Skip to content

Commit f4b0b81

Browse files
nchenewethncheneweth
committed
[nc] initial pipeline test, dev-pskctl
Signed-off-by: Nic Cheneweth <[email protected]>
1 parent 51b22e6 commit f4b0b81

27 files changed

+184
-480
lines changed

‎.circleci/config.yml

+63-68
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
---
22
version: 2.1
33

4+
orbs:
5+
op: twdps/[email protected]
6+
do: twdps/[email protected]
7+
48
globals:
59
- &context empc-lab
6-
- &shell op run --env-file op.env -- /bin/bash -eo pipefail
10+
- &executor-image twdps/circleci-python-builder:3.0.2
711

812
on-push-main: &on-push-main
913
branches:
@@ -21,89 +25,80 @@ commands:
2125

2226
set-environment:
2327
parameters:
24-
cluster:
25-
description: target cluster
26-
type: string
27-
default: ""
28-
tag:
29-
description: image to deploy
28+
tenant:
29+
description: set tenant ENV
3030
type: string
31-
default: dev.${CIRCLE_SHA1:0:7}
3231
steps:
33-
- run:
34-
name: set environment
35-
command: |
36-
op inject -i op.env -o $BASH_ENV
37-
echo "export API_VERSION=<< parameters.tag >>" >> $BASH_ENV
38-
source $BASH_ENV
39-
op inject -i tpl/cosign.key.tpl -o cosign.key
40-
op inject -i tpl/cosign.pub.tpl -o cosign.pub
41-
- when:
42-
condition: << parameters.cluster >>
43-
steps:
44-
- run:
45-
name: set ~/.kube/config
46-
command: |
47-
mkdir -p ~/.kube
48-
ENV=<< parameters.cluster >> op inject -i tpl/kubeconfig.tpl -o ~/.kube/config
32+
- op/env:
33+
env-file: op.<< parameters.tenant >>.env
4934

5035
jobs:
5136

52-
deploy auth0 configuration:
37+
configure-auth0-tenant:
38+
description: configure auth0 tenant
39+
docker:
40+
- image: *executor-image
5341
parameters:
54-
cluster:
55-
description: target cluster
42+
tenant:
43+
description: auth0 tenant to configure
5644
type: string
57-
namespace:
58-
description: deploy to this env namespace
59-
type: string
60-
tag:
61-
description: image to deploy
62-
type: string
63-
docker:
64-
- image: twdps/circleci-python-builder:alpine-stable
6545
steps:
6646
- checkout
6747
- setup_remote_docker
6848
- set-environment:
69-
cluster: << parameters.cluster >>
70-
tag: << parameters.tag >>
49+
tenant: << parameters.tenant >>
50+
- run:
51+
name: install requirements
52+
command: pip install -r requirements.txt
7153
- run:
72-
name: deploy hello-restful
73-
command: |
74-
helm upgrade hello-restful charts/hello-restful \
75-
--install --atomic --timeout 60s \
76-
--namespace demo-<< parameters.namespace>> \
77-
--values charts/hello-restful/values.yaml \
78-
--values charts/hello-restful/values-<< parameters.namespace >>.yaml \
79-
--set image.tag=<< parameters.tag >>
54+
name: lint invoke tasks
55+
command: pylint tasks
8056
- run:
81-
name: test healthz endpoint
82-
command: |
83-
reponse=$(curl https://twdps.io/v1/hello/healthz)
84-
if [[ $(echo $reponse | jq -r .status) != "ok" ]]; then
85-
echo "error: healthz not ok"
86-
exit 1
87-
fi
88-
# deploy observability
57+
name: configure Auth0 tenant
58+
command: inv idp.install
59+
- run:
60+
name: write tenant Application credentials to secrets store
61+
command: bash scripts/write_client_credentials.sh
8962

