) you would like. May use one or multiple." exit 1 fi @@ -290,6 +295,40 @@ EOF --dry-run=client --output yaml | kubectl apply -f - fi +if [[ "$use_github_upstream" == "yes" ]]; then + # Make an GitHubIdentityProvider. Needs to be configured with an actual GitHub App or GitHub OAuth App. + # TODO: claims ought be configured + cat <>$fd_file - - displayName: "My AD IDP" + - displayName: "My AD IDP 🚀" objectRef: apiGroup: idp.supervisor.pinniped.dev kind: ActiveDirectoryIdentityProvider @@ -414,6 +453,20 @@ if [[ "$use_ad_upstream" == "yes" ]]; then EOF fi +if [[ "$use_github_upstream" == "yes" ]]; then + # Indenting the heredoc by 4 spaces to make it indented the correct amount in the FederationDomain below. + cat <>$fd_file + + - displayName: "My GitHub IDP 🚀" + objectRef: + apiGroup: idp.supervisor.pinniped.dev + kind: GitHubIdentityProvider + name: my-github-provider +EOF +fi + + + # Apply the FederationDomain from the file created above. kubectl apply --namespace "$PINNIPED_TEST_SUPERVISOR_NAMESPACE" -f "$fd_file" @@ -496,6 +549,11 @@ if [[ "$use_ad_upstream" == "yes" ]]; then https_proxy="$proxy_server" no_proxy="$proxy_except" \ ./pinniped get kubeconfig --oidc-skip-browser $flow_arg --upstream-identity-provider-type activedirectory >kubeconfig-ad.yaml fi +if [[ "$use_github_upstream" == "yes" ]]; then + echo "Generating GitHub kubeconfig..." + https_proxy="$proxy_server" no_proxy="$proxy_except" \ + ./pinniped get kubeconfig --oidc-skip-browser $flow_arg --upstream-identity-provider-type github >kubeconfig-github.yaml +fi # Clear the local CLI cache to ensure that the kubectl command below will need to perform a fresh login. rm -f "$HOME/.config/pinniped/sessions.yaml" @@ -534,6 +592,12 @@ if [[ "$use_ad_upstream" == "yes" ]]; then echo fi +if [[ "$use_github_upstream" == "yes" ]]; then + echo " GitHub Username: your github username" + echo " GitHub Password: your github password" + echo +fi + # Echo the commands that may be used to login and print the identity of the currently logged in user. # Once the CLI has cached your tokens, it will automatically refresh your short-lived credentials whenever # they expire, so you should not be prompted to log in again for the rest of the day. @@ -552,3 +616,8 @@ if [[ "$use_ad_upstream" == "yes" ]]; then echo "PINNIPED_DEBUG=true ${proxy_env_vars}./pinniped whoami --kubeconfig ./kubeconfig-ad.yaml" echo fi +if [[ "$use_github_upstream" == "yes" ]]; then + echo "To log in using GitHub, run:" + echo "PINNIPED_DEBUG=true ${proxy_env_vars}./pinniped whoami --kubeconfig ./kubeconfig-github.yaml" + echo +fi From 265c51b8aad39eb3a4ca5b961007d93fc289fc02 Mon Sep 17 00:00:00 2001 From: Ben Petersen Date: Thu, 11 Apr 2024 16:23:18 -0400 Subject: [PATCH 2/5] Update prepare-supervisor-on-kind.sh to use vars for github secret --- hack/prepare-supervisor-on-kind.sh | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/hack/prepare-supervisor-on-kind.sh b/hack/prepare-supervisor-on-kind.sh index 86c4190ce..7b147efb7 100755 --- a/hack/prepare-supervisor-on-kind.sh +++ b/hack/prepare-supervisor-on-kind.sh @@ -323,8 +323,8 @@ type: "secrets.pinniped.dev/github-client" metadata: name: my-github-provider-client-secret stringData: - clientID: REDACTED - clientSecret: REDACTED + clientID: "$PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_ID" + clientSecret: "$PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_SECRET" EOF fi @@ -592,12 +592,6 @@ if [[ "$use_ad_upstream" == "yes" ]]; then echo fi -if [[ "$use_github_upstream" == "yes" ]]; then - echo " GitHub Username: your github username" - echo " GitHub Password: your github password" - echo -fi - # Echo the commands that may be used to login and print the identity of the currently logged in user. # Once the CLI has cached your tokens, it will automatically refresh your short-lived credentials whenever # they expire, so you should not be prompted to log in again for the rest of the day. From 84007cb1ec794313eed64128958057518b498b03 Mon Sep 17 00:00:00 2001 From: Ben Petersen Date: Thu, 11 Apr 2024 16:44:58 -0400 Subject: [PATCH 3/5] Update prepare-supervisor-on-kind.sh add github environment variables --- hack/prepare-supervisor-on-kind.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hack/prepare-supervisor-on-kind.sh b/hack/prepare-supervisor-on-kind.sh index 7b147efb7..fbe17fc1a 100755 --- a/hack/prepare-supervisor-on-kind.sh +++ b/hack/prepare-supervisor-on-kind.sh @@ -94,6 +94,13 @@ if [[ "$use_oidc_upstream" == "no" && "$use_ldap_upstream" == "no" && "$use_ad_u exit 1 fi +if [[ "$use_github_upstream" == "yes" ]]; then + if [[ "${PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_ID:-}" == "" || "${PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_SECRET:-}" == "" ]]; then + echo "Error: Please set environment vars PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_ID and PINNIPED_TEST_SUPERVISOR_UPSTREAM_GITHUB_CLIENT_SECRET when using --github flag" + exit 1 + fi +fi + # Read the env vars output by hack/prepare-for-integration-tests.sh source /tmp/integration-test-env From 41f8663dcd0da15684c1004bba982c34def84adc Mon Sep 17 00:00:00 2001 From: Ben Petersen Date: Thu, 11 Apr 2024 16:50:14 -0400 Subject: [PATCH 4/5] Update prepare-supervisor-on-kind.sh & remove hard-coded github claims --- hack/prepare-supervisor-on-kind.sh | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/hack/prepare-supervisor-on-kind.sh b/hack/prepare-supervisor-on-kind.sh index fbe17fc1a..c142dd2d9 100755 --- a/hack/prepare-supervisor-on-kind.sh +++ b/hack/prepare-supervisor-on-kind.sh @@ -42,7 +42,7 @@ source hack/lib/helpers.sh use_oidc_upstream=no use_ldap_upstream=no use_ad_upstream=no -use_github_upstream=no # TODO: there are two kinds of github apps, we may have to support args for this? +use_github_upstream=no use_flow="" while (("$#")); do case "$1" in @@ -311,9 +311,6 @@ kind: GitHubIdentityProvider metadata: name: my-github-provider spec: - claims: - username: id - groups: slug client: secretName: my-github-provider-client-secret allowAuthentication: From a72155a57f9392ace3ad09a9296d22ef91b3526f Mon Sep 17 00:00:00 2001 From: Ben Petersen Date: Thu, 11 Apr 2024 16:51:53 -0400 Subject: [PATCH 5/5] Update prepare-supervisor-on-kind.sh final polish --- hack/prepare-supervisor-on-kind.sh | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/hack/prepare-supervisor-on-kind.sh b/hack/prepare-supervisor-on-kind.sh index c142dd2d9..2c4467f0a 100755 --- a/hack/prepare-supervisor-on-kind.sh +++ b/hack/prepare-supervisor-on-kind.sh @@ -303,8 +303,7 @@ EOF fi if [[ "$use_github_upstream" == "yes" ]]; then - # Make an GitHubIdentityProvider. Needs to be configured with an actual GitHub App or GitHub OAuth App. - # TODO: claims ought be configured + # Make an GitHubIdentityProvider. Needs to be configured with an actual GitHub App or GitHub OAuth App. cat <