feat(e2e): OIDC e2e test suite (#36)

Add headless OIDC login flow, WaitForSiteAPIWithOIDC, and 5 OIDC-specific tests. Closes #30.

Author: mjudeikis-bot

.github/workflows/e2e.yaml

@@ -4,7 +4,7 @@ on:
   pull_request:
     branches: [main]
   push:
-    branches: [main, "hex/*"]
+    branches: [main]
   workflow_dispatch:
 
 permissions:
@@ -54,3 +54,57 @@ jobs:
             *.kubeconfig
             *.log
           retention-days: 3
+
+  e2e-oidc:
+    name: OIDC (Dex + auth-code flow)
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: v1.25.0
+
+      - name: Install kind
+        uses: helm/kind-action@v1
+        with:
+          install_only: true
+
+      - name: Install Helm
+        uses: azure/setup-helm@v3
+
+      - name: Add kedge.localhost to /etc/hosts
+        run: echo "127.0.0.1 kedge.localhost" | sudo tee -a /etc/hosts
+
+      - name: Add Dex hostname to /etc/hosts
+        run: echo "127.0.0.1 dex.kedge-system.svc.cluster.local" | sudo tee -a /etc/hosts
+
+      - name: Add dexidp Helm repo
+        run: |
+          helm repo add dexidp https://charts.dexidp.io
+          helm repo update dexidp
+
+      - name: Build binaries
+        run: make build
+
+      - name: Build hub Docker image
+        run: |
+          docker build -f deploy/Dockerfile.hub \
+            -t ghcr.io/faroshq/kedge-hub:test .
+
+      - name: Run OIDC e2e
+        env:
+          KEDGE_HUB_IMAGE_PULL_POLICY: Never
+          KEDGE_HUB_IMAGE_TAG: test
+        run: make e2e-oidc E2E_TIMEOUT=25m
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-oidc-logs
+          path: |
+            *.kubeconfig
+            *.log
+          retention-days: 3

Makefile

@@ -349,8 +349,11 @@ e2e: e2e-standalone ## Run default e2e suite (standalone)
 e2e-standalone: build ## Run standalone e2e suite (embedded kcp + static token, no Dex)
 	go test ./test/e2e/suites/standalone/... -v -timeout $(E2E_TIMEOUT) $(E2E_FLAGS)
 
+e2e-oidc: build ## Run OIDC e2e suite (Dex OIDC provider, requires --with-dex cluster)
+	go test ./test/e2e/suites/oidc/... -v -timeout $(E2E_TIMEOUT) $(E2E_FLAGS)
+
 e2e-all: build ## Run all e2e suites
-	go test ./test/e2e/... -v -timeout 30m $(E2E_FLAGS)
+	go test ./test/e2e/suites/... -v -timeout 30m $(E2E_FLAGS)
 
 e2e-keep: ## Run standalone e2e, keep clusters on failure for debugging
 	$(MAKE) e2e-standalone E2E_FLAGS="--keep-clusters"

pkg/cli/cmd/dev/plugin/create.go

@@ -68,11 +68,30 @@ type DevOptions struct {
 	HubHTTPSPort        int
 	HubHTTPPort         int
 	ImagePullPolicy     string
+
+	// WithDex enables Dex as an embedded OIDC identity provider.
+	// When true, Dex is deployed into the hub kind cluster and the hub is
+	// configured with the Dex issuer URL automatically.
+	WithDex     bool
+	DexHTTPPort int // host port for the Dex NodePort mapping (default 5556)
 }
 
 // fallbackAssetVersion is used when unable to fetch the latest version
 const fallbackAssetVersion = "0.0.1"
 
+// Dex constants used when --with-dex is set.
+const (
+	devDexIssuerURL    = "http://dex.kedge-system.svc.cluster.local:5556/dex"
+	devDexClientID     = "kedge"
+	devDexClientSecret = "kedge-test-secret"
+	devDexChartRef     = "dexidp/dex" // from https://charts.dexidp.io, added as a repo
+	devDexChartVersion = "0.24.0"
+	devDexReleaseName  = "dex"
+	devDexNodePort     = 31556
+	// bcrypt of "Password1!" for the dev Dex static user
+	devDexUserHash = "$2a$10$ntVcHD0gEYObjVin2ti7XuMILVz0rTQl//HVPc3cR8z7AAVbQGrkO"
+)
+
 // gitHubRelease represents a GitHub release response
 type gitHubRelease struct {
 	TagName string `json:"tag_name"`
@@ -90,6 +109,7 @@ func NewDevOptions(streams genericclioptions.IOStreams) *DevOptions {
 		APIServerPort:    6443,
 		HubHTTPSPort:     8443,
 		HubHTTPPort:      8080,
+		DexHTTPPort:      5556,
 	}
 }
 