9063
workflows:
91-
version: 2
9264

93-
development-build:
65+
development tenant build:
9466
jobs:
95-
- python/static-analysis:
96-
name: static code analysis
67+
- configure-auth0-tenant:
68+
name: configure dev-pskctl tenant
9769
context: *context
98-
shell: *shell
99-
package-manager: *package-manager
100-
install-dev: true
101-
lint-path: api
102-
report-coverage: codeclimate
103-
after-checkout:
104-
- run:
105-
name: set API_VERSION
106-
command: |
107-
echo "export API_VERSION=dev.${CIRCLE_SHA1:0:7}" >> $BASH_ENV
108-
source $BASH_ENV
70+
tenant: dev-pskctl
10971
filters: *on-push-main
72+
73+
production tenant configuration:
74+
jobs:
75+
- configure-auth0-tenant:
76+
name: configure pskctl tenant
77+
context: *context
78+
tenant: pskctl
79+
filters: *on-tag-main
80+
81+
- do/release:
82+
name: generate release notes
83+
context: *context
84+
on-tag: true
85+
before-release:
86+
- set-environment:
87+
tenant: pskctl
88+
requires:
89+
- configure pskctl tenant
90+
filters: *on-tag-main
91+
92+
- do/slack-bot:
93+
name: post lab-events
94+
context: *context
95+
channel: lab-events
96+
message: pskctl Auth0 tenant application release
97+
include-link: true
98+
include-tag: true
99+
before-message:
100+
- set-environment:
101+
tenant: pskctl
102+
requires:
103+
- configure pskctl tenant
104+
filters: *on-tag-main

‎.gitignore

+5-1
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,8 @@ get-token.sh
22
.venv
33
access_token
44
source.env
5-
client_credentials.json
5+
client_credentials.json
6+
request-body/github-social-connection.json
7+
request-body/set-claims-as-github-teams-trigger-binding.json
8+
request-body/set-claims-as-github-teams.json
9+
actions/set-claims-as-github-teams.js

‎.pre-commit-config.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
repos:
3+
- repo: https://github.com/pre-commit/pre-commit-hooks
4+
rev: v4.0.1
5+
hooks:
6+
- id: check-executables-have-shebangs
7+
- id: check-symlinks
8+
- id: check-merge-conflict
9+
- id: check-added-large-files
10+
- id: check-json
11+
- id: check-yaml
12+
args: [--allow-multiple-documents]
13+
- id: forbid-new-submodules
14+
- id: detect-private-key
15+
- id: end-of-file-fixer
16+
- id: trailing-whitespace
17+
args: [--markdown-linebreak-ext=md]
18+
- repo: local
19+
hooks:
20+
- id: git-secrets
21+
name: git-secrets
22+
entry: git-secrets
23+
language: system
24+
args: ["--scan"]

‎.python-version

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
3.11.2
1+
3.11.6

‎README.md

+16-35
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,27 @@
66
</p>
77
<br />
88
<h3>pskctl-auth0-management</h3>
9-
<a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/github/license/ThoughtWorks-DPS/psk-aws-platform-vpc"></a> <a href="https://github.com"><img src="https://img.shields.io/badge/-social-blank.svg?style=social&logo=github"></a>
9+
<a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/github/license/ThoughtWorks-DPS/pskctl-auth0-management"></a> <a href="https://github.com"><img src="https://img.shields.io/badge/-social-blank.svg?style=social&logo=github"></a>
1010
</div>
1111
<br />
1212

