Move browser authentication behind a generated-contract BFF
This commit is contained in:
parent
6f0f20f5cc
commit
fa7220ee33
2 changed files with 7259 additions and 2825 deletions
|
|
@ -30,14 +30,33 @@ spec:
|
|||
args:
|
||||
- |
|
||||
retry="--retry 30 --retry-all-errors --retry-delay 1"
|
||||
test "$(curl $retry --silent --output /dev/null --write-out '%{http_code}' http://remora-remora-api-metrics:9090/health/ready)" = 200
|
||||
test "$(curl $retry --silent --output /dev/null --write-out '%{http_code}' http://remora-remora-web/health/ready)" = 200
|
||||
curl $retry --fail --silent http://remora-remora-api-metrics:9090/metrics | grep -q remora_background_runs_total
|
||||
curl $retry --fail --silent http://remora-remora-web/runtime-config.js | grep -q '"oidcClientId":"remora-web"'
|
||||
test "$(curl $retry --silent --output /dev/null --write-out '%{http_code}' http://remora-remora/v1/jobs)" = 401
|
||||
expect_status() {
|
||||
name="$1"
|
||||
expected="$2"
|
||||
shift 2
|
||||
actual="$(curl $retry --silent --output /dev/null --write-out '%{http_code}' "$@")"
|
||||
if test "$actual" != "$expected"; then
|
||||
printf '%s returned HTTP %s, expected %s\n' "$name" "$actual" "$expected" >&2
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
expect_body() {
|
||||
name="$1"
|
||||
pattern="$2"
|
||||
shift 2
|
||||
if ! curl $retry --fail --silent "$@" | grep -q "$pattern"; then
|
||||
printf '%s did not contain the expected response marker\n' "$name" >&2
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
expect_status "API readiness" 200 http://remora-remora-api-metrics:9090/health/ready
|
||||
expect_status "Web readiness" 200 http://remora-remora-web/health/ready
|
||||
expect_body "API metrics" remora_background_runs_total http://remora-remora-api-metrics:9090/metrics
|
||||
expect_body "Web runtime configuration" '"apiUrl":"/bff/api/"' http://remora-remora-web/runtime-config.js
|
||||
expect_status "API authentication" 401 http://remora-remora/v1/jobs
|
||||
if test -n "@@INGRESS_URL@@"; then
|
||||
curl $retry --fail --silent --header 'Host: qualification-ingress' @@INGRESS_URL@@/ | grep -q '<title>Remora</title>'
|
||||
test "$(curl $retry --silent --header 'Host: qualification-ingress' --output /dev/null --write-out '%{http_code}' @@INGRESS_URL@@/v1/jobs)" = 401
|
||||
expect_body "Ingress WebClient" '<title>Remora</title>' --header 'Host: qualification-ingress' --header 'Accept: text/html' @@INGRESS_URL@@/
|
||||
expect_status "Ingress API authentication" 401 --header 'Host: qualification-ingress' @@INGRESS_URL@@/v1/jobs
|
||||
fi
|
||||
if curl --connect-timeout 2 --max-time 5 --insecure --silent --fail https://remora-remora-worker:8443/internal/v1/jobs/x/claim >/dev/null 2>&1; then
|
||||
exit 1
|
||||
|
|
|
|||
|
|
@ -138,6 +138,8 @@ create_external_secrets() {
|
|||
kube --namespace "$FIXTURE_NAMESPACE" delete \
|
||||
secret/remora-database \
|
||||
secret/remora-coordination \
|
||||
secret/remora-web-oidc \
|
||||
secret/remora-web-session \
|
||||
secret/remora-target \
|
||||
--ignore-not-found \
|
||||
--wait=true
|
||||
|
|
@ -145,6 +147,10 @@ create_external_secrets() {
|
|||
--from-literal="url=$database_url"
|
||||
kube --namespace "$FIXTURE_NAMESPACE" create secret generic remora-coordination \
|
||||
--from-literal="url=$coordination_url"
|
||||
kube --namespace "$FIXTURE_NAMESPACE" create secret generic remora-web-oidc \
|
||||
--from-literal="client-secret=synthetic-web-client-secret"
|
||||
kube --namespace "$FIXTURE_NAMESPACE" create secret generic remora-web-session \
|
||||
--from-literal="url=$coordination_url"
|
||||
kube --namespace "$FIXTURE_NAMESPACE" create secret generic remora-target \
|
||||
--from-literal="access-key=$target_access_key" \
|
||||
--from-literal="secret-key=$target_secret_key"
|
||||
|
|
@ -181,9 +187,7 @@ worker:
|
|||
web:
|
||||
image: {repository: remora-web, tag: local, digest: "", pullPolicy: Never}
|
||||
publicOrigin: $public_origin
|
||||
apiUrl: /v1/
|
||||
oidcClientId: remora-web
|
||||
cspConnectSrc: "'self' $oidc_issuer"
|
||||
podDnsPolicy: None
|
||||
podDnsConfig:
|
||||
nameservers: [10.96.0.53]
|
||||
|
|
@ -227,6 +231,9 @@ networkPolicy:
|
|||
- fixture.remora.dev/component: vault
|
||||
- fixture.remora.dev/component: zitadel
|
||||
- fixture.remora.dev/component: versitygw
|
||||
webDependencyPodLabels:
|
||||
- fixture.remora.dev/component: dragonfly
|
||||
- fixture.remora.dev/component: zitadel
|
||||
observability:
|
||||
serviceMonitor: {enabled: false, interval: 30s}
|
||||
prometheusRule: {enabled: false}
|
||||
|
|
@ -413,6 +420,8 @@ validate_deployment_assets() {
|
|||
--set-string outbound.allowedSchemePorts=https:70000
|
||||
reject_chart_values "renewal at lease expiry" \
|
||||
--set runtime.workerRenewSeconds=30
|
||||
reject_chart_values "a shared WebSession credential" \
|
||||
--set web.sessionUrlSecret.name=remora-coordination
|
||||
reject_chart_values "application-only CIDR reachability" \
|
||||
--set-string outbound.allowedCidrs=10.0.0.0/8
|
||||
reject_chart_values "an impossible disruption budget" \
|
||||
|
|
|
|||
Loading…
Reference in a new issue