feat: dexop - operator to manage Oauth2 clients in Dex #876
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
skrobul
changed the title
skrobul
force-pushed
the
dexop
branch
17 times, most recently
from
2f506f3 to
a239090
Compare
abhimanyu003
requested changes
Apr 29, 2025
| type SecretManager struct { | ||
| } | ||
|
|
||
| func (s SecretManager) readSecret(r *ClientReconciler, ctx context.Context, name, namespace string) (string, error) { |
Contributor
There was a problem hiding this comment.
Any specific reasons for not using pointer here func (s *SecretManager)
Collaborator
Author
There was a problem hiding this comment.
The methods in SecretManager do not alter the struct's state, and because SecretManager is currently an empty struct, there's no need for a pointer receiver. A value receiver suffices for stateless behavior and avoids unnecessary complexity of pointer management.
|
|
||
| toolchain go1.23.6 | ||
|
|
||
| require ( |
Contributor
There was a problem hiding this comment.
need to run go mod tidy
current go.mod is missing some packages that are used.
Like: github.com/sethvargo/go-password
Collaborator
Author
There was a problem hiding this comment.
Good catch,thanks! fixed in rebase
cardoe
reviewed
Apr 29, 2025
Contributor
cardoe
left a comment
cardoe
left a comment
There was a problem hiding this comment.
Overall seems like what we're aiming to achieve.
abhimanyu003
requested changes
May 7, 2025
Up till now all tests required the Dex server to be already running on the developer's machine. It was also assumed that the server will be preconfigured for the gRPC communication. This required the appropriate certificates to be generated, configured in Dex and copied over to the project directory. This commit removes that requirement altogether by automatically starting "dex serve" with appropriate configuration and shutting it down when the tests complete.
grpc.Dial deprecation will be done in separate commit in case w need to revert.
This deploys basic version of the operator.
This changes how the automatically generated Kubernetes Secret looks like: - the `secret` key was renamed to `client-secret` - the `client-id` key is now populated - the `issuer` is populated Caveat: The Issuer information can be obtained from Dex dynamically only starting from newest version (2.42) of Dex. To avoid triggering failed discovery, the same information can be provided as a command line argument.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces a new operator that enables dynamic management of OAuth2 clients in Dex using standard Kubernetes objects.
Currently, creating a Client involves several manual steps:
This process is not ideal, as it imposes a significant administrative burden and security risks due to the use of environment variables. Moreover, updating passwords becomes challenging.
By deploying the operator from this pull request, we can simplify this process significantly. The operator will handle generating secrets and updating Dex configurations for the listed Clients, eliminating the need for manual intervention. Additionally, it leverages dynamic configuration of Dex, allowing us to make changes without requiring a restart. As an added security benefit, the actual password values will never leave the cluster, reducing the risk of exposure and improving overall security.
Key benefits of this change include reduced administrative burden, improved security, and easier password updates.
Note
To the reviewer:
Part of this PR is boiler plate that is automatically generated by operator-sdk. This can be ignored or skimmed through:
config/folder is automatically generated with exception ofconfig/samplesdist/contains an autogenerated YAML for non-helm installsMakefileis autogenerated with adjustments to theIMAGE_TAG_BASEonly