Skip to content

Commit defcc33

Browse files
davidcheungdavidcheung
authored
improvement: allow overriding default config (#56)
1 parent c14041e commit defcc33

File tree

3 files changed

+159
-138
lines changed

3 files changed

+159
-138
lines changed

‎modules/user_auth/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,10 @@ No requirements.
4141
| jwks\_content | The content of a JWKS file for Oathkeeper | `string` | n/a | yes |
4242
| k8s\_local\_exec\_context | Custom resource (Oathkeeper Rules are created using local-exec with kubectl), if not specified it will target your current context from kubeconfig | `string` | `""` | no |
4343
| kratos\_secret\_name | Secret name for kratos to access Database credentials, created from pre-k8s script | `string` | n/a | yes |
44+
| kratos\_values\_override | a map of parameters to override the kratos-values.yml | `map(any)` | `{}` | no |
4445
| kubectl\_extra\_args | Arguments that will be passed to kubectl when using the local executor in cases where the terraform k8s support is not enough | `string` | n/a | yes |
4546
| name | The name to create user-auth components(kratos/oathkeeper), must be unique in the cluster for helm-resources | `string` | n/a | yes |
47+
| oathkeeper\_values\_override | a map of parameters to override the oathkeeper-values.yml | `map(any)` | `{}` | no |
4648
| user\_auth\_mail\_from\_address | Mail from the user management system will come from this address | `string` | `""` | no |
4749
| whitelisted\_return\_urls | URLs that can be redirected to after completing a flow initialized with the return\_to parameter | `list(string)` | `[]` | no |
4850

‎modules/user_auth/main.tf‎

Lines changed: 145 additions & 138 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,128 @@ locals {
1414
}
1515
}
1616

17+
kratos_values_override = {
18+
secret = {
19+
nameOverride = var.kratos_secret_name
20+
}
21+
kratos = {
22+
config = {
23+
serve = {
24+
public = {
25+
base_url = "https://${var.backend_service_domain}/.ory/kratos/public"
26+
}
27+
admin = {
28+
base_url = "https://${var.backend_service_domain}/.ory/kratos/"
29+
}
30+
}
31+
32+
selfservice = {
33+
whitelisted_return_urls = var.whitelisted_return_urls
34+
default_browser_return_url = "https://${var.frontend_service_domain}/"
35+
flows = {
36+
settings = {
37+
ui_url = "https://${var.frontend_service_domain}/auth/settings"
38+
after = {
39+
default_browser_return_url = "https://${var.frontend_service_domain}/dashboard"
40+
}
41+
}
42+
43+
verification = {
44+
ui_url = "https://${var.frontend_service_domain}/auth/verify"
45+
after = {
46+
default_browser_return_url = "https://${var.frontend_service_domain}/dashboard"
47+
}
48+
}
49+
50+
recovery = {
51+
ui_url = "https://${var.frontend_service_domain}/auth/recovery"
52+
after = {
53+
default_browser_return_url = "https://${var.frontend_service_domain}/dashboard"
54+
}
55+
}
56+
57+
login = {
58+
ui_url = "https://${var.frontend_service_domain}/auth/login"
59+
after = {
60+
default_browser_return_url = "https://${var.frontend_service_domain}/dashboard"
61+
}
62+
}
63+
64+
registration = {
65+
ui_url = "https://${var.frontend_service_domain}/auth/registration"
66+
after = {
67+
default_browser_return_url = "https://${var.frontend_service_domain}/dashboard"
68+
password = {
69+
default_browser_return_url = "https://${var.frontend_service_domain}/dashboard"
70+
}
71+
oidc = {
72+
default_browser_return_url = "https://${var.frontend_service_domain}/dashboard"
73+
}
74+
}
75+
}
76+
77+
error = {
78+
ui_url = "https://${var.frontend_service_domain}/auth/errors"
79+
}
80+
81+
}
82+
}
83+
courier = {
84+
smtp = {
85+
from_address = var.user_auth_mail_from_address
86+
}
87+
}
88+
}
89+
}
90+
}
91+
92+
oathkeeper_values_override = {
93+
ingress = {
94+
proxy = {
95+
hosts = [var.backend_service_domain]
96+
tls = {
97+
// HCL doesnt allow map inside a list, you will get the following error with a list
98+
// `<.host>: can't evaluate field host in type interface {}`
99+
"0" = {
100+
host = [var.backend_service_domain]
101+
}
102+
}
103+
104+
annotations = {
105+
"nginx.ingress.kubernetes.io/cors-allow-origin" : "https://${var.frontend_service_domain}"
106+
}
107+
}
108+
}
109+
oathkeeer = {
110+
config = {
111+
authenticators = {
112+
cookie_session = {
113+
config = {
114+
check_session_url = "http://kratos-${var.name}-public/sessions/whoami"
115+
}
116+
}
117+
}
118+
119+
mutators = {
120+
id_token = {
121+
config = {
122+
issuer_url = "https://${var.backend_service_domain}"
123+
}
124+
}
125+
}
126+
127+
errors = {
128+
handlers = {
129+
redirect = {
130+
config = {
131+
to = "https://${var.frontend_service_domain}/auth/login"
132+
}
133+
}
134+
}
135+
}
136+
}
137+
}
138+
}
17139