@@ -108,6 +128,8 @@ func (o *DevOptions) AddCmdFlags(cmd *cobra.Command) {
 	cmd.Flags().IntVar(&o.HubHTTPSPort, "hub-https-port", 8443, "HTTPS port for kedge hub (change if 8443 is already in use)")
 	cmd.Flags().IntVar(&o.HubHTTPPort, "hub-http-port", 8080, "HTTP port for kedge hub (change if 8080 is already in use)")
 	cmd.Flags().StringVar(&o.ImagePullPolicy, "image-pull-policy", "IfNotPresent", "Image pull policy for the hub (use Never when the image is pre-loaded into kind)")
+	cmd.Flags().BoolVar(&o.WithDex, "with-dex", false, "Deploy Dex as OIDC identity provider into the hub kind cluster")
+	cmd.Flags().IntVar(&o.DexHTTPPort, "dex-http-port", 5556, "Host port for the Dex NodePort mapping (default 5556)")
 }
 
 // Complete completes the options
@@ -180,6 +202,14 @@ func (o *DevOptions) Validate() error {
 }
 
 func (o *DevOptions) hubClusterConfig() string {
+	dexMapping := ""
+	if o.WithDex {
+		dexMapping = fmt.Sprintf(`  - containerPort: 31556
+    hostPort: %d
+    protocol: TCP
+    listenAddress: "127.0.0.1"
+`, o.DexHTTPPort)
+	}
 	return fmt.Sprintf(`apiVersion: kind.x-k8s.io/v1alpha4
 kind: Cluster
 networking:
@@ -196,7 +226,7 @@ nodes:
     hostPort: %d
     protocol: TCP
     listenAddress: "127.0.0.1"
-`, o.APIServerPort, o.HubHTTPPort, o.HubHTTPSPort)
+%s`, o.APIServerPort, o.HubHTTPPort, o.HubHTTPSPort, dexMapping)
 }
 
 var agentClusterConfig = `apiVersion: kind.x-k8s.io/v1alpha4
@@ -392,7 +422,20 @@ func (o *DevOptions) createCluster(ctx context.Context, clusterName, clusterConf
 		if err != nil {
 			return err
 		}
-		if err := o.installHelmChart(ctx, restConfig); err != nil {
+
+		// Deploy Dex FIRST so the hub can be installed once, with IDP settings
+		// already wired in. Dex creates the namespace (CreateNamespace=true).
+		if o.WithDex {
+			_, _ = fmt.Fprint(o.Streams.ErrOut, "Deploying Dex OIDC provider...\n")
+			if err := o.deployDex(ctx, restConfig, kubeconfigPath); err != nil {
+				return fmt.Errorf("deploying dex: %w", err)
+			}
+			_, _ = fmt.Fprint(o.Streams.ErrOut, "Dex deployed\n")
+		}
+
+		// Single hub install: pass withIDP=o.WithDex so IDP settings are
+		// included from the start when Dex is enabled.
+		if err := o.installHelmChart(ctx, restConfig, o.WithDex); err != nil {
 			_, _ = fmt.Fprint(o.Streams.ErrOut, "Failed to install Helm chart\n")
 			return err
 		}
@@ -406,6 +449,108 @@ func loadRestConfigFromFile(kubeconfigPath string) (*rest.Config, error) {
 	return clientcmd.BuildConfigFromFlags("", kubeconfigPath)
 }
 
