Skip to content

Commit a332a21

Browse files
stlazstlaz
committed
mount a session secret in OIDC envs
1 parent f8c2631 commit a332a21

File tree

10 files changed

+233
-7
lines changed

10 files changed

+233
-7
lines changed

‎pkg/api/api.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ const (
3737
RedirectContainerPort = 8444
3838
RedirectContainerPortName = "custom-route-redirect"
3939
ServiceCAConfigMapName = "service-ca"
40+
SessionSecretName = "session-secret"
4041
TargetNamespace = "openshift-console"
4142
TrustedCABundleKey = "ca-bundle.crt"
4243
TrustedCABundleMountDir = "/etc/pki/ca-trust/extracted/pem"

‎pkg/console/operator/sync_v400.go‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,10 @@ func (co *consoleOperator) sync_v400(ctx context.Context, controllerContext fact
7676
return statusHandler.FlushAndReturn(err)
7777
}
7878

79-
var authServerCAConfig *corev1.ConfigMap
79+
var (
80+
authServerCAConfig *corev1.ConfigMap
81+
sessionSecret *corev1.Secret
82+
)
8083
switch authnConfig.Spec.Type {
8184
case configv1.AuthenticationTypeOIDC:
8285
if len(authnConfig.Spec.OIDCProviders) > 0 {
@@ -87,7 +90,10 @@ func (co *consoleOperator) sync_v400(ctx context.Context, controllerContext fact
8790
}
8891
}
8992

90-
sessionSecret := secretsub.Stub()
93+
sessionSecret, err = co.syncSessionSecret(ctx, updatedOperatorConfig, controllerContext.Recorder())
94+
if err != nil {
95+
return statusHandler.FlushAndReturn(err)
96+
}
9197
}
9298

9399
cm, cmChanged, cmErrReason, cmErr := co.SyncConfigMap(
@@ -158,6 +164,7 @@ func (co *consoleOperator) sync_v400(ctx context.Context, controllerContext fact
158164
authServerCAConfig,
159165
trustedCAConfigMap,
160166
clientSecret,
167+
sessionSecret,
161168
set.Proxy,
162169
set.Infrastructure,
163170
customLogoCanMount,
@@ -261,6 +268,7 @@ func (co *consoleOperator) SyncDeployment(
261268
authServerCAConfigMap *corev1.ConfigMap,
262269
trustedCAConfigMap *corev1.ConfigMap,
263270
sec *corev1.Secret,
271+
sessionSecret *corev1.Secret,
264272
proxyConfig *configv1.Proxy,
265273
infrastructureConfig *configv1.Infrastructure,
266274
canMountCustomLogo bool,
@@ -275,6 +283,7 @@ func (co *consoleOperator) SyncDeployment(
275283
authServerCAConfigMap,
276284
trustedCAConfigMap,
277285
sec,
286+
sessionSecret,
278287
proxyConfig,
279288
infrastructureConfig,
280289
canMountCustomLogo,
@@ -587,3 +596,29 @@ func (co *consoleOperator) isCopiedCSVsDisabled(ctx context.Context) (bool, erro
587596

588597
return copiedCSVsDisabled, nil
589598
}
599+
600+
func (co *consoleOperator) syncSessionSecret(
601+
ctx context.Context,
602+
operatorConfig *operatorv1.Console,
603+
recorder events.Recorder,
604+
) (*corev1.Secret, error) {
605+
606+
sessionSecret, err := co.secretsLister.Secrets(api.TargetNamespace).Get(api.SessionSecretName)
607+
if err != nil && !apierrors.IsNotFound(err) {
608+
return nil, err
609+
}
610+
611+
var required *corev1.Secret
612+
if sessionSecret == nil {
613+
required = secretsub.DefaultSessionSecret(operatorConfig)
614+
} else {
615+
required = sessionSecret.DeepCopy()
616+
changed := secretsub.ResetSessionSecretKeysIfNeeded(required)
617+
if !changed {
618+
return required, nil
619+
}
620+
}
621+
622+
secret, _, err := resourceapply.ApplySecret(ctx, co.secretsClient, recorder, required)
623+
return secret, err
624+
}

