Skip to content

Commit 18ef78a

Browse files
jorteljortel
authored
🐛 Fix IdP CR upgrade issues. (#578)
closes #577 Also ensures only the IdentityProvider and Clients with the part-of label are manged. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed API key preservation during upgrade scenarios where existing secrets are updated. * **Chores** * Refactored identity provider client configuration management for improved maintainability. * Enhanced OIDC issuer URL configuration handling for better flexibility in different deployment environments. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Jeff Ortel <jortel@redhat.com>
1 parent 79fb9b7 commit 18ef78a

7 files changed

Lines changed: 144 additions & 87 deletions

‎roles/tackle/tasks/idpclient-create.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
- name: "Check for existing IdpClient: {{ idpclient.name }}"
3+
k8s_info:
4+
api_version: tackle.konveyor.io/v1alpha1
5+
kind: IdpClient
6+
name: "{{ idpclient.name }}"
7+
namespace: "{{ app_namespace }}"
8+
register: existing_idpclient
9+
10+
- name: "Create/update IdpClient if operator-managed: {{ idpclient.name }}"
11+
when: >-
12+
(existing_idpclient.resources | length) == 0 or
13+
((existing_idpclient.resources[0].metadata.labels | default({})).get('app.kubernetes.io/part-of', '') == app_name)
14+
k8s:
15+
state: present
16+
definition: "{{ lookup('template', idpclient.template) }}"

‎roles/tackle/tasks/main.yml‎

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,14 @@
3636
openshift_cluster: true
3737
when: "'route.openshift.io' in api_groups"
3838

39-
- name: "Create IdpClient CRs (web-ui, kantra, kai-ide)"
40-
k8s:
41-
state: present
42-
definition: "{{ lookup('template', 'customresource-idpclients.yml.j2') }}"
43-
register: idpclients_result
44-
failed_when: idpclients_result.failed
39+
- name: "Create operator-managed IdpClients"
40+
include_tasks: idpclient-create.yml
41+
loop:
42+
- { name: web-ui, template: customresource-idpclient-webui.yml.j2 }
43+
- { name: kantra, template: customresource-idpclient-kantra.yml.j2 }
44+
- { name: kai-ide, template: customresource-idpclient-kai.yml.j2 }
45+
loop_control:
46+
loop_var: idpclient
4547

4648
- name: "Detect existing Keycloak deployment"
4749
block:
@@ -73,10 +75,22 @@
7375
keycloak_service_url: "{{ 'https://' + app_name + '-rhbk-service.' + app_namespace + '.svc:8443' if keycloak_is_rhbk else 'http://' + app_name + '-keycloak-sso.' + app_namespace + '.svc:8080' }}"
7476
when: keycloak_detected|bool
7577

78+
- name: "Check for existing IdentityProvider"
79+
when:
80+
- feature_auth_required|bool
81+
- keycloak_detected|bool
82+
k8s_info:
83+
api_version: tackle.konveyor.io/v1alpha1
84+
kind: IdentityProvider
85+
name: keycloak
86+
namespace: "{{ app_namespace }}"
87+
register: idp_status
88+
7689
- name: "Create IdentityProvider CR for detected Keycloak"
7790
when:
7891
- feature_auth_required|bool
7992
- keycloak_detected|bool
93+
- (idp_status.resources | length) == 0 or ((idp_status.resources[0].metadata.labels | default({})).get('app.kubernetes.io/part-of', '') == app_name)
8094
k8s:
8195
state: present
8296
definition: "{{ lookup('template', 'customresource-identityprovider.yml.j2') }}"
@@ -160,6 +174,30 @@
160174
state: present
161175
definition: "{{ lookup('template', 'secret-hub.yml.j2') }}"
162176