13-
Configuration of Auth0 applications, social integrations, and actions to support the EMPC labs Platform Starter Kits command line tool (`pskctl`).
13+
Configuration of Auth0 applications, social integrations, and actions to support the EMPC labs Platform Starter Kits engineering platform user experience.
14+
15+
PSK Platform access is based around team membership. If you are part of a team that has been authorized to use the platform, then you will have permission to interact with all of that particular teams resources on the platform.
16+
17+
The intended integration pattern is that all the SaaS developer tools are integrated into the organization's SSO provider. Generally, corporations have Okta (of which Auth0 is now a part) or another IDP (Azure AD) and this is used to create an authentication workflow with the tool. As the authorization experience is intended to be around team membership and we also want customers of the platform to be able to self-manage those teams, we will use GitHub as the oauth2 integration point for the platform. It is relatively straightforward to configure such an experience within GitHub itself (and most organization have) as far creating and managing teams in an authorized manner.
18+
19+
A User (customer, developer) has access to the platform by virtue of being added to a GitHub Team that has been onboarded.
20+
21+
The Auth0 tenant application created by this pipeline is used in two ways:
22+
- An the 0auth2/oidc integration with each of the kubernetes cluster to enable bounded access to team resources on the cluster, and
23+
- to authN/Z calls to the custom platfom product APIs (typically using the platform cli `pskctl`).
1424

1525
The oauth0/oidc flow required by the pskctl tool is available in the free tier of Auth0. Complete these [bootstrap](doc/bootstrap.md) steps as part of signing up for Auth0 and preparing for the pipeline managed Auth0 configuration.
1626

1727
With a management api token now available, this pipeline will perform the following tasks:
1828

19-
* Create an application client to be used by the pskctl tool.
29+
* Create an application client to be used by the pskctl tool.
2030

2131
* Create a custom action that will run after a successful github social-authentication. The action fetches the Users teams for the integrated (above) github organization.
2232

@@ -28,45 +38,16 @@ The above results in the creation of an oauth2/oidc device-auth-flow endpoint th
2838

2939
This endpoint implements the oauth2/oidc device-auth-flow. Using the pskctl cli, when you perform a `login` command, you will be provided a link. From your browser, proceed to the link and enter the provided device code. You must then authenticate to Github. This is performed via Githubs oauth service and no credential information is made available to Auth0.
3040

31-
In addition to this social-login connection, upon a successful github login, the auth0 application client will fetch the list of github teams the user is a member of the github organization. This list is included as a claim within the resulting id token.
41+
In addition to this social-login connection, upon a successful github login, the auth0 application client will fetch the list of organization github teams in which the user is a member. This list is included as a claim within the resulting id token.
3242

43+
The Auth0 tenant application is also integrated with the kubernetes clusters of the PSK engineering platform. The pskctl cli can also generate kubeconfig files that enable users to authenticate to the EKS cluster with permissions based on role bindings tied to the github team claims.
3344

3445
### development
3546

3647
The above github oauth app and auth0 management api tokens must be available in th environment for the python scripts to work. See op.*.env
3748

38-
39-
40-
41-
49+
These setting are all configurable in the request-body/TENANT.json file.
4250
- token expires after 1hr (3600)
4351
- can be refreshed (refresh token provided)
4452
- absolute lifetime for refresh for token in active use is 7 days (604800)
4553
- an idle token cannot be refreshed after 2days (172800)
46-
47-
48-
49-
50-
51-
52-
53-
After completing the bootstrap steps, the github social connection in place and the Management API client endpoint available, now this repo pipeline can manage the Applications and Rules that define the functionality of our oidc endpoint.
54-
55-
The pipeline has three essential steps:
56-
57-
1. Fetch a management api token to use for creating and updating Auth0 configuration
58-
2. Deploy the dev or prod tenant dpsctl application definitions
59-
3. Deploy all rules used by the dpsctl application login process
60-
61-
Since Auth0 is not used to perform any authentication functions, the rules are the steps to take in constructing a jwt to return from a successful authentication.
62-
63-
In this case that means, if the user is a member of the github org where the github oauth-app is defined (in this case ThoughtWorks-DPS) then they will be able to successfully authenticate, after which:
64-
65-
* with the users own github access token, fetch all org teams of which the user is a member
66-
* insert those teams as a list into the returned idToken
67-
68-
See repo pipeline for specific details.
69-
70-
71-
72-

‎archive/create_action_v2.py

-10
This file was deleted.

‎archive/create_actions.py

-91
This file was deleted.

0 commit comments

Comments
 (0)