‎pkg/console/subresource/configmap/configmap_test.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ clusterInfo:
115115
masterPublicURL: ` + mockAPIServer + `
116116
controlPlaneTopology: HighlyAvailable
117117
releaseVersion: ` + testReleaseVersion + `
118+
session: {}
118119
customization:
119120
branding: ` + DEFAULT_BRAND + `
120121
documentationBaseURL: ` + DEFAULT_DOC_URL + `
@@ -171,6 +172,7 @@ clusterInfo:
171172
consoleBaseAddress: https://` + host + `
172173
masterPublicURL: ` + mockAPIServer + `
173174
releaseVersion: ` + testReleaseVersion + `
175+
session: {}
174176
customization:
175177
branding: ` + DEFAULT_BRAND + `
176178
documentationBaseURL: ` + DEFAULT_DOC_URL + `
@@ -192,6 +194,7 @@ providers: {}
192194
managedConfig: &corev1.ConfigMap{
193195
Data: map[string]string{configKey: `kind: ConsoleConfig
194196
apiVersion: console.openshift.io/v1
197+
session: {}
195198
customization:
196199
branding: online
197200
documentationBaseURL: https://docs.okd.io/4.4/
@@ -239,6 +242,7 @@ clusterInfo:
239242
nodeArchitectures:
240243
- amd64
241244
- arm64
245+
session: {}
242246
customization:
243247
branding: online
244248
documentationBaseURL: https://docs.okd.io/4.4/
@@ -260,6 +264,7 @@ providers: {}
260264
managedConfig: &corev1.ConfigMap{
261265
Data: map[string]string{configKey: `kind: ConsoleConfig
262266
apiVersion: console.openshift.io/v1
267+
session: {}
263268
customization:
264269
branding: online
265270
documentationBaseURL: https://docs.okd.io/4.4/
@@ -307,6 +312,7 @@ clusterInfo:
307312
nodeOperatingSystems:
308313
- foo
309314
- bar
315+
session: {}
310316
customization:
311317
branding: online
312318
documentationBaseURL: https://docs.okd.io/4.4/
@@ -337,6 +343,7 @@ providers: {}
337343
managedConfig: &corev1.ConfigMap{
338344
Data: map[string]string{configKey: `kind: ConsoleConfig
339345
apiVersion: console.openshift.io/v1
346+
session: {}
340347
customization:
341348
branding: online
342349
documentationBaseURL: https://docs.okd.io/4.4/
@@ -380,6 +387,7 @@ clusterInfo:
380387
consoleBaseAddress: https://` + host + `
381388
masterPublicURL: ` + mockAPIServer + `
382389
releaseVersion: ` + testReleaseVersion + `
390+
session: {}
383391
customization:
384392
branding: ` + string(operatorv1.BrandDedicatedLegacy) + `
385393
documentationBaseURL: ` + mockOperatorDocURL + `
@@ -415,6 +423,7 @@ providers: {}
415423
managedConfig: &corev1.ConfigMap{
416424
Data: map[string]string{configKey: `kind: ConsoleConfig
417425
apiVersion: console.openshift.io/v1
426+
session: {}
418427
customization:
419428
branding: online
420429
documentationBaseURL: https://docs.okd.io/4.4/
@@ -458,6 +467,7 @@ clusterInfo:
458467
consoleBaseAddress: https://` + host + `
459468
masterPublicURL: ` + mockAPIServer + `
460469
releaseVersion: ` + testReleaseVersion + `
470+
session: {}
461471
customization:
462472
branding: ` + string(operatorv1.BrandDedicatedLegacy) + `
463473
documentationBaseURL: ` + mockOperatorDocURL + `
@@ -495,6 +505,7 @@ providers: {}
495505
managedConfig: &corev1.ConfigMap{
496506
Data: map[string]string{configKey: `kind: ConsoleConfig
497507
apiVersion: console.openshift.io/v1
508+
session: {}
498509
customization:
499510
branding: online
500511
documentationBaseURL: https://docs.okd.io/4.4/
@@ -538,6 +549,7 @@ clusterInfo:
538549
consoleBaseAddress: https://` + host + `
539550
masterPublicURL: ` + mockAPIServer + `
540551
releaseVersion: ` + testReleaseVersion + `
552+
session: {}
541553
customization:
542554
branding: ` + string(operatorv1.BrandDedicatedLegacy) + `
543555
documentationBaseURL: ` + mockOperatorDocURL + `
@@ -601,6 +613,7 @@ clusterInfo:
601613
consoleBaseAddress: https://` + customHostname + `
602614
masterPublicURL: ` + mockAPIServer + `
603615
releaseVersion: ` + testReleaseVersion + `
616+
session: {}
604617
customization:
605618
branding: ` + DEFAULT_BRAND + `
606619
documentationBaseURL: ` + DEFAULT_DOC_URL + `
@@ -659,6 +672,7 @@ clusterInfo:
659672
consoleBaseAddress: https://` + host + `
660673
masterPublicURL: ` + mockAPIServer + `
661674
releaseVersion: ` + testReleaseVersion + `
675+
session: {}
662676
customization:
663677
branding: ` + DEFAULT_BRAND + `
664678
documentationBaseURL: ` + DEFAULT_DOC_URL + `
@@ -720,6 +734,7 @@ clusterInfo:
720734
consoleBaseAddress: https://` + host + `
721735
masterPublicURL: ` + mockAPIServer + `
722736
releaseVersion: ` + testReleaseVersion + `
737+
session: {}
723738
customization:
724739
branding: ` + DEFAULT_BRAND + `
725740
documentationBaseURL: ` + DEFAULT_DOC_URL + `
@@ -822,6 +837,7 @@ clusterInfo:
822837
masterPublicURL: ` + mockAPIServer + `
823838
controlPlaneTopology: External
824839
releaseVersion: ` + testReleaseVersion + `
840+
session: {}
825841
customization:
826842
branding: ` + DEFAULT_BRAND + `
827843
documentationBaseURL: ` + DEFAULT_DOC_URL + `
@@ -882,6 +898,7 @@ clusterInfo:
882898
controlPlaneTopology: External
883899
releaseVersion: ` + testReleaseVersion + `
884900
copiedCSVsDisabled: true
901+
session: {}
885902
customization:
886903
branding: ` + DEFAULT_BRAND + `
887904
documentationBaseURL: ` + DEFAULT_DOC_URL + `
@@ -946,6 +963,7 @@ clusterInfo:
946963
masterPublicURL: ` + mockAPIServer + `
947964
controlPlaneTopology: HighlyAvailable
948965
releaseVersion: ` + testReleaseVersion + `
966+
session: {}
949967
customization:
950968
branding: ` + DEFAULT_BRAND + `
951969
documentationBaseURL: ` + DEFAULT_DOC_URL + `
@@ -1228,6 +1246,7 @@ func Test_extractYAML(t *testing.T) {
12281246
},
12291247
Data: map[string]string{configKey: `kind: ConsoleConfig
12301248
apiVersion: console.openshift.io/v1
1249+
session: {}
12311250
customization:
12321251
branding: online
12331252
documentationBaseURL: https://docs.okd.io/4.4/
@@ -1238,6 +1257,7 @@ customization:
12381257
},
12391258
want: `kind: ConsoleConfig
12401259
apiVersion: console.openshift.io/v1
1260+
session: {}
12411261
customization:
12421262
branding: online
12431263
documentationBaseURL: https://docs.okd.io/4.4/