+// ensureDexHelmRepo adds the dexidp helm repo if it isn't already present.
+// This is needed so that `helm install dexidp/dex` can resolve the chart.
+func ensureDexHelmRepo() error {
+	addCmd := exec.Command("helm", "repo", "add", "dexidp", "https://charts.dexidp.io")
+	// "already exists" is not an error; any other failure is.
+	out, err := addCmd.CombinedOutput()
+	if err != nil && !strings.Contains(string(out), "already exists") {
+		return fmt.Errorf("adding dexidp helm repo: %w\noutput: %s", err, string(out))
+	}
+	updateCmd := exec.Command("helm", "repo", "update", "dexidp")
+	if out, err := updateCmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("updating dexidp helm repo: %w\noutput: %s", err, string(out))
+	}
+	return nil
+}
+
+// deployDex installs or upgrades the Dex Helm chart into the hub kind cluster
+// and blocks until the Dex pod is Running/Ready.
+func (o *DevOptions) deployDex(ctx context.Context, restConfig *rest.Config, kubeconfigPath string) error {
+	actionConfig := new(action.Configuration)
+	if err := actionConfig.Init(&restConfigGetter{config: restConfig}, "kedge-system", "secret",
+		func(format string, v ...any) {}); err != nil {
+		return fmt.Errorf("initialising helm action config for dex: %w", err)
+	}
+	regClient, err := registry.NewClient()
+	if err != nil {
+		return fmt.Errorf("creating helm registry client for dex: %w", err)
+	}
+	actionConfig.RegistryClient = regClient
+
+	hubExternalURL := fmt.Sprintf("https://kedge.localhost:%d", o.HubHTTPSPort)
+	redirectURI := hubExternalURL + "/auth/callback"
+
+	dexValues := map[string]any{
+		"image": map[string]any{"tag": "v2.44.0"},
+		"service": map[string]any{
+			"type": "NodePort",
+			"ports": map[string]any{
+				"http": map[string]any{"nodePort": devDexNodePort},
+			},
+		},
+		"config": map[string]any{
+			"issuer":  devDexIssuerURL,
+			"storage": map[string]any{"type": "memory"},
+			"web":     map[string]any{"http": "0.0.0.0:5556"},
+			"oauth2":  map[string]any{"skipApprovalScreen": true},
+			"staticClients": []map[string]any{{
+				"id":           devDexClientID,
+				"secret":       devDexClientSecret,
+				"name":         "Kedge Hub",
+				"redirectURIs": []string{redirectURI},
+			}},
+			"enablePasswordDB": true,
+			"staticPasswords": []map[string]any{{
+				"email":    "admin@test.kedge.local",
+				"hash":     devDexUserHash,
+				"username": "admin",
+				"userID":   "test-user-id-01",
+			}},
+		},
+	}
+
+	if err := ensureDexHelmRepo(); err != nil {
+		return fmt.Errorf("ensuring dex helm repo: %w", err)
+	}
+
+	tmp := action.NewInstall(actionConfig)
+	tmp.Version = devDexChartVersion
+	chartPath, err := tmp.LocateChart(devDexChartRef, cli.New())
+	if err != nil {
+		return fmt.Errorf("locating dex chart: %w", err)
+	}
+	chartObj, err := loader.Load(chartPath)
+	if err != nil {
+		return fmt.Errorf("loading dex chart: %w", err)
+	}
+
+	hist := action.NewHistory(actionConfig)
+	hist.Max = 1
+	if _, err := hist.Run(devDexReleaseName); err == nil {
+		upg := action.NewUpgrade(actionConfig)
+		upg.Namespace = "kedge-system"
+		upg.Wait = true
+		upg.Timeout = 3 * time.Minute
+		if _, err := upg.Run(devDexReleaseName, chartObj, dexValues); err != nil {
+			return fmt.Errorf("upgrading dex chart: %w", err)
+		}
+	} else {
+		inst := action.NewInstall(actionConfig)
+		inst.ReleaseName = devDexReleaseName
+		inst.Namespace = "kedge-system"
+		inst.CreateNamespace = true // Dex is deployed before the hub; create namespace here.
+		inst.Wait = true
+		inst.Timeout = 3 * time.Minute
+		if _, err := inst.Run(chartObj, dexValues); err != nil {
+			return fmt.Errorf("installing dex chart: %w", err)
+		}
+	}
+
+	return nil
+}
+
 func (o *DevOptions) getClusterIPAddress(ctx context.Context, clusterName, networkName string) (string, error) {
 	dockerClient, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
 	if err != nil {
@@ -443,7 +588,11 @@ func (o *DevOptions) getClusterIPAddress(ctx context.Context, clusterName, netwo
 	return "", fmt.Errorf("could not find IP address for cluster %s in network %s", clusterName, networkName)
 }
 
