Implement confidential OIDC authentication boundary

deploy/kubernetes/nuthatch.yaml.in

@@ -5,13 +5,16 @@ metadata:
   namespace: nuthatch-testbed
 data:
   NUTHATCH_LISTEN: 0.0.0.0:8080
-  NUTHATCH_PUBLIC_BASE_URL: http://nuthatch-@@LANE@@:8080
+  NUTHATCH_PUBLIC_BASE_URL: https://nuthatch-@@LANE@@:8080
   NUTHATCH_REDIS_URL: "@@REDIS_URL@@"
+  NUTHATCH_OIDC_ISSUER: "@@OIDC_ISSUER@@"
+  NUTHATCH_OIDC_CLIENT_ID: "@@OIDC_CLIENT_ID@@"
+  NUTHATCH_OIDC_ADDITIONAL_AUDIENCES: "@@OIDC_ADDITIONAL_AUDIENCES@@"
+  NUTHATCH_OIDC_REDIRECT_URI: https://nuthatch-@@LANE@@:8080/oidc/callback
   NUTHATCH_S3_ENDPOINT: "@@S3_ENDPOINT@@"
   NUTHATCH_S3_REGION: "@@S3_REGION@@"
   NUTHATCH_S3_BUCKET: "@@S3_BUCKET@@"
   NUTHATCH_S3_PATH_STYLE: "true"
-  NUTHATCH_AUTH_MODE: dev
 ---
 apiVersion: v1
 kind: Secret
@@ -20,7 +23,8 @@ metadata:
   namespace: nuthatch-testbed
 type: Opaque
 stringData:
-  NUTHATCH_JWT_SECRET: synthetic-kind-jwt-secret-@@LANE@@
+  NUTHATCH_JWT_SECRET: synthetic-kind-session-jwt-secret-@@LANE@@
+  NUTHATCH_OIDC_CLIENT_SECRET: "@@OIDC_CLIENT_SECRET@@"
   NUTHATCH_PG_CONN: "@@PG_CONN@@"
   NUTHATCH_S3_ACCESS_KEY: "@@S3_ACCESS_KEY@@"
   NUTHATCH_S3_SECRET_KEY: "@@S3_SECRET_KEY@@"
@@ -40,11 +44,47 @@ spec:
     spec:
       automountServiceAccountToken: false
       enableServiceLinks: false
+      dnsPolicy: None
+      dnsConfig:
+        nameservers: [10.96.0.53]
+        searches:
+          - nuthatch-testbed.svc.cluster.local
+          - svc.cluster.local
+          - cluster.local
+        options:
+          - {name: ndots, value: "5"}
       securityContext:
         runAsNonRoot: true
         runAsUser: 10001
         runAsGroup: 10001
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
         seccompProfile: {type: RuntimeDefault}
+      initContainers:
+        - name: tls-certificate
+          image: @@APP_IMAGE@@
+          imagePullPolicy: Never
+          command: [/bin/sh, -ec]
+          args:
+            - |
+              openssl req \
+                -x509 \
+                -newkey rsa:2048 \
+                -nodes \
+                -days 1 \
+                -subj "/CN=nuthatch-@@LANE@@" \
+                -addext "subjectAltName=DNS:nuthatch-@@LANE@@,DNS:nuthatch-@@LANE@@.nuthatch-testbed.svc" \
+                -keyout /tls/tls.key \
+                -out /tls/tls.crt
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: ["ALL"]}
+          volumeMounts:
+            - {name: tls, mountPath: /tls}
+          resources:
+            requests: {cpu: 25m, memory: 16Mi}
+            limits: {cpu: 250m, memory: 32Mi}
       containers:
         - name: nuthatch
           image: @@APP_IMAGE@@
@@ -57,18 +97,23 @@ spec:
             - configMapRef: {name: nuthatch-@@LANE@@}
             - secretRef: {name: nuthatch-@@LANE@@}
           ports:
-            - {name: http, containerPort: 8080}
+            - {name: https, containerPort: 8080}
           livenessProbe:
-            httpGet: {path: /healthz, port: http}
+            httpGet: {path: /healthz, port: https, scheme: HTTPS}
             periodSeconds: 2
             failureThreshold: 15
           readinessProbe:
-            httpGet: {path: /readyz, port: http}
+            httpGet: {path: /readyz, port: https, scheme: HTTPS}
             periodSeconds: 2
             failureThreshold: 30
           resources:
             requests: {cpu: 100m, memory: 96Mi}
             limits: {cpu: "2", memory: 512Mi}
+          volumeMounts:
+            - {name: tls, mountPath: /tls, readOnly: true}
+      volumes:
+        - name: tls
+          emptyDir: {}
 ---
 apiVersion: v1
 kind: Service
@@ -78,4 +123,4 @@ metadata:
 spec:
   selector: {app: nuthatch-@@LANE@@}
   ports:
-    - {name: http, port: 8080, targetPort: http}
+    - {name: https, port: 8080, targetPort: https}