feat(auth): adopt oidc apps in gitops
This commit is contained in:
Andrew Stoltz
@@ -15,7 +15,6 @@ public sealed class FleetManifestLintTests
|
||||
{
|
||||
"brochure.flowercore.io",
|
||||
"dist.flowercore.io",
|
||||
"dns.iamworkin.lan",
|
||||
};
|
||||
|
||||
// Public hosts that allow a tightly bounded write surface in addition to
|
||||
@@ -706,6 +705,140 @@ public sealed class FleetManifestLintTests
|
||||
application.Scalar("spec", "destination", "namespace").Should().Be("fc-devicemgmt");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void OidcFlipServices_AreGitOpsManagedWithHealthzProbes()
|
||||
{
|
||||
var deployments = new[]
|
||||
{
|
||||
(App: "fc-dns", Name: "dns-web", Slug: "dns", Secret: "dns-oidc-client"),
|
||||
(App: "fc-media", Name: "fc-media-web", Slug: "media", Secret: "media-oidc-client"),
|
||||
(App: "fc-distribution", Name: "fc-distribution", Slug: "distribution", Secret: "distribution-oidc-client"),
|
||||
};
|
||||
|
||||
foreach (var expected in deployments)
|
||||
{
|
||||
var deployment = AppDocuments(expected.App)
|
||||
.Single(document => document.Kind == "Deployment" && document.Name == expected.Name);
|
||||
var container = deployment.MainContainerMappings().Should().ContainSingle().Subject;
|
||||
|
||||
EnvValue(container, "FlowerCore__Auth__Enabled").Should().Be("true");
|
||||
EnvValue(container, "FlowerCore__Auth__Oidc__Enabled").Should().Be("true");
|
||||
(EnvValue(container, "FlowerCore__Auth__Oidc__Audience") ?? EnvValue(container, "FlowerCore__Auth__Oidc__ClientId"))
|
||||
.Should()
|
||||
.Be(expected.Slug);
|
||||
EnvSecretName(container, "FlowerCore__Auth__Oidc__ClientSecret").Should().Be(expected.Secret);
|
||||
EnvSecretOptional(container, "FlowerCore__Auth__Oidc__ClientSecret").Should().Be("true");
|
||||
|
||||
ProbePath(container, "readinessProbe").Should().Be("/healthz");
|
||||
if (ProbePath(container, "startupProbe") is { } startupProbePath)
|
||||
{
|
||||
startupProbePath.Should().Be("/healthz");
|
||||
}
|
||||
|
||||
if (ProbePath(container, "livenessProbe") is { } livenessProbePath)
|
||||
{
|
||||
livenessProbePath.Should().Be("/healthz");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void OidcFlipServices_UseOnePasswordItemClientSecrets()
|
||||
{
|
||||
var expectedItems = new Dictionary<string, (string Name, string ItemPath)>(StringComparer.Ordinal)
|
||||
{
|
||||
["fc-dns"] = ("dns-oidc-client", "vaults/IAmWorkin/items/dns-oidc-client"),
|
||||
["fc-media"] = ("media-oidc-client", "vaults/IAmWorkin/items/media-oidc-client"),
|
||||
["fc-distribution"] = ("distribution-oidc-client", "vaults/IAmWorkin/items/distribution-oidc-client"),
|
||||
};
|
||||
|
||||
foreach (var expected in expectedItems)
|
||||
{
|
||||
var item = AppDocuments(expected.Key)
|
||||
.Single(document => document.Kind == "OnePasswordItem" && document.Name == expected.Value.Name);
|
||||
|
||||
item.Scalar("spec", "itemPath").Should().Be(expected.Value.ItemPath);
|
||||
}
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void DnsAndMediaGitOpsAdoption_PreservesLiveStorageAndImageShape()
|
||||
{
|
||||
var dnsDeployment = AppDocuments("fc-dns")
|
||||
.Single(document => document.Kind == "Deployment" && document.Name == "dns-web");
|
||||
var dnsContainer = dnsDeployment.MainContainerMappings().Should().ContainSingle().Subject;
|
||||
var dnsPvc = AppDocuments("fc-dns")
|
||||
.Single(document => document.Kind == "PersistentVolumeClaim" && document.Name == "dns-web-data");
|
||||
|
||||
ManifestNodeExtensions.Scalar(dnsContainer, "image").Should().Be("localhost/fc-dns-web:v20260604-oidc-proper");
|
||||
dnsPvc.Scalar("spec", "storageClassName").Should().Be("longhorn");
|
||||
dnsPvc.Scalar("spec", "resources", "requests", "storage").Should().Be("1Gi");
|
||||
|
||||
var mediaDeployment = AppDocuments("fc-media")
|
||||
.Single(document => document.Kind == "Deployment" && document.Name == "fc-media-web");
|
||||
var mediaContainer = mediaDeployment.MainContainerMappings().Should().ContainSingle().Subject;