177+
- name: "Add apikey-secret to existing Hub secret if missing (upgrade scenario)"
178+
when: (hub_secret_status.resources | length) > 0
179+
block:
180+
- name: "Check if apikey-secret exists in Hub secret"
181+
set_fact:
182+
apikey_exists: "{{ 'apikey-secret' in hub_secret_status.resources[0].data }}"
183+
184+
- name: "Generate and add apikey-secret to existing Hub secret"
185+
when: not apikey_exists
186+
block:
187+
- name: "Generate Hub API key secret for upgrade"
188+
set_fact:
189+
hub_apikey_secret_upgrade: "{{ lookup('password', '/dev/null chars=ascii_lowercase,ascii_uppercase,digits length=32') }}"
190+
191+
- name: "Add apikey-secret key to existing Hub secret"
192+
kubernetes.core.k8s:
193+
state: patched
194+
kind: Secret
195+
name: "{{ hub_secret_name }}"
196+
namespace: "{{ app_namespace }}"
197+
definition:
198+
data:
199+
apikey-secret: "{{ hub_apikey_secret_upgrade | b64encode }}"
200+
163201
# Create all the neccessary CR's before the hub deployment is created
164202
- name: "Remove Admin Addon CR"
165203
k8s:

‎roles/tackle/templates/customresource-identityprovider.yml.j2‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ metadata:
1010
app.kubernetes.io/part-of: {{ app_name }}
1111
spec:
1212
name: keycloak
13-
issuer: {{ keycloak_service_url }}/auth/realms/{{ app_name }}
13+
issuer: ${issuer.proto}://${issuer.host}/auth/realms/{{ app_name }}
1414
tls:
1515
insecure: true
1616
clientId: {{ app_name }}-ui
17-
redirectURI: {{ hub_url }}/oidc/idp/callback
17+
redirectURI: ${issuer.proto}://${issuer.host}/oidc/idp/callback
1818
scopes:
1919
- openid
2020
- profile

‎roles/tackle/templates/customresource-idpclient-kai.yml.j2‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
3+
# kai-ide client (public client - no secret needed)
4+
apiVersion: tackle.konveyor.io/v1alpha1
5+
kind: IdpClient
6+
metadata:
7+
name: kai-ide
8+
namespace: {{ app_namespace }}
9+
labels:
10+
app.kubernetes.io/name: kai-ide
11+
app.kubernetes.io/component: idp-client
12+
app.kubernetes.io/part-of: {{ app_name }}
13+
spec:
14+
id: 3
15+
clientId: kai-ide
16+
applicationType: native
17+
grants:
18+
- urn:ietf:params:oauth:grant-type:jwt-bearer
19+
- authorization_code
20+
- refresh_token
21+
redirectURIs:
22+
- vscode://konveyor.konveyor-core/auth
23+
- http://127.0.0.1/callback
24+
scopes:
25+
- offline_access
26+
- openid
27+
- profile
28+
- email

‎roles/tackle/templates/customresource-idpclient-kantra.yml.j2‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
3+
# kantra client (public client - no secret needed)
4+
apiVersion: tackle.konveyor.io/v1alpha1
5+
kind: IdpClient
6+
metadata:
7+
name: kantra
8+
namespace: {{ app_namespace }}
9+
labels:
10+
app.kubernetes.io/name: kantra
11+
app.kubernetes.io/component: idp-client
12+
app.kubernetes.io/part-of: {{ app_name }}
13+
spec:
14+
id: 2
15+
clientId: kantra
16+
applicationType: native
17+
grants:
18+
- urn:ietf:params:oauth:grant-type:device_code
19+
- authorization_code
20+
- refresh_token
21+
scopes:
22+
- offline_access
23+
- openid
24+
- profile
25+
- email
26+

‎roles/tackle/templates/customresource-idpclient-webui.yml.j2‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
3+
# web-ui client
4+
apiVersion: tackle.konveyor.io/v1alpha1
5+
kind: IdpClient
6+
metadata:
7+
name: web-ui
8+
namespace: {{ app_namespace }}
9+
labels:
10+
app.kubernetes.io/name: web-ui
11+
app.kubernetes.io/component: idp-client
12+
app.kubernetes.io/part-of: {{ app_name }}
13+
spec:
14+
id: 1
15+
clientId: web-ui
16+
applicationType: web
17+
grants:
18+
- urn:ietf:params:oauth:grant-type:jwt-bearer
19+
- authorization_code
20+
- refresh_token
21+
redirectURIs:
22+
- "${issuer.proto}://${issuer.host}{,*}/**"
23+
scopes:
24+
- offline_access
25+
- openid
26+
- profile
27+
- email
28+

‎roles/tackle/templates/customresource-idpclients.yml.j2‎

Lines changed: 0 additions & 79 deletions
This file was deleted.

0 commit comments

Comments
 (0)