-func (o *DevOptions) installHelmChart(_ context.Context, restConfig *rest.Config) error {
+// installHelmChart installs or upgrades the kedge-hub Helm chart.
+// withIDP controls whether IDP/OIDC values are included; pass false for the
+// initial install (before Dex is deployed) and true for the upgrade after Dex
+// is up, so the hub never tries to contact a non-existent issuer at startup.
+func (o *DevOptions) installHelmChart(_ context.Context, restConfig *rest.Config, withIDP bool) error {
 	actionConfig := new(action.Configuration)
 
 	if err := actionConfig.Init(&restConfigGetter{config: restConfig}, "kedge-system", "secret", func(format string, v ...any) {}); err != nil {
@@ -457,6 +606,21 @@ func (o *DevOptions) installHelmChart(_ context.Context, restConfig *rest.Config
 	}
 	actionConfig.RegistryClient = registryClient
 
+	hubExternalURL := fmt.Sprintf("https://kedge.localhost:%d", o.HubHTTPSPort)
+
+	hubValues := map[string]any{
+		"hubExternalURL": hubExternalURL,
+		"listenAddr":     fmt.Sprintf(":%d", o.HubHTTPSPort),
+		"devMode":        true,
+	}
+	// Static auth token is only used in token mode. In OIDC/IDP mode the hub
+	// authenticates via Dex; mixing both would be confusing and unnecessary.
+	if !withIDP {
+		hubValues["staticAuthTokens"] = []string{"dev-token"}
+	}
+	// IDP settings are passed via the top-level `idp` helm values (not under `hub`).
+	// See deploy/charts/kedge-hub/templates/statefulset.yaml.
+
 	values := map[string]any{
 		"image": map[string]any{
 			"hub": map[string]any{
@@ -465,14 +629,7 @@ func (o *DevOptions) installHelmChart(_ context.Context, restConfig *rest.Config
 				"pullPolicy": o.ImagePullPolicy,
 			},
 		},
-		"hub": map[string]any{
-			"hubExternalURL": fmt.Sprintf("https://kedge.localhost:%d", o.HubHTTPSPort),
-			"listenAddr":     fmt.Sprintf(":%d", o.HubHTTPSPort),
-			"devMode":        true,
-			"staticAuthTokens": []string{
-				"dev-token",
-			},
-		},
+		"hub": hubValues,
 		"service": map[string]any{
 			"type": "NodePort",
 			"hub": map[string]any{
@@ -481,6 +638,13 @@ func (o *DevOptions) installHelmChart(_ context.Context, restConfig *rest.Config
 			},
 		},
 	}
+	if withIDP && o.WithDex {
+		values["idp"] = map[string]any{
+			"issuerURL":    devDexIssuerURL,
+			"clientID":     devDexClientID,
+			"clientSecret": devDexClientSecret,
+		}
+	}
 
 	var chartObj *chart.Chart
 	var err error

pkg/cli/cmd/site.go

@@ -38,6 +38,7 @@ func newSiteCommand() *cobra.Command {
 		newSiteCreateCommand(),
 		newSiteListCommand(),
 		newSiteGetCommand(),
+		newSiteDeleteCommand(),
 	)
 
 	return cmd
@@ -194,6 +195,30 @@ func newSiteGetCommand() *cobra.Command {
 	}
 }
 
+func newSiteDeleteCommand() *cobra.Command {
+	return &cobra.Command{
+		Use:   "delete <name>",
+		Short: "Delete a site",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			name := args[0]
+			ctx := context.Background()
+
+			dynClient, err := loadDynamicClient()
+			if err != nil {
+				return err
+			}
+
+			if err := dynClient.Resource(kedgeclient.SiteGVR).Delete(ctx, name, metav1.DeleteOptions{}); err != nil {
+				return fmt.Errorf("deleting site %q: %w", name, err)
+			}
+
+			fmt.Printf("Site %q deleted.\n", name)
+			return nil
+		},
+	}
+}
+
 func unstructuredNestedBool(obj map[string]interface{}, fields ...string) (bool, bool, error) {
 	val, found, err := unstructuredNestedField(obj, fields...)
 	if err != nil || !found {