‎pkg/console/subresource/consoleserver/config_builder.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,8 @@ type ConsoleServerCLIConfigBuilder struct {
7070
oidcExtraScopes []string
7171
oidcIssuerURL string
7272
authType string
73+
sessionEncryptionFile string
74+
sessionAuthenticationFile string
7375
}
7476

7577
func (b *ConsoleServerCLIConfigBuilder) Host(host string) *ConsoleServerCLIConfigBuilder {
@@ -175,6 +177,8 @@ func (b *ConsoleServerCLIConfigBuilder) AuthConfig(authnConfig *configv1.Authent
175177
b.oidcIssuerURL = oidcProvider.Issuer.URL
176178
b.oauthClientID = oidcConfig.ClientID
177179
b.oidcExtraScopes = oidcConfig.ExtraScopes
180+
b.sessionAuthenticationFile = "/var/session-secret/sessionAuthenticationKey"
181+
b.sessionEncryptionFile = "/var/session-secret/sessionEncryptionKey"
178182
}
179183

180184
return b
@@ -237,6 +241,7 @@ func (b *ConsoleServerCLIConfigBuilder) Config() Config {
237241
Kind: "ConsoleConfig",
238242
APIVersion: "console.openshift.io/v1",
239243
Auth: b.auth(),
244+
Session: b.session(),
240245
ClusterInfo: b.clusterInfo(),
241246
Customization: b.customization(),
242247
ServingInfo: b.servingInfo(),
@@ -349,6 +354,14 @@ func (b *ConsoleServerCLIConfigBuilder) auth() Auth {
349354
return conf
350355
}
351356

357+
func (b *ConsoleServerCLIConfigBuilder) session() Session {
358+
conf := Session{
359+
CookieAuthenticationKeyFile: b.sessionAuthenticationFile,
360+
CookieEncryptionKeyFile: b.sessionEncryptionFile,
361+
}
362+
return conf
363+
}
364+
352365
func (b *ConsoleServerCLIConfigBuilder) customization() Customization {
353366
conf := Customization{}
354367
if len(b.brand) > 0 {

0 commit comments

Comments
 (0)