18140
}
19141

@@ -39,6 +161,15 @@ resource "null_resource" "external_secret_custom_resource" {
39161
depends_on = [kubernetes_namespace.user_auth]
40162
}
41163

164+
module "kratos_config" {
165+
source = "cloudposse/config/yaml"
166+
version = "0.7.0"
167+
168+
map_config_local_base_path = "${path.module}/files"
169+
map_config_paths = ["kratos-values.yml"]
170+
map_configs = [local.kratos_values_override, var.kratos_values_override]
171+
}
172+
42173
resource "helm_release" "kratos" {
43174

44175
name = "kratos-${var.name}"
@@ -49,14 +180,11 @@ resource "helm_release" "kratos" {
49180
depends_on = [kubernetes_namespace.user_auth]
50181

51182
values = [
52-
file("${path.module}/files/kratos-values.yml"),
183+
jsonencode(module.kratos_config.map_configs)
53184
]
54-
55-
# This secret contains db credentials created during the initial zero apply command
56-
# The kubernetes secret will be created automatically by external-secrets based on the content of a secret from the specified secrets source
57-
set {
58-
name = "secret.nameOverride"
59-
value = var.kratos_secret_name
185+
set_sensitive {
186+
name = "kratos.config.secrets.default[0]"
187+
value = var.cookie_signing_secret_key
60188
}
61189

62190
# set {
@@ -65,106 +193,6 @@ resource "helm_release" "kratos" {
65193
# value = "sqlite:///var/lib/sqlite/db.sqlite?_fk=true&mode=rwc"
66194
# # value = "${local.db_type}://${kubernetes_service.app_db.metadata[0].name}.${kubernetes_service.app_db.metadata[0].namespace}"
67195
# }
68-
69-
set {
70-
name = "kratos.config.courier.smtp.from_address"
71-
value = var.user_auth_mail_from_address
72-
}
73-
74-
set_sensitive {
75-
name = "kratos.config.secrets.default[0]"
76-
value = var.cookie_signing_secret_key
77-
}
78-
79-
set {
80-
name = "kratos.config.serve.public.base_url"
81-
value = "https://${var.backend_service_domain}/.ory/kratos/public"
82-
}
83-
84-
set {
85-
name = "kratos.config.serve.admin.base_url"
86-
value = "https://${var.backend_service_domain}/.ory/kratos/"
87-
}
88-
89-
# Return urls
90-
set {
91-
name = "kratos.config.selfservice.default_browser_return_url"
92-
value = "https://${var.frontend_service_domain}/"
93-
}
94-
95-
dynamic "set" {
96-
for_each = var.whitelisted_return_urls
97-
iterator = whitelist_url
98-
content {
99-
name = "kratos.config.selfservice.whitelisted_return_urls[${whitelist_url.key}]"
100-
value = whitelist_url.value
101-
}
102-
}
103-
104-
set {
105-
name = "kratos.config.selfservice.flows.settings.ui_url"
106-
value = "https://${var.frontend_service_domain}/auth/settings"
107-
}
108-
109-
set {
110-
name = "kratos.config.selfservice.flows.settings.after.default_browser_return_url"
111-
value = "https://${var.frontend_service_domain}/dashboard"
112-
}
113-
114-
set {
115-
name = "kratos.config.selfservice.flows.verification.ui_url"
116-
value = "https://${var.frontend_service_domain}/auth/verify"
117-
}
118-
119-
set {
120-
name = "kratos.config.selfservice.flows.verification.after.default_browser_return_url"
121-
value = "https://${var.frontend_service_domain}/dashboard"
122-
}
123-
124-
set {
125-
name = "kratos.config.selfservice.flows.recovery.ui_url"
126-
value = "https://${var.frontend_service_domain}/auth/recovery"
127-
}
128-
129-
set {
130-
name = "kratos.config.selfservice.flows.logout.after.default_browser_return_url"
131-
value = "https://${var.frontend_service_domain}/"
132-
}
133-
134-
set {
135-
name = "kratos.config.selfservice.flows.login.ui_url"
136-
value = "https://${var.frontend_service_domain}/auth/login"
137-
}
138-
139-
set {
140-
name = "kratos.config.selfservice.flows.login.after.default_browser_return_url"
141-
value = "https://${var.frontend_service_domain}/dashboard"
142-
}
143-
144-
set {
145-
name = "kratos.config.selfservice.flows.registration.ui_url"
146-
value = "https://${var.frontend_service_domain}/auth/registration"
147-
}
148-
149-
set {
150-
name = "kratos.config.selfservice.flows.registration.after.default_browser_return_url"
151-
value = "https://${var.frontend_service_domain}/dashboard"
152-
}
153-
154-
set {
155-
name = "kratos.config.selfservice.flows.registration.after.password.default_browser_return_url"
156-
value = "https://${var.frontend_service_domain}/dashboard"
157-
}
158-
159-
set {
160-
name = "kratos.config.selfservice.flows.registration.after.oidc.default_browser_return_url"
161-
value = "https://${var.frontend_service_domain}/dashboard"
162-
}
163-
164-
set {
165-
name = "kratos.config.selfservice.flows.error.ui_url"
166-
value = "https://${var.frontend_service_domain}/auth/errors"
167-
}
168196
}
169197