|
||||
var mediaPvc = AppDocuments("fc-media")
|
||||
.Single(document => document.Kind == "PersistentVolumeClaim" && document.Name == "fc-media-data");
|
||||
|
||||
ManifestNodeExtensions.Scalar(mediaContainer, "image").Should().Be("localhost/fc-media-web:v20260604-oidc-proper");
|
||||
mediaPvc.Scalar("spec", "storageClassName").Should().Be("longhorn");
|
||||
mediaPvc.Scalar("spec", "resources", "requests", "storage").Should().Be("20Gi");
|
||||
|
||||
mediaDeployment.AllScalars().Should().Contain(new[]
|
||||
{
|
||||
"/volume1/kubernetes/fc-media-transcodes",
|
||||
"/volume1/kubernetes/fc-media-inbox",
|
||||
"/volume1/video",
|
||||
});
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void MonitoringProbes_UseHealthzForOidcGatedHosts()
|
||||
{
|
||||
var monitoring = File.ReadAllText(Path.Combine(Inventory.BluejayRoot, "apps", "monitoring", "noc-monitoring.yaml"));
|
||||
|
||||
monitoring.Should().Contain("\"https://dns.iamworkin.lan/healthz\"");
|
||||
monitoring.Should().Contain("\"https://dist.iamworkin.lan/healthz\"");
|
||||
monitoring.Should().Contain("\"https://media.iamworkin.lan/healthz\"");
|
||||
monitoring.Should().NotContain("\"https://dns.iamworkin.lan/\"");
|
||||
monitoring.Should().NotContain("\"https://dist.iamworkin.lan/\"");
|
||||
monitoring.Should().NotContain("\"https://media.iamworkin.lan/\"");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void DistributionPublicIngress_KeepsGetHeadMethodAllowlist()
|
||||
{
|
||||
var publicIngress = AppDocuments("fc-distribution")
|
||||
.Single(document => document.Kind == "IngressRoute" && document.Name == "fc-distribution-public");
|
||||
var route = publicIngress.MappingSequence("spec", "routes").Should().ContainSingle().Subject;
|
||||
var match = ManifestNodeExtensions.Scalar(route, "match");
|
||||
|
||||
match.Should().Contain("Host(`dist.flowercore.io`)");
|
||||
match.Should().Contain("Method(`GET`)");
|
||||
match.Should().Contain("Method(`HEAD`)");
|
||||
match.Should().NotContain("Method(`POST`)");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void DnsAndMediaIngressRoutes_MatchLiveInternalHosts()
|
||||
{
|
||||
var dnsRoute = AppDocuments("fc-dns")
|
||||
.Single(document => document.Kind == "IngressRoute" && document.Name == "dns-web")
|
||||
.MappingSequence("spec", "routes")
|
||||
.Should()
|
||||
.ContainSingle()
|
||||
.Subject;
|
||||
var mediaRoute = AppDocuments("fc-media")
|
||||
.Single(document => document.Kind == "IngressRoute" && document.Name == "fc-media-web")
|
||||
.MappingSequence("spec", "routes")
|
||||
.Should()
|
||||
.ContainSingle()
|
||||
.Subject;
|
||||
|
||||
ManifestNodeExtensions.Scalar(dnsRoute, "match").Should().Be("Host(`dns.iamworkin.lan`)");
|
||||
ManifestNodeExtensions.Scalar(mediaRoute, "match").Should().Be("Host(`media.iamworkin.lan`)");
|
||||
}
|
||||
|
||||
private static IEnumerable<string> ProbeViolations(
|
||||
ManifestDocument document,
|
||||
YamlMappingNode container,
|
||||
@@ -762,6 +895,25 @@ public sealed class FleetManifestLintTests
|
||||
: null;
|
||||
}
|
||||
|
||||
private static string? EnvSecretOptional(YamlMappingNode container, string name)
|
||||
{
|
||||
return EnvMapping(container, name) is { } env
|
||||
? ManifestNodeExtensions.Scalar(env, "valueFrom", "secretKeyRef", "optional")
|
||||
: null;
|
||||
}
|
||||
|
||||
private static string? ProbePath(YamlMappingNode container, string probeKey)
|
||||
{
|
||||
return ManifestNodeExtensions.Scalar(container, probeKey, "httpGet", "path");
|
||||
}
|
||||
|
||||
private static IReadOnlyList<ManifestDocument> AppDocuments(string app)
|
||||
{
|
||||
return Inventory.Documents
|
||||
.Where(document => document.RelativePath.StartsWith($"{app}/", StringComparison.Ordinal))
|
||||
.ToList();
|
||||
}
|
||||
|
||||
private static YamlMappingNode? EnvMapping(YamlMappingNode container, string name)
|
||||
{
|
||||
return ManifestNodeExtensions.MappingSequence(container, "env")
|
||||
|
||||
Reference in New Issue
Block a user