170198
data "template_file" "oathkeeper_kratos_proxy_rules" {
@@ -188,6 +216,15 @@ resource "null_resource" "oathkeeper_kratos_proxy_rules" {
188216
depends_on = [helm_release.oathkeeper]
189217
}
190218

219+
module "oathkeeper_config" {
220+
source = "cloudposse/config/yaml"
221+
version = "0.7.0"
222+
223+
map_config_local_base_path = "${path.module}/files"
224+
map_config_paths = ["oathkeeper-values.yml"]
225+
map_configs = [local.oathkeeper_values_override, var.oathkeeper_values_override]
226+
}
227+
191228
resource "helm_release" "oathkeeper" {
192229

193230
name = "oathkeeper-${var.name}"
@@ -198,42 +235,12 @@ resource "helm_release" "oathkeeper" {
198235
depends_on = [kubernetes_namespace.user_auth]
199236

200237
values = [
201-
file("${path.module}/files/oathkeeper-values.yml"),
238+
jsonencode(module.oathkeeper_config.map_configs)
202239
]
203240

204-
set {
205-
name = "oathkeeper.config.mutators.id_token.config.issuer_url"
206-
value = "https://${var.backend_service_domain}"
207-
}
208-
209-
set {
210-
name = "oathkeeper.config.authenticators.cookie_session.config.check_session_url"
211-
value = "http://kratos-${var.name}-public/sessions/whoami"
212-
}
213-
214241
# Clean up and set the JWKS content. This will become a secret mounted into the pod
215242
set_sensitive {
216243
name = "oathkeeper.mutatorIdTokenJWKs"
217244
value = replace(jsonencode(jsondecode(var.jwks_content)), "/([,\\[\\]{}])/", "\\$1")
218245
}
219-
220-
set {
221-
name = "oathkeeper.config.errors.handlers.redirect.config.to"
222-
value = "https://${var.frontend_service_domain}/auth/login"
223-
}
224-
225-
set {
226-
name = "ingress.proxy.hosts[0].host"
227-
value = var.backend_service_domain
228-
}
229-
230-
set {
231-
name = "ingress.proxy.annotations.nginx\\.ingress\\.kubernetes\\.io/cors-allow-origin"
232-
value = "https://${var.frontend_service_domain}"
233-
}
234-
235-
set {
236-
name = "ingress.proxy.tls[0].hosts[0]"
237-
value = var.backend_service_domain
238-
}
239246
}

‎modules/user_auth/variables.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,3 +75,15 @@ variable "external_secret_name" {
7575
description = "Name of a secret in an external secrets backend that contains the content to pull into a kubernetes secret for Kratos to use"
7676
type = string
7777
}
78+
79+
variable "kratos_values_override" {
80+
description = "a map of parameters to override the kratos-values.yml"
81+
type = map(any)
82+
default = {}
83+
}
84+
85+
variable "oathkeeper_values_override" {
86+
description = "a map of parameters to override the oathkeeper-values.yml"
87+
type = map(any)
88+
default = {}
89+
}

0 commit comments

Comments
 (0)